Attribute categories

["Daniel Engovatov" <dengovatov@bea.com>]

I tried to make a reasonable draft for introducing abstract attribute
categories to the XACML context.  It seems there is a choice in between
less invasive and considerably ugly (IMHO) way, or a nicer way to define
this that is considerably invasive.  By considerably invasive I mean it
will require translation of existing policies and request, and extensive
editing of the specification and of some related profiles.
The difference is whether to define existing subject categories in the
terms of the abstract ones.
I am attaching a short description of the invasive proposal to
illustrate what I mean here.  I would guess we would need to discuss if
we are willing to go that route - and I do see some benefits in doing
that - or if we are not willing to make that many changes to the core
spec.
If we are brave I will edit the core spec and the profile documents as
described in the proposal.  That may take some time as there are a lot
of (fairly straightforward though) little changes.
Daniel;
_______________________________________________________________________
Notice:  This email message, together with any attachments, may contain
information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated
entities,  that may be confidential,  proprietary,  copyrighted  and/or
legally privileged, and is intended solely for the use of the individual
or entity named in this message. If you are not the intended recipient,
and have received this message in error, please immediately return this
by email and then delete it.

AttributeCategories.pdf