OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: RE: [xacml] Any Subject, Any Resource, Any Action, Any Environment (fwd from Polar)

I think that the way to address this is to define RULE, not Target as a
conjunctive sequence or the subordinate elements - including elements of
the Target and the condition.

Each of the Target elements is logically equivalent to an additional
condition.  I think that we have to have equivalent treatment of the
missing condition and any of the Target element.

And I do not know about you, but <AnyEnvironment> makes me shudder.
What the heck this is supposed to mean?

I strongly agree that we need to make all target elements optional and
get rid of the redundant <Any*> elements, and AnyEnvironment in
It does not create any inconsistencies.


-----Original Message-----
From: Anne Anderson [mailto:Anne.Anderson@Sun.COM] 
Sent: Friday, January 23, 2004 9:41 AM
Subject: [xacml] Any Subject, Any Resource, Any Action, Any Environment
(fwd from Polar)

I think I may have misunderstood the approach before, or just didn't
it carefully enough.  So, if I am reading the right document, the change
on the target is that, NOW, the sub-elements of <Target> are OPTIONAL.
Whereas, previously they had been REQUIRED.  Correct? (This diffs I see
not seem reflect this change).

<Target> has always been a conjunctive sequence of its subordinate
elements.  Now, due to the optionality of it subordinates, you may now
up with an empty conjunctive sequence, which is commonly said to be
"true", and therefore an "empty" target evaluates to "Match".

If I've got the intent wrong on any of the following please let me know:

So, now, an empty target:


has the same meaning as:


Correct? Therefore, this approach also means that you may have


with the resulting applicability predicate concerned with just the

This approach is logically consistent, as long as we can agree that


has the same meaning as the <Target> immediately above, and that


(or any other target with an empty disjunctive subordinate) always
evaluates to "No-Match".

I don't know if this is an issue, but we should maintain <AnySubject>,
for backward compatibility reasons.


Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692

To unsubscribe from this mailing list (and be removed from the roster of
the OASIS TC), go to

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]