PAP Issues re: REST Profile working draft 05

I think you need to specify that a policy has to be sufficiently well formed to determine what the policy id and version are. The policy does not need to be correct as specified by XACML, because it may be in the process of being edited and debugged.

In section 2.2.3.1, you appear to be using “Cohort” in a way inconsistent with the definition I have proposed. (interchangeable with collection) I don’t object if you want to propose a different definition and get consensus around it, but otherwise I suggest sticking to “collection”.

I am still generally uncomfortable with the amount of variability of the semantics you propose to allow. One cannot tell if a policy change will shut down the system or merely update a file. One cannot tell if requests will succeed or fail because a version has been left out or included.

I am puzzled that there is no way to update a policy in place. It seems like this would be a natural action. Do we have to increment the version just to fix a misspelled word?

Why does delete only delete all versions? What if I just want to get rid of some old versions I am no longer using while keeping the last few?

Since nothing is specified about whether policies are trusted, I wonder if we should allow policies to be wrapped as described in chapter 6 of the SAML profile, so they can be suigned?

Hal

From: Remon Sinnema [mailto:remon.sinnema@emc.com]
Sent: Thursday, May 31, 2012 6:40 PM
To: xacml@lists.oasis-open.org
Subject: [xacml] Groups - REST Profile of XACML v3.0 Version 1.0, working draft 05 uploaded

Submitter's message
Changes:
- PDP is now optional, allowing PAP-only servers
- Added explanatory text for delete example
- Added note on policies contained within policy sets
- Added note that supplied policies must be valid according to the policy schema
- Improved wording in Security section
- Added “lost” paragraph from WD02 about the contents of the entry point resource
- Added text on different types of PAPs
- Added text on policy (version) equality
- Added use of HTTP to conformance section

-- Mr. Remon Sinnema

Document Name: REST Profile of XACML v3.0 Version 1.0, working draft 05

No description provided.
Download Latest Revision
Public Download Link

Submitter: Mr. Remon Sinnema
Group: OASIS eXtensible Access Control Markup Language (XACML) TC
Folder: Specifications and Working Drafts
Date submitted: 2012-05-31 15:39:48

xacml message