cdanger
commented
6 months ago The names, though, suggest that we are referencing an identifier rather than the identified object. These names make more sense (and distinguish the simplified references from the more complicated form in XACML 3.0):
<xs:element name="PolicySetReference" type="xs:anyURI"/> <xs:element name="PolicyReference" type="xs:anyURI"/> <xs:element name="GlobalVariableReference" type="xs:anyURI"/>However, note that #12 suggests GlobalVariableReference as a possible new kind of expression.
Some comments:
-
Indeed, issue #12 suggests that GlobalVariableReference be a new kind of Expression (much like VariableReferences), unlike Policy(Set)References, so I'd rather not mix the discussions on both types of references in this issue. I suggest we leave the definition of GlobalVariableReference to #12 only.
-
In #11, we decided to get rid of PolicySet and have a new Policy definition replace both former Policy/PolicySet, so no need for PolicySetReference anymore. PolicyReference covers both.
-
In #9 we introduced parameterized policies, and we're discussing references to such policies, so I am thinking since we are re-defining policy references here, we can use the new PolicyReference type definition to reference parameterized ones as well, and therefore avoid defining a new type like ParameterizedPolicyReference (which increases schema complexity). A parameterized policy reference is just a policy reference with arguments, so I suggest to take @steven-legg 's proposal to reference by XML attribute, and add the optional Expressions for the policy arguments if there is any, i.e. if the policy is parameterized:
<xs:element name="PolicyReference" type="PolicyReferenceType"/>
<xs:complexType name="PolicyReferenceType">
<xs:sequence>
<xs:element ref="xacml:Expression" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="PolicyId" type="xs:anyURI"/>
</xs:complexType>So a reference to a non- parameterized policy would look like @steven-legg 's example before, although I can't see why still we have to call it PolicyIdReference instead of PolicyReference:
<PolicyReference PolicyId="http://example.com/mypolicy"/>And a reference to a parameterized policy with 2 parameters for instance like this:
<PolicyReference PolicyId="http://example.com/mypolicy2">
<GlobalVariableReference GlobalVariableId="X"/>
<VariableReference VariableId="y"/>
</PolicyReference>
steven-legg
References to policies and policy sets (from within policies and policy sets) are instances of the following type:
The implementation experience of the active members of the TC is that the EarliestVersion and LatestVersion attributes never get used, nor does the pattern matching ability of the Version attribute.
Policies and policy sets have a Version attribute that, although used, carries information that could just as easily be encoded (and probably should be encoded) into the URI.
The proposed change is to remove the Version attribute from Policy and PolicySet and to replace IdReferenceType with xs:anyURI.
This leads to the definitions:
The names, though, suggest that we are referencing an identifier rather than the identified object. These names make more sense (and distinguish the simplified references from the more complicated form in XACML 3.0):
However, note that #12 suggests GlobalVariableReference as a possible new kind of expression.
We could go over to referencing policies and global variables by XML attribute instead of by element content (to align with simpler XSD in #12), which suggests:
It would be less verbose in XML but more verbose in JSON: