RE: [xacml] Proposed semantics for operations involving INDETERMI NATE

[Daniel Engovatov <dengovatov@crosslogix.com>]

Title: RE: [xacml] Proposed semantics for operations involving INDETERMI NATE

>> In fact what we are discussing is that functions in the constraint may
>> "throw exception", beside
>> returning "true" or "false".  I think we do need clear protocol to
>> communicate that - we should not
>> lump together a case when no applicable rule was found with the case of
>> database connection timed out..

>i fundamentally disagree. you are asking the the authorization decision
>conversation to encompass operational behaviors. to what end?

To the end of allowing to communicate "Not available" from "Not applicable"
That is a result of policy evaluation - three distinct. pricipally different outcomes:
decision/no applicable rules/could not evaluate.
You may do at the external protocol layer. I suggest we provide standard way of doing
that between PDP and PEP, not just leave it hanging.

>let's
>assume that there is a throw deep within the bowels of some external
>function during policy evaluation. what is the PEP supposed to do with
>that information?

What's it is supposed to do with GRANT? Or DENY?  Whatever is appropriate in
a concrete application - that's not part of policy discription and policy query
protocols.  We may state that PEP may treat ERROR==UNDETERMINATE by default,
but not providing a way to convey this fundamentally different state in the
response is not helpful in my opinion.

You will have exceptions. That's a fact.  In one form or another.
Not having a clear strategy what to do with this will not make it more
robust or secure.

Daniel.