[xacml] Update to "Successfully Using the XACML Specification"...

[Carlisle Adams <carlisle.adams@entrust.com>]

Title: Update to "Successfully Using the XACML Specification"...

Hi,

After a brief exchange for clarification over the mail list, and after some discussion on yesterday's teleconference, I have slightly modified the text for "successfully using" our spec.

Michiharu:  can you please post this on our Web site (perhaps at the end of the "Charter" section)?

Carlisle.

8<-----------------------------------

"Successfully Using the XACML Specification"

XACML is an XML schema for representing authorization and entitlement policies.  However, it is important to note that a compliant Policy Decision Point (PDP) may choose an entirely different representation for its internal evaluation and decision-making processes.  That is, it is entirely permissible for XACML to be regarded simply as a policy interchange format, with any given implementation translating the XACML policy to its own local/native/proprietary/alternate policy language sometime prior to evaluation.

A set of test cases (each test case consisting of a specific XACML policy instance, along with all relevant inputs to the policy decision and the corresponding PDP output decision) will be devised and included on the XACML Web site.

 
In order to be "successfully using the XACML specification", an implementation MUST, for each test case, have a "policy evaluation component" that can consume the policy instance and the inputs and produce the specified output.  Furthermore, the implementation MUST have a "policy creation component" that allows it to generate schema-valid XACML policy instances that can be consumed/processed by other PDPs.

Note that, aside from the XACML policy instance itself, all PDP inputs and outputs MUST be SAML-compliant (i.e., conform with the assertions and protocol messages defined in the SS-TC SAML specification), although other syntaxes/formats for the PDP input and output MAY be supported in addition to this.