Ergebnis fr URL: http://www.oasis-open.org/committees/xacml/repository/xacml-implement-guide-1.1.docࡱ> M p$bjbj== -@WW l8JV d 4NNNNNNN$DQ dS(#O #O 8O ~N N l'jIN `01 l K2NNO0~OKJT TN
XACML Implementers Guide
Informational Document 1.1, 11 March 2003
Document identifier:
xacml-implement-guide-1.1.doc
Location:
Editor:
Hal Lockhart, BEA Systems,
Contributors:
Anne Anderson, Sun Microsystems
Abstract:
This document contains notes, which may be useful to implementers of the XACML Specification. It is not normative in any way.
Status:
This document is expected to be added to periodically on no particular schedule.
Committee members should send comments and contributions on this specification to the HYPERLINK "mailto:xxx@lists.oasis-open.org" xacml@lists.oasis-open.org list. Others should subscribe to and send comments and contributions to the HYPERLINK "mailto:xxx-comment@lists.oasis-open.org"xacml-comment@lists.oasis-open.org list. To subscribe, send an email message to HYPERLINK "mailto:xxx-comment-request@lists.oasis-open.org?body=subscribe"xacml-comment-request@lists.oasis-open.org with the word "subscribe" as the body of the message.
Table of Contents
TOC \o "1-3" \h \z HYPERLINK \l "_Toc35147766" 1 Introduction PAGEREF _Toc35147766 \h 2
HYPERLINK \l "_Toc35147767" 2 "Notional" Request context PAGEREF _Toc35147767 \h 2
HYPERLINK \l "_Toc35147768" 2.1 Suggestions PAGEREF _Toc35147768 \h 2
HYPERLINK \l "_Toc35147769" 3 - Functions PAGEREF _Toc35147769 \h 3
HYPERLINK \l "_Toc35147770" 4 Bags PAGEREF _Toc35147770 \h 3
HYPERLINK \l "_Toc35147771" 5 - Date and time arithmetic functions PAGEREF _Toc35147771 \h 3
HYPERLINK \l "_Toc35147772" 6 - Combining algorithms PAGEREF _Toc35147772 \h 3
HYPERLINK \l "_Toc35147773" 7 - MatchId PAGEREF _Toc35147773 \h 4
HYPERLINK \l "_Toc35147774" 8 - Hierarchical resources PAGEREF _Toc35147774 \h 4
HYPERLINK \l "_Toc35147775" 9 - Subject categories PAGEREF _Toc35147775 \h 4
HYPERLINK \l "_Toc35147776" 10 References PAGEREF _Toc35147776 \h 4
HYPERLINK \l "_Toc35147777" Appendix A. Notices PAGEREF _Toc35147777 \h 4
Introduction
These are potential topics to go into an XACML Implementers Guide. The intent is to alert implementers to subtleties of the specification that need particular attention in order to avoid problems.
"Notional" Request context
Request context can not be treated as static XML document
AttributeSelector evaluation can not depend on just XPath processing because even if the XPath expression does not return an attribute value, it will be necessary to invoke some sort of "attribute locator" to look for the referenced attribute in external databases.
Suggestions
Parse input Request.xml as a starting point for evaluation of AttributeDesignator (AD) and AttributeSelector (AS) references.
Define an "attribute retrieval" interface that takes as input an AD or AS and returns the matching attribute value, error, or "not found" result. The implementation of this interface first looks for referenced AD or AS in the parsed Request.xml. If attribute not found there, then implementation invokes an external attribute location API. This API should support plugins for different ways of locating attributes. The plugins should be configurable for particular LDAP repository locations, etc.
Functions
x500Name-equal: can this use a standard Java method?
rfc822Name-equal: local part is case-sensitive, domain-part is not case-sensitive
Bags
A singleton bag is NOT the same as an instance of the datatype contained in the bag. All the equality predicates, arithmetic functions, string conversion functions, numeric data-type conversion functions, Boolean functions, arithmetic comparison functions, date and time arithmetic functions, non-numeric comparison functions, and special match functions take only primitive data types as arguments. They must return Indeterminate if a bag or singleton bag is used as input.
