Subject: [Simple] Pointer to standard policy language

From: Steve Hanna <[email-masked]>
Date: Mon, 18 Nov 2002 17:28:08 -0500

In today's SIMPLE WG session, I promised to send a pointer to the
work going on elsewhere to define a standard access control policy
language.

The language I was referring to is XACML (eXtensible Access Control
Markup Language). It is an XML-based access control policy language
designed to support a wide variety of applications. The spec is
currently in the middle of a 30 day Public Review, so this is a
great time to read it and send your comments. For more info, see
http://www.oasis-open.org/committees/xacml.

There are definite advantages to using a standard language for
expressing access control policies. Developers can reuse existing
code. Users don't need to learn special-purpose languages. Etc.

I would recommend that in defining your protocols, you treat an
access control policy as a blob, allowing users to set or get them
but not defining commands to manipulate the internal contents. This
will allow you to use XACML or any successor language or even to
define your own language if you should decide at some later time
that you want to do so.

I do not subscribe to your WG list, so please cc me on subsequent
discussions of this topic (unless you explicitly want to exclude me!).

Thanks,

Steve Hanna

_______________________________________________
simple mailing list
[email-masked]
http://mailman.dynamicsoft.com/mailman/listinfo/simple

---

From: [email-masked]
Date: Tue, 19 Nov 2002 22:34:24 +0200

Hi Steve,

Thanks for the pointer.

Before getting deeper into the details, I would like to know a couple of basic points about XACML's applicability in this case. In my opinion the standardized protocols to setup presence policy rules are most valuable for wireless terminals with small displays, since using a web browser aside of SIP client is quite clumsy with them.

If we assume the XACML document would be a blob, that the client can just read and replace, would that be feasible over low-bandwidth links (say, <50 kps)? This depends on how big the documents would get, and wheter ALL the information, such as URI lists, would be included in the same blob (document). For instance, if reactive authorization works so that a SIP URI is appended to some list, I don't think it makes sense to send the whole policy doc. to the server. 

In my opinion the protocol should have some light-weigth procedures to do the most common operations, such as adding and deleting URIs (assuming the authorization model in the requirements draft).

Would it still make sense to use XACML, and use some simple XML manipulation operations on it, to achieve this?

I'll do some calculations to see whether this will be critical or not in real-life systems.

Markus  

> -----Original Message-----
> From: ext Steve Hanna [mailto:[email-masked]]
> Sent: 19 November, 2002 00:28
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Simple] Pointer to standard policy language
> 
>