New Issue 3793: Add example about policies in the context of relationships between multiple entities

I wanted to send this proposal before the today's optionality tar ball
so as to provide additional context. The purpose of the proposal is to
add an example in the Primer (probably in the section 2.5 Combining
Policy Assertions or 3.3 Policy Data Model) about dealing with
requirements and capabilities of entities as [optional] behaviors in the
most basic use case for requester and provider. I am suggesting the
outline of the use case. I can come up with the actual text if the WG
will agree with the approach. 

 

The example may describe policy design for the WS-Security token
authentication scheme when only two entities - requester and provider -
are involved. The following four policy assertions with respect to the
corresponding entities may be considered:

1. "The provider only accepts WS-Security tokens as means of the
authentication"

2. "The provider may accept WS-Security tokens as means of the
authentication" (optional="true")

3. "The requester must attach the WS-Security token to a message"

4. "The requester may attach the WS-Security token to a message"
(optional="true")

 

I think that briefly describing some combinations of one or more
assertions above will provide policy designers with a good understanding
of policy assertion choices and possible policy enforcement
implications. The example would also show that typically any policy
assertion should deal with one entity at a time, and that combinations
of assertions (behaviors) would allow the designers to cover
relationships/dependencies between entities.

 

Regards,

 

Yakov Sverdlov

CA