Re: [xacml] XACML Obligations and SAML Conditions (?)

[Michiharu Kudoh <KUDO@jp.ibm.com>]

Hi, Frank

>>In the case of an xacml response, the obligations seems part of that
response,
>>and together constitute the statement. It is this complete statement that
will
>>be used by the pep after the validation of the assertion.

I agree. My original thought was that the obligations in XACML response are
associated with each decision (for a certain target resource) and handled
by PEP. On the other hand, SAML assertion's condition means some condition
on the statement, that is substantially different from the obligations. So
my preference is not to bind XACML's obligation to SAML condition.

Michiharu Kudo


                                                                                                                                       
                      Frank Siebenlist                                                                                                 
                      <franks@mcs.anl.g        To:       Polar Humenn <polar@syr.edu>                                                  
                      ov>                      cc:       XACML TC <xacml@lists.oasis-open.org>                                         
                                               Subject:  Re: [xacml] XACML Obligations and SAML Conditions (?)                         
                      2003/09/11 01:01                                                                                                 
                                                                                                                                       
                                                                                                                                       



Not sure if "considering" is the right wording ... as I understood it, it
was a
point of discussion that required resolution, and was added to the saml 2.0
todo
list. I just send in my 5c before I forgot ;-)

-Frank.


Polar Humenn wrote:

> On Wed, 10 Sep 2003, Frank Siebenlist wrote:
>
>
>>In my mind, the issuer of an assertion vouches for the validity of the
>>statement, and that the conditions clause should only apply to the
validity of
>>the statement as a whole.
>>
>>In the case of an xacml response, the obligations seems part of that
response,
>>and together constitute the statement. It is this complete statement that
will
>>be used by the pep after the validation of the assertion.
>>
>>To pull the obligations out and carry them in the saml's conditions
doesn't seem
>>to fit that model well.
>
>
> Ah, I got your point. I agree with you. The response carrying within an
> XACML response should be the captured as whole statement.
>
> Were we really considering pulling obligations out into the Conditions?
>
> Cheers,
> -Polar
>
>
>>-Frank.
>>
>>
>>Polar Humenn wrote:
>>
>>
>>>On Wed, 10 Sep 2003, Frank Siebenlist wrote:
>>>
>>>
>>>
>>>>My feel is that the saml condition is on the assertion level, while the
xacml
>>>>obligation is on the decision response level.
>>>>
>>>>Does it make sense to have the decision response including the
obligations live
>>>>outside of the assertion?
>>>>If the answer is yes, then that may have answered the question...
>>>
>>>
>>>I'm not quite sure what you mean.
>>>
>>>An obligation is part of the decision response. If we use the SAML
>>>Response to wrap this XACML response, By virtue of being a SAML
Response,
>>>does that mean the XACML Response must be an Assertion? So, do you mean
by
>>>turning the response into a SAML Assertion that we should strip the
>>>obligations out and put them some where else?
>>>
>>>-Polar
>>>
>>>
>>>
>>>>-Frank.
>>>>
>>>>
>>>
>>>
>>
>

--
Frank Siebenlist              franks@mcs.anl.gov
The Globus Project - Argonne National Laboratory


To unsubscribe from this mailing list (and be removed from the roster of
the OASIS TC), go to
http://www.oasis-open.org/apps/org/workgroup/xacml/members/leave_workgroup.php
.