OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

xacml message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [xacml] Default behavior for unrecognized resource attributes?

If an "unrecognized attribute" is an attribute not in use by a policy / rule in the policy set, then the attribute serves no purpose and will have no impact. This is true of any category of attributes. Therefore there is no need to cause the PDP to reply with a DENY.

To the best of my knowledge the XACML 3.0 standard doesn't mention how a request with extra attributes should be handled. The standard doesn't delve into PIP behavior either.


On Thu, Sep 24, 2015 at 5:51 PM, Martin Smith <bfc.mclean@gmail.com> wrote:
As a result of thinking about the DSD question, it occurred to me to wonder if there is anything in normative or non-normative XACML pubs that says that an unrecognized resource attribute must result in a DENY decision. 

Let's say that "unrecognized" means that there is no rule in the set being used by the PDP that references the attribute. 

It seems to me that this should be a requirement, as the purpose of resource attributes is to specify (via the applied rule set) what subject attributes are required for access to the resource. If there's no rule that references the resource attribute then there is a definite possibility that the subject does not have all the attributes intended to be required by whatever policy led to the inclusion of the unrecognized resource attribute in the protected resource's metadata.  

The same does not apply to unrecognized subject attributes, which can be ignored as they are simply "extra" from the perspective of the PDP (and are presumably provisioned for access to other resources not protected by the current PDP/PEP.) 


Martin F Smith, Principal
BFC Consulting, LLC
McLean, Va 22102
703 506-0159
703 389-3224 mobile

David Brossard
VP of Customer Relations
+46(0)760 25 85 75
+1 502 922 6538
Axiomatics AB

Västmannagatan 4
S-111 24 Stockholm, Sweden
Axiomatics for developers: http://developers.axiomatics.com
Connect with us on LinkedIn | Twitter | Google + | Facebook | YouTube

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]