[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [xacml] Issue #87 CORE ERRATA: resource:xpath needs to be addedin B.6, plus fix needed for 4.2.2 example - updated
This email to follow up on last TC meeting's action item: Issue 87: Rich: Need xpath feedback from others - i.e. someone who "knows" what the xpath constructs are "supposed to be" Rich to provide specific proposal for changes. Options of required optional/ resource:xpath in attr designator. (will be based on deduction of intent of xpath in spec unless specific feedback provided) Based on the above action item, and that afaik there has not been anyone who has submitted more info on this issue, I will now explain as best I can my interpretation of the intent of the current spec and recommend the change necessary to match that intent. (This will be followed by some supporting comments listing the main specifics leading to these conclusions.) I have reviewed the xacml 1.0, xacml 1.1, and xacml 2.0 specs to set up a context for understanding what changed. My conclusion is that resource:xpath was accidentally removed from xacml 2.0 and that the only way to make sense of its use in the example policies is to assume that when it is specified in a ResourceAttributeDesignator, that xpath in the AttributeValue of the ResourceMatch must have as a context node the ResourceContent element of the Request. Therefore, my proposal is that the proposal in issue 87 for adding back the resource:xpath identifier with the following text will substantially correct the situation: ' This identifier indicates that the resource is specified by an XPath expression and that the default RequestContextPath for the parent attribute is "//xacml-context:Request/ xacml-context:Resource/xacml-context:ResourceContent". * urn:oasis:names:tc:xacml:1.0:resource:xpath ' The above is the proposal. Now here are some of the specific things I found which led me to these conclusions: 1. In xacml 1.1 section B.6 contains several attribute identifiers including resource-id and xpath. In xacml 2.0 section B.6 all the above attribute identifiers have been removed, except for resource-id, and a new xacml.2.0 identifier has been added: target-namespace. 2. The description in the example Rule 1 of the ResourceMatch containing the ResourceAttributeDesignator (lines 1166-1174 and lines 1244-1247 clearly indicate that the resource:xpath identifier is alive and well and required for this Policy to continue to function. Given the requirement for the Policy to function, it is clear that the context node for the xpath string specified needs to be the ResourceContent node and not the Resource node. 3. Given the description of xacml:2.0:resource:target-namespace (lines 5041-5046), it is clear that the place to look for the namespace that is being described is the ResourceContent node. 4. Given that lines 4907-4908 say the Request element is the context node for every XPath expression, a means to override this is necessary if we just want to deal with the content under the ResourceContent, which appears to be generally the case. 5. The xacml:1.0:resource:target-namespace and xacml:1.0:resource:xpath Attributes were removed from xacml 1.1 lines 978-992, and incorporated thru other means in the xacml 2.0. In the former case thru the xacml 2.0 defn in section B.6 for xacml:2.0:resource:target-namespace, and in the latter case by what is proposed above as the accidentally left out defm of resource:xpath, which appears to synergistically, as defined, work together with the target-namespace. Bottom line: the xpath-node-match function is trying to determine if the node /md:record is under the node ResourceContent. As indicated in the issue description, there are other ways to address this issue or possibly interpret the original intent. However, I believe the above proposal is the path of least resistance which is consistent with the spec as it currently stands with the examples given. Thanks, Rich Rich Levinson wrote: Note: the previous version of this issue accidentally went to xacml-demo-tech. |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]