Hi all
For a long time I ask myself what exactly the need is that XACML has PolicySet, Policy and Rule.
A PolicySet has combining algorithms to combine Policies and a Policy has (the same) combining algorithms to combine Rules.
Therefore in my opinion it really does not make sense to have 3 elements.
Have a look at the following picture, what exactly should the difference between the two trees be (assuming the each level has the same combining algorithm in both trees)?
I asked this question to the xacml-comment mailinglist but was not really satisfied by their answer (
http://lists.oasis-open.org/archives/xacml-comment/200903/msg00003.html).
Maybe someone could shed light on that.
Author
