Re: [sunxacml-discuss] A problem with Obligations

[seth p. <Set...@Su...>]

Hi Jim.

> I am issue a request against a set of Policies and get back the correct
> response with associated Obligations. The only problem is that the
> Obligation does not contain the corresponding Attribute Value. Basically
> I get everything up to and including the AttributeAssignment but I do
> not get the enclosed AttributeValue node.

There is frequent confusion around how Obligations work. Without an 
example of the policy you're using I can't say for sure, but what you're 
experiencing sounds like something I've heard before. I suspect that 
you're not seeing a bug in the code, but if what I suggest here doesn't 
solve your problem let me know, and I'll take a closer look. Also, make 
sure you're using the latest code, since there was a bug in the initial 
1.0 release.

The schema defines AttributeAssignment as an AttributeValue. The common 
mistake that a lot of people make is to have something like

   <AttributeAssignment ...>
     <AttributeValue DataType="...">value</AttributeValue>
   </AttributeAssignment>

While technically valid, this probably isn't what you want. If you're 
trying to specify an AttributeValue that should get passed back from an 
Obligation, you want

   <AttributeAssignment DataType="..." ...>value</AttributeAssignment>

Then when you get the AttributeValue, it will have the right value. The 
1.1 release (which is almost ready but moving slowly since I'm at CCS 
this week) contains a deeper Obligations example, but like I said I'm 
happy to walk through an example on the list if I haven't addressed your 
problem here.

As a side note, there is still some question in my mind about the right 
way to handle certain DataTypes in assignments. I'm trying to decide now 
on the best way to fix this, but I don't think it's likely to relate to 
your problem.


seth