Multiple resource profile of XACML v2.0 profile support ?

[alexisd]

Hi,

In our current R&D project, we plan to use Heras AF as a XACML implementation. We've recently come across the problem of multiple queries from the PEP to the PDP. We've just found the "Multiple resource profile of XACML v2.0" XACML optional profile (available at this address : http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-mult-profile-spec-os.pdf).

I was wondering if Heras-AF supports this profile ? Maybe only some options... For example, does it support multiple <Resource> elements in a XACML request ?

Thank you in advance for your answers,
Best regards,

Alexis Davoux
Orange Labs

[Florian Huonder]

Hi Alexis,

The HERAS-AF XACML Implementation does not support the multiple resources profile.
That means if you try to evaluate a request with multiple resources then this will evaluate to an Indeterminate.
This would mean you would have to write a supporter class that splits up a request with multiple resources into multiple request with only one resource per request and evaluate each separately.

Let me know if I could help you.

Regards,
Florian

[alexisd]

Hi Florian,

Thanks for your quick answer and for the tip for a potential implementation.

We'll let you know if we decide to add/support this feature for Heras-AF.

Best regards,
Alexis

[Florian Huonder]

Hi,
Thanks a lot. We are always very interested in contributions from the community.
We would very appreciate your input (if you'd decide to extend HERAS-AF).

Regards,
Florian