Re: [xacml-users] hierarchical resources

[seth proctor <Seth.Proctor@sun.com>]

Argyn wrote:
> your problem would be to find PDP which actually supports hierarchical 
> resources

SunXACML supports the 1.x notion of Hierarchical Resources.

Dhirendra - While I haven't done a lot of work with hierarchies, what 
you've described seems like a pretty reasonable approach. You could also 
think about defining the company memberships as nested groups and 
writing your policies to say "if the user is in this group" with an AFM 
or custom function that expands correctly. For that matter, you could 
just use some regexp or XPath notation, but I think that gets less 
flexible pretty quickly.


seth