RE: [security-services] Issues from SAML/XACML review

["Scott Cantor" <cantor.2@osu.edu>]

> 3. Lines 1986-8: The sentence "For data types corresponding to the types
> defined in Section 3.3 of [Schema2], the xsi:type XML attribute
> SHOULD also be used." is perhaps questionable because the XACML spec has
> no corresponding SHOULD, and presumably this attribute profile exists to
> serve interop.  Do we want to retain this as a SHOULD, or would it be
> more proper to turn it into a non-normative note that merely explains
> the presumed relationship between DataType and any presence 
> of xsi:type?

My reason is simply that the goal isn't purely interop with XACML but
"aligning attribute use across both specs". Meaning that SAML advises use of
xsi:type in this way because we don't use a second data typing approach, and
by including it in this case, you can follow SAML hygeine for attribute
values without complicating the XACML mapping.

>   It seems to me to be a sufficiently non-substantive point that it's
> safe to muck with if we wish.  In any case, it's probably worth
> editorially clarifying that xsi:type would appear on <AttributeValue>,
> not the parent <Attribute> (as opposed to the DataType 
> attribute, which appears on <Attribute>).

Agree it could be clarified.

-- Scott