Hi Jie.
On Jul 17, 2005, at 1:26 PM, Jie Ren wrote:
> I am using SimplePDP to evaluate a request against a policy. I
> need
> to include some homemade content in the ResourceContent section of the
> request.xml, much like the resource-content example. Yet these
> homemade
> content reside in our own namespace, so I need a way to insert the
> namespace
> prefix declarations. Currently the encode function of RequestCtx only
> outputs "<Request>" at the beginning. In the future it might be more
> flexible to let the caller specify a namespace declaration (default
> to null)
> before calling encode.
Yup. This is a known problem. My apologies that this feature wasn't
added sooner. For now, my suggestion is that you extract the Result
and create the Request element yourself. I know that's not very
helpful. If you're interested in committing code to fix this, let me
know.
> Another issue I encountered is the classification of
> general/target/condition functions in FunctionFactory. My specific
> problem
> is to use a string-subset function as the MatchId for a
> SubjectMatch. Since
> now subset function is called ConditionSetFunction, included as a
> member of
> ConditionSetFunctionCluster, and initialized in
> initConditionFunctions in
> StandardFunctionFactory, it means it can only be used in the
> Condition part
> of a rule. Yet it looks that the code can also support using it in
> a target.
> I am just curious about the rationale of this design and where the
> spec
> requires so.
This is a requirement of the spec. Only certain functions are allowed
in the Target. Specifically, these are boolean functions that accept
two arguments, neither of which may be a bag or a set (ie, base
types). The specific function you're asking about operates over
collections, so it can't be used in a TargetMatch. This one's not my
fault :)
seth
|