[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [xacml] Issue: Hierarchical profile appears ambiguous and inconsistent
Using URI is a very limited approach, and it can be trivially mapped into "ancestor" approach. Requiring a unique URI for resources is often not feasible The following example will show why this is doubly and actually triply specified and also why it is essential that the changes described in 1-3 above are needed. I think you are confusing physical resources and policy resources. Such mapping is outside of XACML. There is no real hierarchy in XACML, we just provide a convenient normative way to represent them - only for the purpose of using it in a policy target. For the purpose of a single policy evaluation hierarchy that is used is uniquely defined by the provided "resource-ancestors" attribute. The fact that there is some persistent identity that may participate in different hierarchies should be outside of the scope of this profile. Daniel; |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]