Re: [xacml-dev] Circular References in XACML PolicySets

[Seth Proctor <Seth.Proctor@sun.com>]

Hi Vladimir.

> Are cycles allowed in XACML PolicySet references?
> 
> For example, a PolicySet (PS) A refer  to a PS B, which in turn
> references C which refers to A. Would this be legal in XACML?
 
Yes, this is (unfortunately) entirely legal. You can also create cycles in
XACML 2.0 using VariableReferences. It's up to the policy developers to
understand their policies, and ensure that loops don't happen. A smart PDP
could alsobe written to catch these loops, but that's (often) substantially
difficult..


seth