Re: [xacml] Delegation with open attribute categories

[Erik Rissanen <mirty@sics.se>]

Anne Anderson - Sun Microsystems wrote:
> Erik,
>
> Erik Rissanen wrote On 09/20/06 09:24,:
>
>> But I am not sure what the gain would be. XACML 3.0 policies would not
>> be understandable by a 2.0 PDP in any case. A 3.0 implementation can
>> internally translate 2.0 policies into 3.0 form, so it could load both
>> types of policies. Am I correct?
>>
> The gain is that every 3.0 PDP could load 2.0 policies, and not just
> those that choose to do internal translations.  We would essentially
> be making support by 3.0 PDP's for 2.0 policies mandatory.  The
> internal implementation would probably be a translation, but that is
> up to the 3.0 PDP implementer.
>
> Regards,
> Anne

I agree that there is a point in making 3.0 PDPs support 2.0. But
wouldn't it be easier to say that a 3.0 implementation MUST be able to
translate 2.0 policies? I doubt we need the ability to mix 2.0 and 3.0
in the same document.

Regards,
Erik