Re: [xacml-users] what is the difference between Ordered-deny-overridesand Deny-overrides

["Rich.Levinson" <rich.levinson@oracle.com>]

Hi Jack,

One consideration is Obligations. Different Policies can return 
different Obligations. If request is denied by Policy 1, there will, in 
general, be different Obligations than if denied by Policy 2. If 
unordered, then precise results (set of returned Obligations) are 
unpredictable. If ordered then same result (same set of Obligations) 
should be returned every time.

    Thanks,
    Rich


smith jack wrote:
> though i have read that specification. i am still confused.
> There is little difference, as the specfication said: when envaluated,
> the order should follow the order how policies listed in policyset.
> but will this matter?
> if one Rule return Deny, they both will Deny.
> (So the only difference is that, Deny-overrides is much more flexible
> than Ordered-deny-overrides, right? since envaluated in random order,
> may fail much faster, and will gain
> better performace, is this opinion correct? if not, it will be
> appreciate that you point the fault, and tell how to correct it)
> thank you:)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: xacml-users-unsubscribe@lists.oasis-open.org
> For additional commands, e-mail: xacml-users-help@lists.oasis-open.org
>
>