[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Does the XACML 2.0 and 3.0 Subject have some inconsistencies in Coreand Multi Profile?
Hi Erik and TC, Been looking at how the Subject evolved in 2.0 to 3.0 plus a possible problem in 2.0 that may or may not carry over to 3.0. First the possible problem:
The above "problem" may or may not go away in 3.0. It appears that the semantics of section 6.2 from 2.0 are "lost" in 3.0, because all the "categories are now Attributes and the designators for Subject, Resource, Action, Environment no longer exist, except as they are buried in identifiers, and as 3.0 refers to them as "RECOMMENDED" in XACML 3.0 section B.2. Assuming that is ok (although I am becoming increasingly uneasy the generalizing "Subject, Resource, Action, Environment" to "Attributes", and allowing "Attributes" to go beyond those four conceptual entities, may cause us to lose a lot of implicit semantics carried by the XACML 2.0 designations of these four entities), I noticed what might be considered to be "creeping functionality" in the XACML 3.0 Multiple Resource Profile. In particular:
The bottom line is that I don't think the access by multiple subjects will work in the 3.0 profile, at least because there will now be no way to determine which members of one subject-category are associated with the members of the other subject-categories. My recommendation is that at the very least, we pull back the multiple subject notion from the multi-resource profile for now. Also, I suggest that we put an errata in for 2.0 removing the lines 2921-2923 as they seem to contradict the intentions specified elsewhere in the 2.0 document, which have also been carried forward to 3.0. Thanks, Rich |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]