[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]
Subject: [xacml] [schema] Proposal for SubjectAttributeDesignator
As I posted a week ago, my preference w.r.t. the semantics for <Target>
element is to specify <Subjects> and <Subject> in <Target> and do not allow
recursive attribute designator in <Condition>.
http://lists.oasis-open.org/archives/xacml/200208/msg00007.html
A) Expression in Target element
I repeat an example expression used in Anne's mail (a little complicated
example though)
>
>1. at least one Subject has
> AttrA == A AND AttrB == B and AttrC == C
>2. OR at least one Subject has
> AttrE == E
>3. OR at least one Subject has
> AttrD == D
Above expression is represented as follows:
(1) Target expression
<Target>
<Subjects> <!-- Symbol of the OR semantics on multiple subject -->
<Subject> <!-- Symbol of the AND semantics on multiple SubjectMatch -->
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrA" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">A</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrB" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">B</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrC" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">C</AttributeValue>
</SubjectAttributeDesignator>
</Subject>
<Subject>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrE" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">E</AttributeValue>
</SubjectAttributeDesignator>
</Subject>
<Subject>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrD" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">D</AttributeValue>
</SubjectAttributeDesignator>
</Subject>
</Subjects>
</Target>
<Subjects> and <Subject> might be mapped to function "OR" and "AND",
respectively. The difference from the pure "OR" and "AND" function would be
that <Subject> implies that a set of <SubjectMatch> condition must be
satisfied in one <Subject> element in a request context, not in multiple
<Subject> elements. In (2), I specify pseudo target expression using "OR"
and "AND" for discussion later.
(2) Pseudo Target expression
<Target>
<Function FunctionId="function:or"> <!-- this corresponds to Subjects -->
<Function FunctionId="function:and"> <!-- this corresponds to Subject
-->
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrA" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">A</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrB" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">B</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrC" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">C</AttributeValue>
</SubjectAttributeDesignator>
</Function>
<Function FunctionId="function:and">
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrE" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">E</AttributeValue>
</SubjectAttributeDesignator>
</Function>
<Function FunctionId="function:and">
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrD" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">D</AttributeValue>
</SubjectAttributeDesignator>
</Function>
</Function>
</Target>
B) Expression in Condition element
For the expression in <Condition> element, I would prefer Simon's <where>
approach than recursive designator specification. But my preference is more
generic approach. My idea is that <SubjectAttributeDesignator> allows
<Function> element in it. It specifies any arbitrary logical expression.
However, the semantics of its logical expression is "where" that is used to
verify whether a subject element satisfying the designator really satisfies
the expression below the designator element.
The following <Condition> says "select attrX where (AttrA='A' & AttrB='B' &
AttrC='C') | AttrE='E' | AttrD='D'), and is the value of attrX equal to
'X'?".
(3) Condition expression
<Condition>
<Function FunctionId="function:string-equal">
<SubjectAttributeDesignator AttributeId="attrX" DataType="xs:string">
<Function FunctionId="function:or"> <!-- From here, the expression is
the same with (2) -->
<Function FunctionId="function:and">
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrA" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">A</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrB" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">B</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrC" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">C</AttributeValue>
</SubjectAttributeDesignator>
</Function>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrE" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">E</AttributeValue>
</SubjectAttributeDesignator>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrD" DataType
="xs:string"/>
<AttributeValue DataType="xs:string">D</AttributeValue>
</SubjectAttributeDesignator>
</Function>
</SubjectAttributeDesignator>
<AttributeValue DataType="xs:string">X</AttributeValue>
</Function>
</Condition>
The above syntax is the same with the syntax of (2). That is one of the
advantage of this approach. Another advantage is that policy writers can
specify any arbitarary logical expressions below
<SubjectAttributeDesignator>.
Michiharu Kudo
IBM Tokyo Research Laboratory, Internet Technology
Tel. +81 (46) 215-4642 Fax +81 (46) 273-7428
Anne Anderson
<Anne.Anderson@Su To: XACML TC <xacml@lists.oasis-open.org>
n.com> cc:
Subject: [xacml] [schema] One two many OR levels in Target Subject?
2002/08/03 03:41
Please respond to
Anne.Anderson
I think we MAY have defined one too many levels of OR in our
Target Subject syntax.
I believe the following example matches any Request in which
1. at least one Subject has
AttrA == A AND AttrB == B and AttrC == C
2. OR at least one Subject has
AttrE == E
3. OR at least one Subject has
AttrD == D
But 1. and 2. are not at the same level as 3.
<Target>
<Subjects>
<Subject>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrA"
DataType="xs:string">
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator
AttributeId="AttrB"
DataType="xs:string">
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator
AttributeId="AttrC"
DataType="xs:string">
<AttributeValue
DataType="xs:string">
valueC
</AttributeValue>
</SubjectAttributeDesignator>
</SubjectMatch>
<AttributeValue DataType="xs:string">
valueB
</AttributeValue>
</SubjectAttributeDesignator>
</SubjectMatch>
<AttributeValue DataType="xs:string">
valueA
</AttributeValue>
</SubjectAttributeDesignator>
</SubjectMatch>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrE"
DataType="xs:string">
<AttributeValue DataType="xs:string">
valueE
</AttributeValue>
</SubjectAttributeDesignator>
</SubjectMatch>
</Subject>
<Subject>
<SubjectMatch MatchId="string-match">
<SubjectAttributeDesignator AttributeId="AttrD"
DataType="xs:string">
<AttributeValue DataType="xs:string">
valueD
</AttributeValue>
</SubjectAttributeDesignator>
</SubjectMatch>
</Subject>
</Subjects>
<Resources>
<AnyResource/>
</Resources>
<Actions>
<AnyAction/>
</Actions>
</Target>
--
Anne H. Anderson Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311 Tel: 781/442-0928
Burlington, MA 01803-0902 USA Fax: 781/442-1692
----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]
Powered by eList eXpress LLC