Issue 72, SAML:Where should passed-in policies be inserted

[Erik Rissanen <erik@axiomatics.com>]

All,

Issue 72 is about where policies supplied in a SAML XACMLAuthz request 
should be placed among the other policies of the PDP.

The difficulty of this issue is that XACML currently does not say 
anything about how a PDP finds it "contained policies" in the first 
place. Without a specification for this, there is nothing to relate the 
SAML supplied policies to.

I don't think we should specify policy finding in the PDP, so I propose 
that we leave this unspecified. Different users/PDPs may find different 
modes of operation useful.

I propose that we add the following text to the SAML profile regarding 
this issue:

--8<--
Since XACML does not specify how a PDP selects a policy to evaluate, the 
supplied policies are related to the policies already available in the 
PDP in an implementation specific manner. For example, a PDP MAY treat 
the policies in the same manner as other policies in the PDP, it MAY 
choose to insert the supplied policies in a PolicySet at some specified 
point, it MAY use solely the supplied policies or it MAY make use of the 
supplied policies in some other way. Users of a PDP should coordinate 
with the providers of the PDP to establish meaningful behavior for the 
supplied policies.
--8<--

Best regards,
Erik