Stack Overflow: What’s the difference between policy target and rule target in XACML?

Are you looking for further clarification in working with XACML? This post originally appeared on Stack Overflow.

Question: XACML allows us to specify <Target> tag in both <Policy> as well as in <Rule> tags.

What I would like to understand is that:

  • What is the utility of having these at both levels?
  • What is the individual effect of both of these methods?
  • How and when one should use them together or separately?

Any help in this regard would be appreciated. Thanks.


You can have a Target in PolicySetPolicy, and Rule. They all achieve the same thing i.e. restrict the scope of the element (PolicySetPolicy, or Rule).

Your question should be more around why the three elements? it’s actually a way to divide and conquer your authorization challenge. Imagine you’re tackling authorization for an entire bank. You might have a policy set that focuses on the retail part of the bank and another that focuses on the commercial side of the bank. You would have an attribute in the target of the PolicySet element that would distinguish between retail and commercial.

Inside the retail bank PolicySet you could have another series of policy sets or maybe just policies where the Target would distinguish between different applications. Inside each Policy element you could have Rule elements that would have targets that would distinguish between functions of the applications.

Answered by David Brossard, VP of Customer Relations at Axiomatics

Other Blogs

3 keys to re-evaluate your authorization management
On May 27, I had the pleasure to join the KuppingerCole KCLive event with several industry peers in a panel discussion about  “Enabling the Future...
How OAuth is related to Attribute Based Access Control
What is Authorization? Authorization, also referred to as Access Control, is the process that follows authentication (which checks your identity and ensures that you are...
Modern Enterprise Authorization Management System
Gartner has an interesting article titled “Modernize Your Runtime Authorization” that highlights some aspects you need from a modern enterprise authorization systems. Over the years...