Re: [xacml-users] what is the difference between Ordered-deny-overridesand Deny-overrides

[Erik Rissanen <erik@axiomatics.com>]

Jack, Rich,

Another consideration is Indeterminate results. You may get a different 
decision depending on the order of evaluation, depending on whether a 
Permit/Deny is reached before or after an Indeterminate.

Best regards,
Erik

On 2010-01-21 20:33, Rich.Levinson wrote:
> Hi Jack,
>
> One consideration is Obligations. Different Policies can return 
> different Obligations. If request is denied by Policy 1, there will, 
> in general, be different Obligations than if denied by Policy 2. If 
> unordered, then precise results (set of returned Obligations) are 
> unpredictable. If ordered then same result (same set of Obligations) 
> should be returned every time.
>
>    Thanks,
>    Rich
>
>
> smith jack wrote:
>> though i have read that specification. i am still confused.
>> There is little difference, as the specfication said: when envaluated,
>> the order should follow the order how policies listed in policyset.
>> but will this matter?
>> if one Rule return Deny, they both will Deny.
>> (So the only difference is that, Deny-overrides is much more flexible
>> than Ordered-deny-overrides, right? since envaluated in random order,
>> may fail much faster, and will gain
>> better performace, is this opinion correct? if not, it will be
>> appreciate that you point the fault, and tell how to correct it)
>> thank you:)
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: xacml-users-unsubscribe@lists.oasis-open.org
>> For additional commands, e-mail: xacml-users-help@lists.oasis-open.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: xacml-users-unsubscribe@lists.oasis-open.org
> For additional commands, e-mail: xacml-users-help@lists.oasis-open.org
>