OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml-dev message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: RE: [xacml-dev] Conformance Tests for V1

Ohhh!!! Interesting, the Obligations must be filtered again by the
PolicySet using its Effect. 

Thanks for your help, I'll change that.

Diego Gonzalez
Lagash Systems SA

-----Original Message-----
From: Seth.Proctor@Sun.COM [mailto:Seth.Proctor@Sun.COM] 
Sent: Thursday, October 28, 2004 9:51 PM
To: diego gonzalez
Cc: xacml-dev@lists.oasis-open.org
Subject: Re: [xacml-dev] Conformance Tests for V1

diego gonzalez wrote:
> [...]
> But regarding IIIA014, why do you say "Policy2 Obligations are Permit
> Obligations", here is the list of Obligations (I've removed the
> AttributeAssignment elements)
> [...]
> There are 4 obligations, 2 of them are for Permit and 2 for Deny.
> the Policy2 will evaluate as Permit, obligations 3 and 4 must be
> returned. 

When Policy2 returns Permit, it also returns only those Obligations that

FulfillOn Permit (in this case, 1 and 2). But the parent PolicySet's 
combining algorithm ends up with a decision of Deny. At this point, the 
algorithm can only return Obligations with a FulfillOn of Deny. Thus, 
the Obligations from Policy2 are not included.


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]