Subject: Re: [xacml] examples in specification
Seth, Now I understood your point and agree with you. The description of rule 3 for line 98-114 looks a little misleading. Since Section 5.35 describes that "the values of the obligation arguments SHALL be interpreted by the PEP", the sentence should have been described in more unambiguous way. It would be great help if you could post such misleading portions you have already found in the current specification. Michiharu Seth Proctor <Seth.Proctor@Sun To: Michiharu Kudoh/Japan/IBM@IBMJP .COM> cc: email@example.com Subject: Re: [xacml] examples in specification 2003/10/24 00:13 Hi Michiharu. I don't think I got my point across. :) Let me try again. > I don't agree that the example in section 126.96.36.199 isn't true. The > obligation described in that rule is "email" with three arguments, an email > address in the medical record referred by a specific XPath, a text string, > and subject id in the request context. These three arguments are not for > PDP but for PEP. PDP does not have to interpret those arguments and the > whole text string below the obligation element is sent back to PEP as a > part of the decision. No interpretation by PDP is not required. Instead, > PEP must understand those parameters but this kind of agreement between PDP > and PEP is already assumed, as described in section 5.35. I actually didn't say that the example isn't true. What I said is: While this isn't illegal, the example implies something about the specification that isn't true What I think the example implies (and what I've had others tell me they see in the example) is that the PDP is supposed to recognize that there is a Selector or Designator, do the attribute retrieval, and then fill in the AttributeValue for the AttributeAssignment. Then what the PEP gets back is the email address as the first parameter, not a Selector that points to an email address. This is not behavior that is defined in the specification, but most people I have talked with think that this is what the example is showing.  This is why I was concerend about this, and other examples. I don't think that this example is invalid, I just think that it's misleading people trying to use Obligations. Is that clearer? seth  I fully understand why this funcationality would be useful, but that's not the issue I'm trying to raise here.