Re: [xacml-users] AttributeSelector usage

[seth proctor <Seth.Proctor@Sun.COM>]

Prakash Yamuna wrote:
> [...]
> 
> Is this truly a spec restriction (or a bug in the implementation I am using)? 

Now wait a minute! :)

My reading of the spec is that, indeed, AttributeSelectors must convert 
the nodes they select, so no, you cannot select an element and use it 
(and its children) to represent some new datatype you've defined. Do I 
think this is limiting? Yes. I don't think it's too terrible, since you 
can always select on individual sub-elements, but I don't see why the 
spec needed to include this restriction.

Now, this said, I could be wrong. It would not be the first time on this 
topic, since the spec has been remarkably incomplete or misleading in 
the past when it comes to the AttributeSelector element. This is part of 
why I implemented the XPath handling of AttributeSelector in a separate 
module of my code. It makes it easy to include/exclude from a 
deployment, and it makes it much easier to replace with alternate 
implementations if needed. If you want to try implementing the support 
you're looking for, I'd be happy to help you figure this out, but I 
don't think it's teechnically compliant with the spec.


seth