Date and time arithmetic functions
o Can these use implementations in "XQuery 1.0 and XPath 2.0 Functions and Operators"?
Combining algorithms
Note that the policy-combining version of each algorithm is different from the rule-combining version.
policy-combining version of Deny-overrides can NEVER return Indeterminate under any conditions.
First-Applicable: The "applicability" test is based solely on evaluation of the Target. The first rule, policy, or policyset whose Target evaluates to "true" is evaluated, and that result is returned even if the evaluation of the condition for the rule(s) evaluates to "NotApplicable". Thus it is perfectly possible to return a result of "NotApplicable" from a "First-Applicable" combining algorithm even if there were subsequent rules or policies that would have returned Permit or Deny.
MatchId
A function used in a MatchId (used in Target) is not passed the arguments directly. An iterator takes the first argument to the MatchId and iterates through each element of the bag returned from evaluating the second argument (the AttributeDesignator or AttributeSelector) and passes those two elements to the MatchId function.
The same function, when used in a Condition, is passed its arguments directly without any iterator intervening to handle bags.
Hierarchical resources
Hierarchical resources in XACML are under-specified. For example, ?
Subject categories
When evaluating AttributeDesignators, all attributes of all Subjects that have the same SubjectCategory are lumped together as if they belonged to a single subject.
An AttributeSelector may distinguish between different subjects that have the same SubjectCategory by effectively asking for "Attribute A in the same subject that has a value of X for Attribute B".
References
Notices
OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS's procedures with respect to rights in OASIS specifications can be found at the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification, can be obtained from the OASIS Executive Director.
OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
Copyright OASIS Open 20023. All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself does not be modified in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications, in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
This document and the information contained herein is provided on an AS IS basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
PAGE 2
wd-spectools-word-sample-03 12 June 2002
Copyright OASIS Open 2002. All Rights Reserved. Page PAGE 5 of NUMPAGES 5
Copyright 2002 OASIS. All rights reserved. Page PAGE 1 of NUMPAGES 1
LMNhi=>234567CDE^_û×wijoUmHnHujUmHnHumHnHuCJOJQJmHnHu0JaJ$mHnHu&jQo>*B*UmHnHphu mHnHu0JmHnHuj0JUmHnHujbnUjmB*Uph
j0JU0JjlUPJ jU)EZxowd _
f
!
!
P#o$_`abcdef
. / ʰަҦʄvjqUmHnHu&j=q>*B*UmHnHphujpUmHnHu0JaJ$mHnHu&jGp>*B*UmHnHphu mHnHu0JmHnHuCJOJQJmHnHuj0JUmHnHumHnHujUmHnHu+/ 0 1 2 3 > ? @ Y Z [ \ ] ^ _ ` a | } ~ ߟwߟc&j t>*B*UmHnHphujsUmHnHu&j)s>*B*UmHnHphu mHnHu0JmHnHujrUmHnHujUmHnHumHnHuCJOJQJmHnHu0JaJ$mHnHuj0JUmHnHu&j3r>*B*UmHnHphu&
*
+
,
-
.
