OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml-users message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [xacml-users] what is the difference between Ordered-deny-overridesand Deny-overrides

Hi Jack,

One consideration is Obligations. Different Policies can return 
different Obligations. If request is denied by Policy 1, there will, in 
general, be different Obligations than if denied by Policy 2. If 
unordered, then precise results (set of returned Obligations) are 
unpredictable. If ordered then same result (same set of Obligations) 
should be returned every time.


smith jack wrote:
> though i have read that specification. i am still confused.
> There is little difference, as the specfication said: when envaluated,
> the order should follow the order how policies listed in policyset.
> but will this matter?
> if one Rule return Deny, they both will Deny.
> (So the only difference is that, Deny-overrides is much more flexible
> than Ordered-deny-overrides, right? since envaluated in random order,
> may fail much faster, and will gain
> better performace, is this opinion correct? if not, it will be
> appreciate that you point the fault, and tell how to correct it)
> thank you:)
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: xacml-users-unsubscribe@lists.oasis-open.org
> For additional commands, e-mail: xacml-users-help@lists.oasis-open.org

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]