OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [xacml] three questions: string-not-equal & valid FulfillOn attributevalues& placement of variableDefintions

Hi Jan,

On second thought, I don't think the string-not-equals would be useful. It won't do what you want in a target in case of multiple values. The target would match if at least one of the values in the request causes string-not-equal to return true. That's not what you would want to.

So you would need to use a condition.

Best regards,

On 05/30/2011 05:14 PM, Erik Rissanen wrote:
4DE3B446.4070809@axiomatics.com" type="cite"> Hi Jan,

See inline.

On 2011-05-30 16:38, Jan Herrmann wrote:
ABD756A3EE1A4144BAA186C7B4379F46@lapschlichter55" type="cite">

Hi all,

three little questions:

1. Would it not be useful to allow a sting-not-equal Match-function?

Yes, it would since it's not possible to use a "not" function in a target. However, my opinion is that the fault is not that there is no string-not-equal function, but the problem is that one cannot use a condition in a policy or policy set. There are lots of cases where one has to use weird constructs to work around that, and your case is just one such example.

ABD756A3EE1A4144BAA186C7B4379F46@lapschlichter55" type="cite">

2. Is there a reason why one can not define an ObligationExpression with a FulfillOn=”Indeterminate” value?

Maybe someone from the XACML 1.0 era here could respond better, but it seems a bit weird to put enforcement actions in an error, meaning that we don't even know whether a policy applied or not. I don't have done a formal analysis of a the matter though.

ABD756A3EE1A4144BAA186C7B4379F46@lapschlichter55" type="cite">

3. Why do VariableDefinitions have to be bound to a <Policy> element and not to e.g. the root <PolicySet> element?

Again, others would know better, but I guess this was simply a design choice. I guess since conditions can appear only in rules, the need for variable definitions was most urgent in a Policy. Of course, now AttributeAssignmentExpression changes that.

Best regards,

ABD756A3EE1A4144BAA186C7B4379F46@lapschlichter55" type="cite">


Best Regards



Jan Herrmann

Dipl.-Inform., Dipl.-Geogr.

Scientific Assistant

Chair for Applied Informatics / Cooperative Systems

Technische Universität München

Boltzmannstr. 3

85748 Garching


T: +49 89 289 18692

F: +49 89 289 18657

W: www11.in.tum.de


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]