Re: [xacml] Obligations rear their ugly head.

[Polar Humenn <polar@syr.edu>]

Well, then let's get the specification to state that instead categorical
denial. So, if a PEP encounters an obligation it doesn't understand (then
there seems to be something wrong with this "bilateral agreement" that is
talked about that the PEP and PDP have). So, therefore it should be
handled as an Error (Indeterminate?).  Then the PEP is free to do what it
wants, such as look up the obligation in a query service, ask another PDP,
etc., whatever PEPs do.

Cheers,
-Polar

 On Thu, 8 Apr 2004, Bill Parducci wrote:

> Polar Humenn wrote:
> > I guess, I can get around saying my PEP understands "strings", and
> > therefore, all obligations, as they are just "strings" and "discharges"
> > all of them to the bit bucket.
>
> you can, but it would be a non XACML compliant PEP. i would suggest that if you
> are wholly against the use of obligations that you have your PEP generate an
> ERROR if given such (and avoid being used in an environment where that may occur ;o)
>
> based on your concerns i am going to take a shot at the wording for collective
> consideration.
>
> b
>
> To unsubscribe from this mailing list (and be removed from the roster of the OASIS TC), go to http://www.oasis-open.org/apps/org/workgroup/xacml/members/leave_workgroup.php.
>