Skip to content

Commit

Permalink
Combined tables 5 and 6 for policy evaluation.
Browse files Browse the repository at this point in the history
  • Loading branch information
steven-legg committed Dec 19, 2024
1 parent 3cd940a commit 5dd6b2e
Showing 1 changed file with 17 additions and 21 deletions.
38 changes: 17 additions & 21 deletions xacml-v4.0-csd01.md
Original file line number Diff line number Diff line change
Expand Up @@ -2724,44 +2724,40 @@ A **_rule_** has a value that can be calculated by evaluating the **_rule_**'s *

###### Table 4 Rule truth table

| Condition | **_Rule_** Value |
| **_Condition_** | **_Rule_** Value |
| :--- | :--- |
| `True` | **_Effect_** |
| `False` | `NotApplicable` |
| `Indeterminate` | `Indeterminate{P}` if the **_Effect_** is Permit, or `Indeterminate{D}` if the **_Effect_** is Deny |

## 7.12 Policy evaluation

The value of a **_policy_** SHALL be determined only by its contents, considered in relation to the contents of the request **_context_**. A **_policy_**'s value SHALL be determined by evaluation of the **_policy_**'s **_target_** and, according to the specified **_combining algorithm_**, **_policies_** and **_rules_**.
The value of a **_policy_** SHALL be determined only by its contents, considered in relation to the contents of the request **_context_**. A **_policy_**'s value SHALL be determined by evaluation of the **_policy_**'s **_target_** and evaluation of the specified **_combining algorithm_** on the contained **_policies_** and **_rules_**.

The **_policy_** truth table is shown in Table 5.

###### Table 5 Policy truth table

| **_Target_** | Child **_Policy_** and **_Rule_** Values | **_Policy_** Value |
| **_Target_** | **_Combining Algorithm_** Value | **_Policy_** Value |
| :--- | :--- | :--- |
| `Match` | Don't care | Specified by the **_combining algorithm_** |
| `Match` | `NotApplicable` | `NotApplicable` |
| `Match` | `Permit` | `Permit` |
| `Match` | `Deny` | `Deny` |
| `Match` | `Indeterminate` | `Indeterminate{DP}` |
| `Match` | `Indeterminate{DP}` | `Indeterminate{DP}` |
| `Match`| `Indeterminate{P}` | `Indeterminate{P}` |
| `Match`| `Indeterminate{D}` | `Indeterminate{D}` |
| `No-match` | Don't care | `NotApplicable` |
| `Indeterminate` | See [Table 6](#table-6-the-value-of-a-policy-when-the-target-is-indeterminate) | See [Table 6](#table-6-the-value-of-a-policy-when-the-target-is-indeterminate) |
| `Indeterminate` | `NotApplicable` | `NotApplicable` |
| `Indeterminate` | `Permit` | `Indeterminate{P}` |
| `Indeterminate` | `Deny` | `Indeterminate{D}` |
| `Indeterminate` | `Indeterminate` | `Indeterminate{DP}` |
| `Indeterminate` | `Indeterminate{DP}` | `Indeterminate{DP}` |
| `Indeterminate`| `Indeterminate{P}` | `Indeterminate{P}` |
| `Indeterminate`| `Indeterminate{D}` | `Indeterminate{D}` |

Note that none of the **_combining algorithms_** defined by XACML 4.0 take parameters. However, non-standard **_combining algorithms_** MAY take parameters. In such a case, the values of these parameters associated with the **_policies_** and **_rules_**, MUST be taken into account when evaluating the **_policy_**. The parameters and their types should be defined in the specification of the **_combining algorithm_**. If the implementation supports combiner parameters and if combiner parameters are present in a **_policy_**, then the parameter values MUST be supplied to the **_combining algorithm_** implementation.

## 7.14 Policy value for Indeterminate Target

If the **_target_** of a **_policy_** evaluates to `Indeterminate`, the value of the **_policy_** as a whole is determined by the value of the **_combining algorithm_** according to Table 6.

###### Table 6 The value of a policy when the target is `Indeterminate`

| **_Combining algorithm_** Value | **_Policy_** Value |
| :--- | :--- |
| `NotApplicable` | `NotApplicable` |
| `Permit` | `Indeterminate{P}` |
| `Deny` | `Indeterminate{D}` |
| `Indeterminate` | `Indeterminate{DP}` |
| `Indeterminate{DP}` | `Indeterminate{DP}` |
| `Indeterminate{P}` | `Indeterminate{P}` |
| `Indeterminate{D}` | `Indeterminate{D}` |

## 7.15 PolicyIdReference evaluation

A **_policy_** id reference is evaluated by resolving the reference and evaluating the referenced **_policy_**.
Expand Down

0 comments on commit 5dd6b2e

Please sign in to comment.