URN changes for DLP-NAC

Hello,

Please ignore the incorrect numbering. Based on Hal’s discussion today about the DLP-NAC profile, I changed the urn’s to be consistent with the list of identifiers in the core. Please let me know if this is better, and we’ll incorporate it into WD-08 (still looking for help generating sample policies for section 4.2). Thanks

1. Recipient-Subject-ID

This identifier indicates the entity that will receive the results of the request, which may include user identifiers, machine identifiers, and/or application identifiers.

Subject-ID classification values shall be designated with the following attribute identifier:

urn:oasis:names:tc:xacml:1.0:subject-category:recipient-subject:recipient-subject-id

The DataType of this attribute is http://www.w3.org/2001/XMLSchema#string.

1.1.1 Recipient-Subject-ID-Qualifier

This identifier indicates the security domain of the recipient subject. It identifies the administrator and policy that manages the name-space in which the recipient-subject id is administered.

Subject-ID-Qualifier classification values shall be designated with the following attribute identifier:

urn:oasis:names:tc:xacml:1.0:subject-category:recipient-subject:recipient-subject-id-qualifier

The DataType of this attribute is http://www.w3.org/2001/XMLSchema#string.

1.1.2 Requesting-Machine

This identifier indicates the address of the machine from which the access request originated. Requesting-machine classification values shall be designated with the following attribute identifier.

urn:oasis:names:tc:xacml:1.0:subject:requesting-machine

1.1.3 Recipient-Machine

This identifier indicates the address of the machine(s) to which the access will be granted. Recipient-machine classification values shall be designated with the following attribute identifier.

urn:oasis:names:tc:xacml:1.0:subject-category:requesting-machine:recipient-machine

The following DataTypes can be used with this attribute: urn:oasis:names:tc:xacml:3.0:data-type:ipAddress-value and urn:oasis:names:tc:xacml:3.0:data-type:dnsName-value. The attribute value may include full paths including volume names, where applicable. For Media Access Control (MAC) addresses, use http://www.w3.org/2001/XMLSchema#string. The attribute may take multiple values.

1.1.4 Recipient-removable-media

This identifier indicates whether or not the destination of the action is a removable media device. Recipient-removable-media classification values shall be designated with the following attribute identifier.

urn:oasis:names:tc:xacml:1.0:subject-category:requesting-machine:recipient-removable-media

The DataType of this attribute is http://www.w3.org/2001/XMLSchema#boolean.

1.2 Codebase Attributes

2.4.1 Authorized-Application

This identifier indicates whether or not the requesting application is approved for the actions requested.

urn:oasis:names:tc:xacml:3.0:subject-category:codebase:authorized-application