Re: [xacml] Decision required: Issue#70: Must Policy[Set]Id matchvalue used in a corresponding Policy[Set]IdReference?

[Seth Proctor <Seth.Proctor@sun.com>]

In today's TC call I promised to capture a quick summary of the use-cases I
covered. Essentially, there are two main uses I have seen where reference
identifiers and policy identifiers don't match up:

  1. A policy is managed at a single point, but pushed to multiple PAPs
     for use. This may be because some PAPs are accessible only from
     specific domains, specific applications, etc. The PAPs provide the
     access to the same policy via different protocols (e.g., http, ldap,
     local filesystem, ebXML Registry, custom application, etc.). The
     policies that reference this policy all want to use different
     reference identifiers because they want to encode details of the
     resolution mechanism. For instance the three reference identifiers

       http://example.com/site/policies/global-policy.xml
       /net/server1/files/policies/gp1.xml
       svn://server1/site/policies/global.xml

     could point to the same policy. If the reference and policy identifiers
     must match, then this cannot be done. Instead, the referring policies
     must all use the same identifier, and their PDPs must each be configured
     to know how to do the mapping. This assumes, of course, that all
     references from a given PDP use the same protocol, and don't host
     policies that want to use different protocols in different scenarios.

  2. A policy is managed at a single point, but different entities or
     domains know this policy by different identifiers. This could be because
     of naming conventions (e.g., at Sun we call this the "corporate policy"
     but at Example.com they call it "legal policy") or for good object
     design reasons (i.e., I would like the same policy that represents
     mixed logic to be referenced by different names when a specific use
     is called out, like "site access" or "weekend access" referring to
     the same policy). This does not have the functional requirements of
     case 1, so it's just a naming and design issue that is impacted by
     requiring all reference and policy idetifiers to match.


seth