Re: [xacml] [model] Proposal of Post Condition

[bill parducci <bill@parducci.net>]

NISHIMURA Toshihiro wrote:

> Though using <Conditions> element might be one option, I think it is
> preferable to place post conditions in <Statement>
> (<AuthorizationDecisionStatement>) element (but there is no room for
> it now).

Michiharu Kudoh wrote:

> First I had the same idea and if such modification is accepted by SAML,
> that would be the ideal way to take. Actually, I tried to find alternative
> solution that might work under a certain assumption.

yes, i agree. that is what i was hoping we were driving towards. in my
mind, this puts the responsibility of appropriate *action* on the PEP;
the PDP is only concerned with *decisions*, and those decisions are
finite (within the scope of the decision making process). personally, i
think that we should proceed with the assumption that SAML will be open
to modifications to their specification--if our reasoning is sound i do
not see why we would not be able to garner support for adoption.

b