/
E
F
G
`
a
b
c
d
e
f
g
h
պ麲պ麲v&j v>*B*UmHnHphujuUmHnHu&ju>*B*UmHnHphu mHnHu0JmHnHuj0JUmHnHujtUmHnHujUmHnHumHnHuCJOJQJmHnHu0JaJ$mHnHu*
* + , - . / C D E ^ _ ` a b c ѽљřދѽwљřijrxUmHnHu&jw>*B*UmHnHphuj|wUmHnHu0JaJ$mHnHu&jw>*B*UmHnHphu mHnHu0JmHnHuCJOJQJmHnHuj0JUmHnHumHnHujUmHnHujvUmHnHu)
d 2
*B*UmHnHphujhyUmHnHujUmHnHumHnHu0JaJ$mHnHu&jx>*B*UmHnHphu mHnHu0JmHnHuj0JUmHnHuCJOJQJmHnHu(WX/z{LMded*56>o -
& F
& F
& F #########$$$$$$$$$$$L$M$S$T$U$V$Z$[$e$f$g$h$i$p$CJmHnHu
jCJUCJCJmHnHu
jCJUCJ0J,mHnHu0J,
j0J,U6]$ !5"###############$$$$i$j$k$l$m$n$++ n$o$p$+0P&P1h / =!"#$%lDdP vu
S RA4D:\ubl\logo\oasis\OAS.bmp"bl\Ê=dkDn k\Ê=dPNG
IHDR m84HjgAMA|Q pHYsּk}IDATx.ˑwHj}& 8P: & ciN84 ;Sg
m' 6 QG0 h! O@H^o隞}zyL} Ɍ63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63"̈h3#͌63",ȿ_
e ןjp,"}l/鷮ǯ/ p?_.!]ҾM\A|Z*_-NNӇQAmjq[}Epo?|hUrkT1⸭^?\)%j'Uvq~qR"y| ZX ;~_+$
]X)$N}
gUz[T7 Ji,5:y%]%6[ N +R" >(>Iv;U8nB3-"]ըQ$U[dr" HW(
='-6TKb]$1h5
mĢ"Ѯ[QqsaqN.pv $WZw]2iw&"kl Ӷ' Yr|eucʵkfԼIlʽR+b29T¦ʵQd/ۅu__7b&'4
`"|(+f Ӯ]tr9tuHa"b=-&9 ![\V]Sn-;
>72 tFy %/l8ykV:2;Hv|%ywHdrSl-?(9 *0`|_~^eQ|r9Ad-0*w!RÀ-w0לGH]BBn}4ֹzG l沀@n!F^@1"Pd^e,$Hr9$'"r~ E,"P䰷rb"мe;F(my 4!
"ɝ-XM9D b2O ;DcֱLŦkzֆuZ8cÎ.$
D>9CDZt w L6XfӠXIAD@BtMYZ^`LF3.ciSDnwTȆvZNN|iS'[_5@K}2"p98u2k
u$Ҏ$N|iS'
{MЅHMR"gl|fjp
tiW(ҎOh!
3]"I;vFd;MvK_: WB"x
Mz e]=}բ_: lׄeD$]"M `Kk"Ѳ.3YQkLKl$5ZrM-r;U"J:-#"lZvEgDDiaou@Q%I.,"E^EUKH8eiX[y'@DdZy"9&S: [6]nH$Uy"IB"(lV$ʊ֑:"'
Sen'pKUiYm"0u(W%Тݯ\@D8^WF0m0u(h:"$5:sO-̀D#JXY" '"M [Z@م}&D D: D}&D8mD: DAK4I;~ `@KN8"q0دZ%D}&D_q0["JXk>>nMw&Ђ_WĚȍr5D!b1"ȉD&3[^@b)/$r#uS"5.oEũC`˷"1Ђ:"iC$ۊ$:^H=d^
*4!1Q"CZ@Dg|MddLz{kE$gF%oIe
="2\nWp\I$'m3FdSC$"=HN%qDrH " o>R2翌Խ! ) dHt[/H$uĺ yeݥp?ґ?vh| 4m vtH-h3 +-9#C;y鏿Ş* jNY; GdKy݀H ZȎAd;qKMF# I&2K@D-D|gL97l sux"E6C |lAg>/5@B$9WR9I%~RmYy*u^=H:%Ddz5rE 6It @*:7I4my"1DC& Ze# pc&M We"JDഝOg;Nb
T@d ݅㡰ɉi;j/ߝlkh9K0IfG[Ha
@#3L"Qi'&2%ӂ$B$PR 5tMF$(9 p1AFI=ި i '"HirD}iD~Ļ5Cב0LDdӔJ]D lDbc"R=S
D'K vm8j29|+WIf̟
C"d $DBt
DND0OTHĥJ~: p*o L$'tslpDSD ~$
D$i}εڂӕXk誃IM uK- FX"JbAtc[
ED%$ndJ tDb n &]-"~w_hRCv"Qe>`"K#QVGh䘣sˉs\EDSk.DDmwwu,# 2V@$^ВtY7""o8`Xt Dc%¥mâ):3aАñYObRĤ͛uI@J/H\ā0ˈpi4ޡ` y{ )%Od.m;~Nc\~"@SP#4ONՈZ{Dا0w"O }-$"ߠa}6x7#|U>(>6?Y@}^!4tDq{a&"M&,3YDd_$D هHy&mkI%
