OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: string-regexp-match function on individual resource-id values as an alternative to the xpath-node-equal/match function?

Hi all,


in order to identify isolated issues of the mult&hier resource profile, I’d like to raise this question (which I hope can be addressed separately)


Does it make sense to evaluate the individual resource-id attribute values through the string-regexp-match function?


The example below tries to motivate why the string-regexp-match function could be a reasonable alternative to using the xpath-node-equal function.


Assume you have the following decision request with a resource content element containing 1,000,000 book objects.



  <Attributes   Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource">



        <book id=1>







        <book id=2>




        <book id=1,000,000>




      <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" >

        <AttributeValue  XPathCategory="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType=" urn:oasis:names:tc:xacml:3.0:data-type:xpathExpression">/objects</AttributeValue>


      <Attribute AttributeId="urn:oasis:names:tc:xacml:2.0:resource:scope " >

        <AttributeValue  XPathCategory="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string"> Descendants </AttributeValue>






As one of this simple book elements consists of 12 nodes, you will get 12 individual decision requests for each book.

Having 1,000,000 book elements will result in 12,000,000 individual decision requests.

Having a rule like permit access to book nodes will imply 12,000,000 evaluations of the function checking the individual resource-id attributes.


e.g.  if you use the xpath-node-equal function…


xpath-node-equal(/objects[1],  /Objects/book)

xpath-node-equal(/objects[1]/book[1],  /Objects/book)

xpath-node-equal(/objects[1]/book[1]/@id,  /Objects/book)

xpath-node-equal(/objects[1]/book[1]/title[1],  /Objects/book)

xpath-node-equal(/objects[1]/book[1]/title[1]/text(),  /Objects/book)

xpath-node-equal(/objects[1]/book[2],  /Objects/book)

xpath-node-equal(/objects[1]/book[3],  /Objects/book)


xpath-node-equal(/objects[1]/book[1,000,000],  /Objects/book)



The question now is whether it is faster to use the

a) xpath-node-equal function or the

b) string-regexp-match function

against the resource-id values of the derived individual decision requests.


The evaluation of the xpath-node-equal function will imply the evaluation of 12,000,001 xpath expressions against the large (e.g. 2GB) DOM representing the content.


The evaluation of the string-regexp-match function doesn’t need to be evaluated against the xml resource. Further the regular expression has a very specific structure (e.g. reg-exp-string-match(resource-id,/objects\[\d+\]/book\[\d+\])


I am no expert in xpath evaluation algorithms but it seems to me that reg-exp-match is the cheaper operation to do.

I think a theoretical performance analysis between the string-regexp-match function and an xpath evaluation algorithm is the core issue we have to figure out.

If string-regexp-match performs significantly better than we should add this alternative to the profile. In this case we have of course to agree on a normal-form for the individual resource-id values and on standardised guidelines how to deal with the namespace problem.





Jan Herrmann
Dipl.-Inform., Dipl.-Geogr. 

wissenschaftlicher Mitarbeiter

Technische Universität München
Institut für Informatik

Lehrstuhl für Angewandte Informatik / Kooperative Systeme

Boltzmannstr. 3
85748 Garching

Tel:      +49 (0)89 289-18692
Fax:     +49 (0)89 289-18657



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]