RE: [xacml-users] Policy for Conformance Test IIC008 issue?

["Hal Lockhart" <hlockhar@bea.com>]

This is not the only problem with negative rules. Take a look at the discussion in section 9.1.7 of the main XACML spec. In fact I suggest you read all of section 9, since obviously you have not. XACML is not a maigc wand which will automatically do the right thing in all circumstances. It is a tool that depends on many other things in the environment.

Hal

> -----Original Message-----
> From: Kuketayev, Argyn [mailto:argyn_kuketayev@fanniemae.com]
> Sent: Monday, October 04, 2004 5:05 PM
> To: Anne.Anderson@Sun.COM
> Cc: xacml-users@lists.oasis-open.org
> Subject: RE: [xacml-users] Policy for Conformance Test IIC008 issue?
> 
> 
> 
> 
> > -----Original Message-----
> > From: Anne Anderson [mailto:Anne.Anderson@Sun.COM] 
> > Sent: Monday, October 04, 2004 10:00 AM
> > To: Argyn
> > Cc: xacml-users@lists.oasis-open.org
> > Subject: Re: [xacml-users] Policy for Conformance Test IIC008 issue?
> > 
> > 
> > Argyn,
> > 
> > I looked up the actual description of what is being tested 
> > here (in the html file describing all tests).  The 
> > description in the policy itself is incorrect.  But the test 
> > is testing for correct handling of an empty bag passed to a 
> > function.  There is no "convicted-felon" attribute in the 
> > corresponding Request, so the bag will be empty, and the 
> > result is NotApplicable.
> 
> Thanks for clarification. I fugured that req, policy and 
> response match.
> It's just this description is confusing
> 
> Argyn
>