Re: [xacml] [CR] New Section 7.x: Request context. Forwarded messagefrom Seth Proctor.

[Anne Anderson <Anne.Anderson@Sun.com>]

------- start of forwarded message -------
From: Seth Proctor <seth.proctor@sun.com>
To: Anne Anderson <Anne.Anderson@sun.com>
Subject: Re: [xacml] [CR] New Section 7.x: Request context
Date: Tue, 8 Oct 2002 15:53:14 -0400


> If a referenced attribute is not available in the cached list of
> attributes or among those supplied by the PEP, then a request is
> made to the PIP for a value for the referenced attribute.  This
> request is implementation-dependent, and is not visible to the
> PDP.  If the PIP is not able to supply a value for the attribute,
> then a result of "Indeterminate" due to "Missing attribute" is
> returned to the PDP.

As I pointed out yesterday, the PDP _is not_ shielded from the implementaion
dependent stuff. There is no standard that describes what a PIP is, or how
a PDP talks to it in any standard way, so either the PDP is the PIP (and
therefore knows all the implementation-dependent issues), or the PDP talks
to a PIP, and therefore defines an implementation-dependent communication
model. Either way, the PDP is not being shielded from anything. If you want
to be pedantic about the PIP being a conceptually different thing, that's
fine, but from an implementation and an interoperability point of view, it
doesn't help anything.

Also, in your last paragraph, I think it's confusing how you tried to fold
in the language about short-circuit evaluation. This is a separate topic,
and needs to be discusssed in greater detail in its own section.


seth

------- end of forwarded message -------

-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692