[xacml] Multiple actions per decision request

[Tim Moses <tim.moses@entrust.com>]

Title: Multiple actions per decision request

Colleagues - In the SAML issues document,

http://www.oasis-open.org/committees/security/docs/draft-sstc-core-discussion-01.doc

... Issue 5.1.15.2 seeks guidance on whether multiple "actions" can be specified in a single decision request.

I feel that XACML should answer this question and send its conclusion in a liaison to SAML.

My feeling is that the answer is "No".  If "applicable policy" is to be identified with the resource/action pair, then multiple "applicable policies" are involved when multiple actions are involved.  Much "cleaner" for there to be a single "applicable policy" for each decision request.  And, therefore, a single action per decision request.  It is no great hardship to submit multiple decision requests, in the event that you need a decision for each of several actions.

Any thoughts?  All the best.  Tim.

-----------------------------------------
Tim Moses
Tel: 613.270.3183