[xacml-comment] When to obtain attributes from the PIP.

[Wes Kubo <wkubo@galdosinc.com>]

First off, thanks for all the help that I've received on this list.

On to my question-> In our implementation we're finding it necessary to
obtain attributes about the Subject and hence are going to implement a PIP.
I'm having some trouble trying to figure out at which point the attributes
need to be obtained. I see that this was covered briefly
http://lists.oasis-open.org/archives/xacml/200210/msg00035.html and
http://lists.oasis-open.org/archives/xacml/200210/msg00035.html but possibly
never resolved.  I noticed that Anne proposed a section 7.x Request Context
but this doesn't seem to have been included in the spec. It boils down to
this: at which point is the PDP required to request additional/missing
attributes from the PIP? Are they obtained before the policy is evaluated or
as I believe, when required during function evaluation?

Thanks.

Wes