RE: [xacml] subjects

[Carlisle Adams <carlisle.adams@entrust.com>]

Title: RE: [xacml] subjects

Hi,

----------
From:   Anne Anderson[SMTP:Anne.Anderson@Sun.com]
Reply To:       Anne.Anderson@Sun.com
Sent:   Tuesday, November 05, 2002 9:30 AM
To:     XACML TC
Subject:        Re: [xacml] subjects

On 4 November, Polar Humenn writes: Re: [xacml] subjects
 > I think a better more workable solution would be to make the subjects
 > (i.e. lists of attributes) unique to the category, and use the present
 > SubjectAttributeDesignator (with the SubjectCategory part)  and get rid of
 > the SubjectAttributeDesignatorWhere. That's simple and I think everybody
 > can get their brains wrapped around that.

I can live with this.  What we lose is the ability to associate
attribute values with the identities and authentication methods
under which those attributes were issued.  We can continue to try
to improve this for 1.1 or 2.0.  I really think we are going to
need some serious thought to solve the problems raised by
SADWhere, and I would rather have a good solution than a complex,
understudied, possibly unworkable one.

 
This is my vote as well:  something workable in most cases for 1.0; something fancier for 1.1 / 2.0.

Carlisle.