questions on the SAML profile for XACML.

["Shawn Ma" <sma@bea.com>]

Hi all,

 

I'm trying to do something with the SAML profile for XACML. But found some confusing questions.

 

1. The SAML profile for XACML specifies an element <XACMLAuthzDecisionQuery>, which is a replacement of <samlp:AuthzDecisionQuery> element. In section 6 of that spec, there's a requirement saying "An <XACMLAuthzDecisionQuery> or <XACMLPolicyQuery> SHALL be encapsulated in a <samlp:RequestAbstractType> element, which MAY be signed."

 

My question is, the samlp:RequestAbstractType in SAML 2.0 is not an element, it is just a type, how can a XACML query be put in such an element/type?

 

In other words, how to fill the 'ELEMENT_NAME' in the following soap call? <XACMLAuthzDecisionQuery>?

<SOAP-ENV:Body>
 <samlp:ELEMENT_NAME xmlns:… ID=”123456” Version=”2.0”…>
  <ds:Signature>…</ds:Signature>
  <xacml-context:Request xmlns:xacml-context=”…”>
   …<Action>…<Subject>…
  </xacml-context:Request>
 </samlp:ELEMENT_NAME>
</SOAP-ENV:Body>

2: in the response, the <XACMLAuthzDecisionStatement>, as a replacement of <samlp:AuthzDecisionStatement>, is stated to be put in a <saml:Assertion>. But the <saml:Assertion> by schema can't conatain an <XACMLAuthzDecisionStatement> directly. Does this mean that the <XACMLAuthzDecisionStatement> should be put in a <saml:Statement> with xsi:type like this?

<saml:Assertion>

...

   <saml:Statement xsi:type="xacml-saml:XACMLAuthzDecisionStatement">

        <xacml-saml:Response>....

  </....>

 

3. Why so complicated? Why don't we just have a SOAP profile for XACML, so we can directly <xacml-context:Request> and <xacml-context:Response> in a SOAP body? I'm a bit curious.

 

Thanks,

Shawn

bea.bmp