Re: [xacml-dev] xpath, urn:oasis:names:tc:xacml:1.0:resource:xpath

[Niko Matsakis <niko@alum.mit.edu>]

First, thank you for your quick response!

> You are correct that resource:xpath needs to be added to XACML 2.0.  
> This
> was identified as an errata:
>
>     http://lists.oasis-open.org/archives/xacml/200702/msg00001.html

Ok, that's good to know.  I did indeed check the errata list before  
posting, but I only saw an errata for the SAML

However, let me pose one additional question: in xacml 1.0, for  
example, the resource:xpath attribute in the example context has the  
value xmlns(md=...) xpointer(/md:record/md:patient/md:patientDoB).   
This is clearly not an xpath expression, but an xpointer one.  Does  
this mean that the XACML processor must also support xpointer?

I see that the XACML specifications (both 1.0 and 2.0) seem to use  
XPath/Xpointer interchangeably, even writing "XPath/Xpointer" on  
occasion.

> On the second part of your question, I think the answer is in  
> section B.6 p 129:
>
> 5036 This attribute identifies the resource to which access is  
> requested. If an <xacml
> 5037 context:ResourceContent> element is provided, then the  
> resource to which access is
> 5038 requested SHALL be all or a portion of the resource supplied  
> in the <xacml
> 5039 context:ResourceContent> element.
> 5040 urn:oasis:names:tc:xacml:1.0:resource:resource-id
>
> I interpret this to mean that the presence of this attribute  
> combined with the
> presence of the ResourceContent element makes that element the default
> root xpath from which other xpaths are derived.

While I agree that this interpretation helps the examples to make  
sense, I would not say it is exactly crystal clear from the text you  
quoted.  Furthermore, the text in the xpath section (A.3.15) clearly  
states "The <Request> element is the context node for every XPath  
expression," which seems like a contradiction.  So, if your  
interpretation is correct, I think an errata is definitely warranted.

I would also say that making the Resource element the "root" of the  
xpath evaluation  --- as opposed to the context node --- is a fairly  
involved transformation, as it involves creating (at least  
conceptually) a separate XML document from the <RequestContent>  
element [along with any inherited namespaces, etc].  Otherwise, as I  
read the specification, the xpath expression normally ranges over the  
complete request document.


regards,

Niko Matsakis