[xacml-comment] Attribute designators

[John Howard <john.howard9@btinternet.com>]

Our vote is for Simon 1, as it is simpler and we have already implemented this solution.  I don't think the schema is broken so it shouldn't be changed.  Polar introduces a number of changes.

 

This needs to be kept simple.

 

In the majority of cases you are only going to require ORs and ANDs.  The structure

 

<Target>
   <Subject> <-- 'or' between <Subject> elements
      <SubjectMatch/> <-- 'and' between subject matches (always)
      <SubjectMatch/>
   </Subject>
   <Subject> <-- 'or' between <Subject> elements
   </Subject>
</Target>

 

is a much clearer syntax.

 

I have yet to see a use for the example (Select sa.attrA such that sa.attrB="valB" & sa.attrC="valC").  It only seems to be of benefit when you want to select an attribute from an anonymous Subject block.  Can this not be achieved by naming the Subject blocks and asking for that particular attribute.  e.g. <SubjectAttributeDesignator AttributeId="AttrC" Category="MainSubject">.  There is a lot less coupling and this seems far more intuitive for both the policy writer and for the building of the Request context.

 

The support for (Select sa.attrA such that sa.attrB="valB" & sa.attrC="valC") still looks contrived and appears to have been thrown together at the last minute.  This I suspect is why there is the continual need to clarify the syntax.  Unless desperately needed it would seem best to drop this support in version 1 to give more time to get the syntax correct. 

 

The main issue we have with Polar is that we are forced to implement this syntax to do a simple AND.  With Simon 1 we can implement this in a later version of our software.  To us this is a very important distinction as we need to have a deliverable product in September.

 

John.