|
From: Seth P. <Set...@su...> - 2005-07-20 16:38:25
|
Hi Jie. On Jul 17, 2005, at 1:26 PM, Jie Ren wrote: > I am using SimplePDP to evaluate a request against a policy. I > need > to include some homemade content in the ResourceContent section of the > request.xml, much like the resource-content example. Yet these > homemade > content reside in our own namespace, so I need a way to insert the > namespace > prefix declarations. Currently the encode function of RequestCtx only > outputs "<Request>" at the beginning. In the future it might be more > flexible to let the caller specify a namespace declaration (default > to null) > before calling encode. Yup. This is a known problem. My apologies that this feature wasn't added sooner. For now, my suggestion is that you extract the Result and create the Request element yourself. I know that's not very helpful. If you're interested in committing code to fix this, let me know. > Another issue I encountered is the classification of > general/target/condition functions in FunctionFactory. My specific > problem > is to use a string-subset function as the MatchId for a > SubjectMatch. Since > now subset function is called ConditionSetFunction, included as a > member of > ConditionSetFunctionCluster, and initialized in > initConditionFunctions in > StandardFunctionFactory, it means it can only be used in the > Condition part > of a rule. Yet it looks that the code can also support using it in > a target. > I am just curious about the rationale of this design and where the > spec > requires so. This is a requirement of the spec. Only certain functions are allowed in the Target. Specifically, these are boolean functions that accept two arguments, neither of which may be a bag or a set (ie, base types). The specific function you're asking about operates over collections, so it can't be used in a TargetMatch. This one's not my fault :) seth |