!Jכ\eI[]CJgӖOdb]gI}qpL#g"DH5"$"icf]ϋln,gJ IuDI/J$DdS"\!FK۱lDY vse"|`ȽSF$:BBzFV$F ][*@v
a ߍHFz{$*/בj"=5ҚiI!OvD.ЈȄ%.;9rȄ8M%Pt#ZSQFD&gm@%J^\ߣW-13;'5%@@#@r5rzə%
Y$RMDZWD^S#~rfħH#oU!,O^D
[(qU3 C#RM+ ˻FrWeh$4]44V%)yUk"+@
L(qUՠFrVH69D?L#5\Gr^I_uJ\pD5FvF!. )+;]ʮZ 5ZH":2Qȧ2PuF7jG"yY DnՐqבTK4@ND87jqͫB\ypբc9044̰kFȩD#Wj#jKm# .!4%]@4FDbXHG伦4$r#>@d{,'r^~Uk?m4ab`;e ջf? L# .+VN$|U" 5j1VȽ#NLy(]+{G"]4 3_ NZF|"*M=QI4{ȭ_{ AGPu;ILdZy$5 "NL$G#1VD.5DDt]> 3 42FM
HwQD6vhdJ qٙ w՚5|~K;QhrD'k+X5G@#%DD浰u$5 "Ȁ=H"aXq"ųILdZhZbDFHc"h#2FZC ϻ_]]I[H#jC^FC# 8xtmUuԈU-ҞFĪV="Mm EZG"
Z{-*TZ=N"CG!tԈU-Ҟv_F"b^ekyFb HdZ嘮[`ҌH`B#+:fD$QC?F9U>
^Hu`2E9DPdH}#>[4 hsK
jzη< I8}F>[4~pzK twnЀHP* 7!R_#:pڀH Lbu@5:%
$F"
4Ӆ6^*ۂYDjo$Fr.Ds5r^e/!:uah$ۂȹT:", \,i-6P_u K tZ}D
J GވH|gL#g AH#稄ڎ?|=~{,D1oBde]agQ"4joVf_ ~J"%!s "SK"se:#0q
#R"D!"Fъ@S紅v.Y'MK$kޜРuv54"$r܊4!m':':"%5@7 %2CD pJ"{xidy>.;9,20OCN~sw!%ڬ^ot
ViJB7 xV q
"u"B&Dr4|*!L2"@ 'ZYuL{0YK|#]"'gf8 *3#kD$hw 9zlCEdjH`tAo8 jygV@ Gd2 6YV.gO }"DB"yq"
j䲍!D2H#|!j@d? CLdGyUq)L #:]ӝ:Gk)9_ ZXD$bYǁsT#_ jGdJuZH[[Hr'ڃyA&2łY}})9DYv
| YXDSS^ =ɕao|B'43<
j|}Om
saN#pDb~שVDfq \E"DAD9&Z'6kg{-"!1S:(7n
oe>s㥲2+eu"s5"/5i[CsI>Ad~# De9%@I 5BjX[_@_Y}j:NBdl`N
xp{V; ߃BEbM"@Je%"09,!n,%9pFjL$s;Dn~Ӏ L.b[\ Y>V}]@`\Iy,+ܶA$o* #,oD ~2Y'"2g!NM֠5$Ǒp"kN1DܺcgvՎH","1gb"t\Fg-ӑ4bw/"b=uڥONp\Hb)\~u6Kg>pwgvy]0Gjl¾&!6qAdzO˅>눴O*->V_K.̩>m
6L0KJ1"g9M DΤGlz%UT&4ŖMFc"3DՎH4ԑIU*kjC E3-.3uc''9UDD&LWDDFa5kT ""
P}>5~ZALA)7hAOWkI≈J~uFD*$&ِty5#OKg@DBY+BT]+B"@~W- L#Ad|DS!AYZ$vHt%?@dθ"iv>Y*[ǙfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDfFDmfDf?%+7IENDB`DyK yK @mailto:xxx@lists.oasis-open.orgDyK yK Pmailto:xxx-comment@lists.oasis-open.orgDyK yK ~mailto:xxx-comment-request@lists.oasis-open.org?body=subscribe{DyK
_Toc35147766{DyK
_Toc35147766{DyK
_Toc35147767{DyK
_Toc35147767{DyK
_Toc35147768{DyK
_Toc35147768{DyK
_Toc35147769{DyK
_Toc35147769{DyK
_Toc35147770{DyK
_Toc35147770{DyK
_Toc35147771{DyK
_Toc35147771{DyK
_Toc35147772{DyK
_Toc35147772{DyK
_Toc35147773{DyK
_Toc35147773{DyK
_Toc35147774{DyK
_Toc35147774{DyK
_Toc35147775{DyK
_Toc35147775{DyK
_Toc35147776{DyK
_Toc35147776{DyK
_Toc35147777{DyK
_Toc35147777B
iD@D
Normal
PP OJQJ_HaJmH sH tH l`l
