[xacml-comment] XACML Context

[John Howard <john.howard9@btinternet.com>]

Some thoughts on the XACML context.

 

1.  Would it be possible to restrict both the context and the policy to known attributes, these attributes being defined separately, so that the policy does not contain details of how to retrieve attributes.  The advantage of this approach is that it defines the attributes available to the policy writers and creates an abstraction layer between the policy and the source of the attributes.  If the location of the attribute changes, the policy does not, additionally the policy looks a lot cleaner and does not require AttributeSelectors.  The main driver for this is to simplify the policies and make them easier to write.  Most organizations will define the attributes at the beginning and they will largely remain fixed, so separating attribute details from policy has major benefits.

 

2.  When mapping from SAML to XACML context we feel that the SAML attribute assertions should be converted to XACML attribute definitions.  One of the purposes of the context is to shield XACML from external formats, but that is not really achieved here and the attributes have to be accessed through AttributeSelectors.

Our thoughts on this were that it would be simpler if the context had an evidence element to contain additional attributes.

 

e.g.

 

<Request>

    <Subject>

    </Subject>

    <Resource>

    </Resource>

    <Action>

    </Action>

    <Evidence>

    </Evidence>

    <Environment>

    </Environment>

</Request>

 

Non subject SAML attributes are placed in the Evidence section and can then be accessed via AttributeDesignators.  It may be appropriate to add attributes retrieved by the PIP to this section as well, so that the policy always addresses the context to obtain attribute values.

 

John Howard