Are you looking for further clarification in working with XACML? This post originally appeared on Stack Overflow.
Question: XACML allows us to specify
<Target> tag in both
<Policy> as well as in
What I would like to understand is that:
- What is the utility of having these at both levels?
- What is the individual effect of both of these methods?
- How and when one should use them together or separately?
Any help in this regard would be appreciated. Thanks.
You can have a
Rule. They all achieve the same thing i.e. restrict the scope of the element (
Your question should be more around why the three elements? it’s actually a way to divide and conquer your authorization challenge. Imagine you’re tackling authorization for an entire bank. You might have a policy set that focuses on the retail part of the bank and another that focuses on the commercial side of the bank. You would have an attribute in the target of the
PolicySet element that would distinguish between retail and commercial.
Inside the retail bank
PolicySet you could have another series of policy sets or maybe just policies where the
Target would distinguish between different applications. Inside each
Policy element you could have
Rule elements that would have targets that would distinguish between functions of the applications.
Answered by David Brossard, VP of Customer Relations at Axiomatics