Re: [xacml] Obligation and Advice handling in case of indeterminates

[Erik Rissanen <erik@axiomatics.com>]

Hi Jan,

There are some discussions on this in the mailing list archives.

Basically, an Indeterminate means that an error has happened and the PDP cannot figure out what the decision should be. In light of that, it is a bit of a contradiction in terms that the PDP still would calculate what obligations goes with the decision.

I guess it might be possible to extend the model, but I think it would be entering into suspect territory to do so, with possible unintended consequences.

Best regards,
Erik


On 2012-08-10 12:38, Herrmann, Jan wrote:

Hi all,

 

Regarding Obligation and Advice handling in case of indeterminates the spec says the following:

 

“…As a consequence of this procedure, no obligations or advice SHALL be returned to the PEP if the rule, policies, or policy sets from which they are drawn are not evaluated, or if their evaluated result is "Indeterminate" or "NotApplicable", or if the decision resulting from evaluating the rule, policy, or policy set does not match the decision resulting from evaluating an enclosing policy set.”

 

I encountered differen use cases were this constraint led to several limitations. Why did we define this constraint. Is it explicitly required? What if obligations get dischared in an obligation handler called by the context handler and not by the pep. What I would need is the option return obligations even if some indeterminate occurs.

 

Thanks upfront for your thoughts on this issue.

 

Best regards

Jan

 

 

With best regards,
Jan Herrmann

Siemens AG
Corporate Technology
Corporate Research and Technologies
CT RTC ITS SEA
Otto-Hahn-Ring 6
81739 Munich, Germany
Tel.: +49 89 636-40612
mailto:jan.herrmann@siemens.com