OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [xacml] Any kind of policies in a request

Hi David,
   thanks for the additional explanation. I really have to think about 
this issue a bit. I do hope other TC members can weigh in their thoughts.

It should be possible to add in the xs:any element to allow extensibility.


On 11/24/2009 11:28 AM, David Chadwick wrote:
> Hi Anil
> OK, now I understand your position. But it is opposed to the existing
> SAMLv2 profile of XACML, since ii) should by Yes to fit the existing
> profile, and iv) should be yes if the phrase "a general purpose" is 
> removed. In fact the only change I am proposing is to make iv) general 
> purpose as opposed to its current XACML specific purpose.
> I attach a Word document (sorry for that) which provides a modified 
> schema showing the change I propose highlighted in yellow, which is 
> the addition of one line, namely
> <xs:element ref="xs:any" minOccurs="0" maxOccurs="unbounded"/>
> This allows a policy in any language to be sent.
> I have also changed the name of the type to reflect that it is now 
> general purpose, and also so that it does not clash with the existing 
> type definition.
> regards
> David
> Anil Saldhana wrote:
>> Hi David,
>> On 11/24/2009 04:15 AM, David Chadwick wrote:
>>> Hi Anil
>>> I dont understand precisely what your objection is. Please could you 
>>> be more specific by answering the following questions
>>> i) there should be a general mechanism for querying any remote PDP 
>>> for an authz response Y/N
>> Y
>>> ii) there is a need to dynamically push a policy to a remote PDP 
>>> along with an authz decision request Y/N
>> N
>>> iii) the v2 XACML request/response context can be used as a general 
>>> purpose mechanism for making an authz query to any ABAC PDP Y/N
>> Y
>>> iv) the SAMLv2 profile of XACML can be used as a general purpose 
>>> mechanism for pushing a policy to a remote PDP along with making an 
>>> authz query Y/N
>> N
>> (The policy update has to be outside the normal request mechanism.  
>> If your use case is to make authz decisions based on a new 
>> replacement for a policy that exists just for the duration of the 
>> authz query, then that is interesting but a new use case which may 
>> require new constructs).
>>> regards
>>> David
>>> Anil Saldhana wrote:
>>>> David,
>>>>   I have a hard time really agreeing to your proposal of 
>>>> interlinking requests and xacml policies.
>>>> The XACML policy aspect has to be out of band wrt the 
>>>> request-response mechanism.
>>>> Regards,
>>>> Anil
>>>> On 11/23/2009 06:12 AM, Erik Rissanen wrote:
>>>>> David,
>>>>> I have been thinking more about this.
>>>>> I think that an extension point to plug in any kind of policy 
>>>>> format does not belong in the XACML core schema, and thus not in 
>>>>> the <Request>. The XACML schema is for defining the XACML 
>>>>> language, and we would lose some of the benefits of 
>>>>> standardization by allowing any content in it.
>>>>> However, SAML defined in the past a protocol for AuthZ 
>>>>> query/response. It is my understanding, and please correct me if I 
>>>>> am wrong, that there was an agreement between the SAML and XACML 
>>>>> TCs that the XACML request schema would supersede the SAML AuthZ 
>>>>> formats, and SAML dropped their own. The original SAML protocol 
>>>>> was ambiguous regarding the policy language.
>>>>> If we think of the XACML SAML profile to carry the legacy of the 
>>>>> original SAML AuthZ protocol, than I guess it would make sense to 
>>>>> support other policy languages since the original protocol was not 
>>>>> XACML specific.
>>>>> What do the rest of the TC see as the scope of the XACML SAML 
>>>>> profile? Is it just about supporting XACML, or does it have a 
>>>>> wider scope?
>>>>> Best regards,
>>>>> Erik
>>>>> David Chadwick wrote:
>>>>>> Subsequent to the minutes
>>>>>> Rich.Levinson wrote:
>>>>>>> Proposed schema change for policies and discussion from
>>>>>>>  David Chadwick and response from Erik:
>>>>>>>   http://lists.oasis-open.org/archives/xacml/200911/msg00023.html
>>>>>>>    Erik: David proposed req ctx schema for ext pts xml any, where
>>>>>>>     can put proprietary policy lang things; doesn't make sense
>>>>>>>     to std on any policies in fmt; suggest using saml/xacml
>>>>>>>     mechanism
>>>>>>>    Rich: sees it as potentially disruptive, effectively allowing
>>>>>>>     elements as children of PolicySet
>>>>>>>    Bill: proprietary elements don't make sense; need further info
>>>>>>>     to be considered;
>>>>>>>     defer topic until more info from David addressing concerns
>>>>>>>      in email and minutes
>>>>>> It makes sense because we cannot assume that every PDP talks the 
>>>>>> XACML policy language. However, it is possible to make every PDP 
>>>>>> talk the XACML request/response context. Once we have sticky 
>>>>>> policies and obligations which we pass around a distributed 
>>>>>> system we need to be able to cater for multiple policy languages. 
>>>>>> If you see my presentation at W3C yesterday at
>>>>>> http://www.w3.org/2009/policy-ws/slides/Chadwick.pdf
>>>>>> and look at slide 5 from 11, you will see why we need to relax 
>>>>>> the schema requirements on the policy element in the SAML-XACML 
>>>>>> profile, otherwise we have no standard way of passing a sticky 
>>>>>> policy to an AIPEP or Master PDP.
>>>>>> regards
>>>>>> David

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]