[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: XACML Research.

• To: Chiusano Joseph <chiusano_joseph@b...>
• Subject: Re: XACML Research.
• From: seth proctor <Seth.Proctor@S...>
• Date: Thu, 16 Sep 2004 23:27:29 -0400
• Cc: xml-dev@l...
• In-reply-to: <414996BB.6E3E4906@b...>
• References: <09495D95A51DD740AA3258E96CA66A1E09BA4C@T...><414996BB.6E3E4906@b...>
• Sender: Seth.Proctor@S...
• User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2)Gecko/20040803

Chiusano Joseph wrote:
> Regarding the future of XACML:
> 
> In the past there has been quite a bit of observation (justified, IMO)
> regarding overlaps in functionality between SAML and XACML, with regard
> to authorization decisions. In the SAML 2.0 Core Specification (OASIS
> Committee Draft[1], released 17-Aug-2004), it states on p.29 regarding
> the SAML Authorization Decision Statement:
> 
> "Note: The <AuthzDecisionStatement> feature has been frozen as of SAML
> V2.0, with no future enhancements planned. Users who require additional
> functionality may want to consider the eXtensible Access Control Markup
> Language [XACML], which offers enhanced authorization decision
> features."
> 
> This is clearly a great step toward helping ensure that the 2 standards
> do not evolve in an overlapping manner for this functionality. One may
> interpret this as meaning a brighter future for XACML.

I think you're right on here. There has been considerable effort in the 
XACML and SAML 2.0 processes to clearly define the relationship, and 
make sure we're not duplicating effort. In addition to specific changes 
to SAML 2.0, there is also an XACML Profile for SAML (which was just 
voted today to committee draft) which defines some specific elements of 
this relationship. I think this will make it even easier to use SAML and 
XACML as complimentary technologies.

As an aside, I've been involved in several prototype experiments to use 
SAML and XACML together. With the 2.0 specifications coming down the 
pipeline, I'm looking forward to finally seeing standard implementations 
that will interoperate. If anyone is bored (heh) and looking for 
something to try building, I'd be happy to provide some pointers about 
how to get started on this...


seth

• References:
  • RE: XACML Research.
    • From: "Diego M. Gonzalez" <diegog@l...>
  • Re: XACML Research.
    • From: "Chiusano Joseph" <chiusano_joseph@b...>

• Prev by Date: Re: xml, xslt and namespaces
• Next by Date: Re: XACML Research.
• Previous by thread: Re: XACML Research.
• Next by thread: RE: XACML Research.
• Index(es):
  • Date
  • Thread