Public Comment

[comment-form@oasis-open.org]

Comment from: Aleksey_Studnev@exigengroup.com

Comment is about RBAC profile specification changes:

>RECOMMENDs use of the following URI as the "role" Attribute >AttributeId: "urn:oasis:names:xacml:2.0:subject:role"

Problem here is that "role" entity is specific to an application. Subject attributes may be composed from multiple applications.
For example, user may be in role "administrator" for application 1 and "user" for application 2 and application 3.
In this case the subject must have something like:

app1:subject:role = "administrator"
app2:subject:role = "user"
app3:subject:role = "user"

So it seems to me that initial specication version where role attribute name was up to application is better. There is no sense to recommend any specific value, because it will cause ambiguities for say applications 2 and 3.