Heading 1($
& Fx$d@&N 5B* CJ$KH \^JaJ phd@d
Heading 2,H2,$
& F
h$d@&NCJ \]aJ J@!J
Heading 3,H3
& F
h@& CJ\aJJ@1J
Heading 4,H4
& F
h@& CJ\aJ B@AB
Heading 5
& F
h@&
\]aJF@QF
Heading 6
& F
h@& CJ\aJ:@a:
Heading 7
& F
h@&@@q@
Heading 8
& F
h@&6]: @:
Heading 9
& F
0h@&hx^h>E@> List Continue 2?x^&`&
TOC 8
@x^x&`&
TOC 9
A@^@p @
EZxowd_
f
d2 <
=
I
O
P
U
V
34WX/z{LMded*56>o 5 i j k l m n q 000000000000000000000000000000 00 0 0 00 0 0=
0=
0=
00 0 0 0 00P
0P
0P
0040404 00 0 0 00 00{ 0{ 0{0{ 00M 0M0M 00 0 0 0 0* -0000000@0@0@0@0@0@0@0@+0@0@0@0@0@0@+0@+0@0@0@0@+0@0@0@0@0@0
0_/
c p$
W n$p$ o$ Mh=4D_abd 0?Z\]_~
,Facdf
,D_abdp XXXt
tX%tX%tX%tX%tX%tX%tX%tX%tX%tX%tX%tX%t̕y!4!! _Toc35147766 _Toc35147767 _Toc35147768 _Toc35147769 _Toc35147770 _Toc35147771 _Toc35147772 _Toc35147773 _Toc35147774 _Toc35147775 _Toc35147776 _Toc35147777=
P
4{M*6q
H
T
Vc4=q 2 C f k U
`
6 = n u
~ { l'/&gx n q Z_* 3
Z[/5.0 n q 333333333333325Zw Fd Db 44{{MM Z h l l m m q Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-03.doc Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-03.doc Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-03.doc Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-03.doc Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-04.doc Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-04.doc Eve L. Maler?C:\My-Documents\oasis\spectools\wd-spectools-word-sample-04.doc Hal LockhartwC:\Documents and Settings\hlockhar\Application Data\Microsoft\Word\AutoRecovery save of wd-spectools-word-sample-04.asd Hal LockhartMC:\Documents and Settings\hlockhar\My Documents\xacml-implement-guide-1.1.doc Hal LockhartMC:\Documents and Settings\hlockhar\My Documents\xacml-implement-guide-1.1.doc| }L6j~ rJB}R`iHE\p 2qfC:\Documents and Settings\hlockhar\Application Data\Microsoft\Templates\wd-spectools-word-template.dot Eve L. Maler Hal LockhartOh+'0 ,
H T
`lt| s s
Eve L. Malero ve ve wd-spectools-word-template.doti
Hal Lockhartwor 3l Microsoft Word 9.0e@Ik@H@՜.+,D՜.+,
Usage: http://www.kk-software.de/kklynxview/get/URL
e.g. http://www.kk-software.de/kklynxview/get/http://www.kk-software.de
Errormessages are in German, sorry ;-)