X500 Name Match unclarity

Hi,

There are some obscurities regarding to the X500 name match functions in the XACML 2.0 specification.
The function of interest ist the urn:oasis:names:tc:xacml:1.0:function:x500Name-match.
The obscurity is about the term terminal sequence that is not defined in any X500 spec. It only appears here in the XACML 2.0 Spec. So it is in fact not defined.

We from HERAS-AF implemented to function the following way:

Code:

public Object handle(Object... args) throws FunctionProcessingException {
try {
if (args.length != 2) {
throw new FunctionProcessingException(
"Invalid number of parameters");
}
String[] expectedName = ((X500Principal) args[0]).getName(
X500Principal.RFC2253).split(",");
String[] comparedName = ((X500Principal) args[1]).getName(
X500Principal.RFC2253).split(",");
for (int i = 0; i < expectedName.length; i += 1) {
boolean found = false;
for (int k = 0; k < comparedName.length; k += 1) {
if (expectedName[i].trim().equals(comparedName[k].trim())) {
found = true;
}
}
if (!found) {
return false;
}
}
return (true);
} catch (ClassCastException e) {
throw new FunctionProcessingException(
"The arguments were of the wrong datatype.");
} catch (FunctionProcessingException e) {
throw e;
} catch (Exception e) {
throw new FunctionProcessingException(e);
}
}

Our implementation returns true if all elements of the comparedName are contained in the expectedName, in any order.

Another interpretation of terminal sequence could be that only the terminus of a x500 name must match.
So e.g.:
expected: CN=Foo, DC=bar, DC=ch
provided: CN=Foo, DC=bar, DC=ch (would match)
provided: CN=Foo, DC=bar, DC=org (would not match)
provided: CN=Foo, DC=xy, DC=ch (would match)

This function could be implemented something like:
candidateDN.getName(X500Principal.CANONICAL).endsWith(target.getName(X500Principal.CANONICAL))

Based on the conformance tests of XACML 2.0, conformance test IIC084, both interpretations could be true.

I am stucked a little bit here, therefore I addressed this question to the XACML TC comments mailing list.
I am going to post their response here as soon as possible.