[xacml] Proposed resolution to MI-1-03: Definition and purpose ofTarget

[Anne Anderson <Anne.Anderson@Sun.com>]

Based on the March 2002 Face-to-Face, I believe this issue, which
has no champion, is ready to be closed.

Resolution: a <target> element consists of three predicates over
elements in a SAML access decision request: one over Subject, one
over Resource, and one over Action.  Any of these predicates may
be universal in that they may result in "true" for "anySubject",
"anyResource", or "anyAction".

the <target> element in a <rule>, <policyStatement>, or
<policyCombinationStatement> has two purposes.  First, it allows
<rule>s, <policyStatement>s, and <policyCombinationStatement>s to
be indexed based on their applicable subject, resource, and/or
action.  Second, it allows a PDP to quickly and efficiently
reduce the set of <rule>s, <policyStatement>s, and
<policyCombinationStatement>s that must be evaluated in response
to a given access decision request.

These intended purposes place three restrictions on what can be
included in a <target>.  First, the predicates in a <target> must
be very efficient to evaluate.  Second, each predicate in a
<target> must refer to only one of <subject>, <resource>, and
<action> (for indexing purposes).  Third, each predicate in a
<target> must refer only to attributes that will always be
present in a SAML access decision request, since a <target> must
not return a result of "indeterminate".

In a <rule>, the <target> element is logically part of the
<condition> element.  Were indexing and efficiency not a concern,
the tests in the <target> could be incorporated into the
<condition>.  The <target> element serves as the "first pass"
test for whether the rule applies:

    if (<target> == true) {
        if (<condition> == true) {
            return <effect>;
        }
    }
    return <not applicable>;

Anne
-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692