Minutes for 8 September 2011 TC Meeting

[rich levinson <rich.levinson@oracle.com>]

Time: 13:00 EDT (=GMT-0400)
Tel: 513-241-0892
Access Code: 65998

Minutes for 8 September 2011 TC Meeting:

I Roll Call

David Brossard
Erik Rissanen
Paul Tyson
Remon Sinnema
Bill Parducci
Anthony Nadalin
Rich Levinson
Hal Lockhart
Crystal Hayes
Richard Hill
John Tolbert

  Approve Minutes:

   25 August 2011 TC Meeting
    http://lists.oasis-open.org/archives/xacml/201108/msg00017.html

     hal: approved no objection

II Administrivia

    V3 Status:
     at aug 11 mtg, bill reported:
      bill: chet is taking next steps to advance the process, however,
	15-day pub rev has not yet started - in hands of tc-admin
     last update from tc-admin: aug 1:
       http://lists.oasis-open.org/archives/xacml/201108/msg00002.html
     is there an update to this status?

      bill: there is TOC SAML issue, but tc-admin is active moving
	specs ahead.

    V3: bitkoo attestation:
      http://lists.oasis-open.org/archives/xacml/201108/msg00011.html

    IPC WD-03 DOC uploaded for consideration to elevate to CD then CS:
     discussion at aug 11 mtg indicated update might be in order
     follow-up discussion: paul submitted comments w attachment:
       http://lists.oasis-open.org/archives/xacml/201108/msg00010.html
    IPC WD-04 DOC (xacml-3 0-ipc-v1 0-spec-wd-04-en.docx) uploaded:
       http://lists.oasis-open.org/archives/xacml/201109/msg00005.html

     john: incorporated comments plus some additional;
	new draft posted for comments, if ok will advance in process;

     paul: thinks profile is still significant way from moving fwd,
	would like to see some realistic scenarios. looked at latest
	draft and will respond
     hal: defining identifiers doesn't mean commitment to particular
	policy model; important topic for discussion, but generally
	benign as it stands.
     paul: there are relationships in form of subsidiaries, holding
	company, etc. - can flatten it out w attrs, but lose something
	doing that


    Conformance requirements: some discussion probably still needed:
     details of oasis rules posted in july mtg minutes:
      http://lists.oasis-open.org/archives/xacml/201107/msg00035.html
     while it appears there is adequate text to meet oasis reqts,
      there may be questions as to the open-endedness of the
      statements, being too broad to be practical to verify.
     Bug in conformance test?: (should be covered by above discussion)
      http://lists.oasis-open.org/archives/xacml/201107/msg00002.html
     hal commented: still need to get 3.0 tests to point where people
         can determine if they are compatible.

    ->  rich: post clarification on what comments mean "too broad to
	be practical".
       hal: where are 3.0 tests in terms of status? (no reply)
       ?: are there any hier tests? rich,erik: think so

    Cloud environment:
     Hal: will post original dee email, and slide deck to see if
	can be improved and will provide to oasis for their use.
	speaker may not be xacml-literate, so notes on slides
	should be reviewed as well:
   ->  all: review slides when hal posts


    Follow up discussion on Andrea Westerinen Policy Language
     presentation (Aug 25, 2011):
      martin:
       http://lists.oasis-open.org/archives/xacml/201108/msg00019.html
      paul:
       http://lists.oasis-open.org/archives/xacml/201108/msg00018.html


III Issues:

   Combining Algorithms&  the Hierarchical Resource profile
    (ray issue and responses to rich comments)
     http://lists.oasis-open.org/archives/xacml/201109/msg00000.html
     http://lists.oasis-open.org/archives/xacml/201109/msg00002.html
     http://lists.oasis-open.org/archives/xacml/201109/msg00004.html

Issue status:

   Old issues: several issues are in various stages of discussion.
    None appear to be critical path for 3.0 approval. The aug 11
    minutes contains links:

   Old actions:
    Proposed list of XACML 2.0 ->    3.0 differences:
     actions from last mtg minutes:
      http://lists.oasis-open.org/archives/xacml/201107/msg00035.html
    ->   david: will be editor: work will be on wiki
    ->   hal: will post prev presentations
    ->   rich: wanted to be able to add page(s) to wiki
    Terminology issue: Need "entity" notion in spec and/or support doc:
     rich has action (last wk's minutes):
      http://lists.oasis-open.org/archives/xacml/201107/msg00008.html

     david: please people comment on wiki page
    ->  all: comment on wiki page

    REST-based query profile:
      hal: could david comment
      david: may convert xacml to JSON to be REST profile; no estimate
        maybe openaz would be good place to host that;

   hal: other issues? none (items below not discussed)
	next call Sep 22.
	meeting adjourned 1:30 PM



    Attribute predicate
     Greg Neven indicated that he will try to have an update by the next TC
     meeting.

   some xacml dev topics:
   Q&A on following topics in Aug archives:
    http://lists.oasis-open.org/archives/xacml-dev/201108/maillist.html
     Database data access control using XACML
     Confused about usage of XPath and resource content in XACML
     XPath and XACML
     Questions about RBAC profile of XACML
   In Sep:
    http://lists.oasis-open.org/archives/xacml-dev/201109/maillist.html
     RuleML2011@BRF Challenge - Extended deadline

   xacml-comment:
    Reduction Should Use Extended Indeterminate Values
     http://lists.oasis-open.org/archives/xacml-comment/201108/msg00001.html
     http://lists.oasis-open.org/archives/xacml-comment/201109/msg00000.html
    user having problem w schema:
     http://lists.oasis-open.org/archives/xacml-comment/201108/msg00000.html
    erik reply:
     http://lists.oasis-open.org/archives/xacml-comment/201109/msg00001.html