have a question about the extended Indeterminate values
in the case that the Target of a Policy or PolicySet
matches to Indeterminate.
can’t find any definition about this case in
you please tell me which one of the following
solutions is correct?
All rules appended to
Policy or PolicySet must be checked. If all of them have
the effect Permit, the
indeterminate value is Indeterminate(P). If all of them
have the effect Deny,
the value is Indeterminate(P). Otherwise the value is
It can be assumed that
always a rule with a deny effect and a permit effect is
appended and therefore
Indeterminate(DP) is returned
All appended Policies
must be evaluated. If all of them are Indeterminate(P) or
Indeterminate(P) is returned. If all of them have the
effect Deny or
Indeterminate(D) Indeterminate(D) is returned. If at least
one is Deny or
Indeterminate(D) and another one is Permit or
Indeterminate(DP) is returned.
Indeterminate with no
value should be returned
it is the case that an Indeterminate is returned I
can’t see a definition how this is combined in the
anybody help me in this case?