RE: [security-services] Potential errata for Core

["Scott Cantor" <cantor.2@osu.edu>]

robert.philpott@rsa.com wrote on 2009-12-09:
> This is, of course, schema-valid.  The question is whether the absence
> of the <AttributeValue> element means that the value of that attribute
> is empty or whether it means it is nil (since these are two different
> states), or should it be disallowed (through normative language, not a
> schema change)?

There's a fourth option, which I believe is the one we settled on at the
time, and that's "has no values". "nil" was itself considered a value state,
specifically the "NULL" concept we're all familiar with.

I think of it like an array. No elements would mean no values (size 0), but
a nil would be 1 value (size 1).

> In these 2 items, we don't state that an <AttributeValue> element MUST
> be present.  We state that "the corresponding <AttribtueValue> element
> MUST be empty...".   To me, that implies it has to be present, but
> doesn't say so.  It doesn't address how to interpret it if it is not
> present.

I would interpret the empty/nil cases as implying it's present, but it's
fine if you want to clarify that.

> There are a couple of options:
> 1)	In both cases, we change the text to say that the
> "<AttributeValue> element MUST be specified and MUST be empty..."
> 2)	We define how to interpret the case of it not being present and
> amend the text to account for that.

I think 2 is independent of 1, which is just a clarification.

> In the case of 2), do folks think that the absence of the
> <AttributeValue> should mean that the attribute has a null value?

No, definitely not.

> example).Or do folks interpret 2) to mean the attribute has an empty
> value.  I think the former case makes more sense to me.

It means neither of those things, that much I'm 100% certain of.

-- Scott