[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]
Subject: Re: [xacml] Proposed resolution from PM-8-01 to PM-8-07
I support these. -Anne On 22 March, Michiharu Kudoh writes: [xacml] Proposed resolution from PM-8-01 to PM-8-07 > From: Michiharu Kudoh <KUDO@jp.ibm.com> > Subject: [xacml] Proposed resolution from PM-8-01 to PM-8-07 > Date: Fri, 22 Mar 2002 15:26:39 +0900 > > I believe the following issues from Issues Version 05 for which I am listed > as the champion can be closed based on our latest > Face-to-Face agreements: > > - ISSUE: PM-8-01: Internal v.s. External post conditions > XACML does not support any distinction between internal obligation and > external obligation. It depends on the configuration of PEP and/or PDP. > > - ISSUE: PM-8-02: Mandatory v.s. advisory post conditions > XACML does not support any distinction between mandatory obligation and > advisory obligation. The meaning of the obligation is determined in each > application. > > - ISSUE: PM-8-03: Inapplicable > The obligation is not returned to PEP when the authorization decision is > determined as inapplicable or indeterminate. > > -ISSUE: PM-8-04: Base policy v.s. policy reference > The obligation is specified in both policyStatement and > policyCombinationStatement. The scope of the obligation is defined in > ISSUE: PM-1-02 as "The set of obligations returned by each level of > evaluation includes only those obligations associated with the effect > element being returned by the given level of evaluation. For example, a > policy set may include some policies that return Permit and other policies > that return Deny for a given request evaluation. If the policy combiner > returns a result of Permit, then only those obligations associated with the > policies that returned Permit are returned to the next higher level of > evaluation. If the PDP's evaluation is viewed as a tree of > policyCombinationStatements, policyStatements, and rules, each of which > returns "Permit" or "Deny", then the set of obligations returned by the PDP > will include only the obligations associated paths where the effect at each > level of evaluation is the same as the effect being returned by the PDP." > > -ISSUE: PM-8-05: How to return post-condition via SAML > (I will post the resolution for this issue later) > > -ISSUE: PM-8-06: When to execute post condition > When and how PEP executes obligation depends on each application. XACML (as > PDP) does not assume any specific semantics. While obligation implies that > specified operation must be dealt with prior to the requested access, it > does not necessarily mean that the specified operations must be executed > synchronously. Taking the obligatory operation usage scenario like > "customers can register themselves with their private information provided > that such information is deleted in 90 days--- obligation is > delete-in-90days", it is impossible to execute "delete-in-90days" > obligation prior to the requested access. It would be reasonable if such > operation is queued in the application and guaranteed to be executed later. > > -ISSUE: PM-8-07: Extension point (line 1315 is typo, the issue number > should be PM-8-07) > Extension point of obligation is 1. obligationId in policyStatement or > policyCombinationStatement and 2. ruleSet combiner or policySet combiner. > This allows policy writers to specify arbitrary identifier of the > user-defined obligation and to specify the semantics of how obligation is > computed in response to the access request. > > Michiharu Kudo > > IBM Tokyo Research Laboratory, Internet Technology > Tel. +81 (46) 215-4642 Fax +81 (46) 273-7428 > > > > ---------------------------------------------------------------- > To subscribe or unsubscribe from this elist use the subscription > manager: <http://lists.oasis-open.org/ob/adm.pl> > -- Anne H. Anderson Email: Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]
Powered by eList eXpress LLC