-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sanjiva Weerawarana wrote:
> On Tue, 2006-06-27 at 09:00 +0100, Brian Hulse wrote:
>> I understand what you're saying, but there's a processing
>> overhead here. In your model, each module will winnow out the
>> alternatives it cannot support and pass on the result to the
>> next. The problem with this is that each will have to do an
>> exhaustive search throughout the whole policy tree, including, as
>> you say, a complete match on what could be very complex
>> WS-SecurityPolicy assertions. This isn't necessary, we only want
>> a single supported alternative, we don't need to process
>> everything to get this.
>
> So what algorithm are you suggesting? I guess an option would be to
> ask all the modules whether they can handle a specific alternative
> and then if not go to the next alternative?
As far as I understand, this is what Brian is suggesting. Consider the
following policy.
<policy>
<ExactlyOne>
<All><A1 /><B1 /></All>
<All><A1 /><C1 /></All>
<All><B1 /><C1 /></All>
</ExactlyOne>
</Policy>
First we pick <A1/> assertion and ask from module A whether it can
support it. If so we can pick the next assertion <B1> and ask from the
module B whether it can support it. If so we can safely pick the first
alternative. If not then only we need to evaluate <C1>.
This is a better way of picking an alternative because otherwise
Module A have to evaluate <A1> twice with the previous model we have.
Anyway this is a nice optimization we could adopt.
Still we need to have that method in the module interface with a
slight modification where the parameter of the method should be
changed from Policy to Assertion which allows to pass a domain
specific assertion to the method. Further it should just returns true
if the module can support that assertion or false otherwise.
>
> Even for that, the method indicated would have to be added to
> Module.java; the difference is how we call it.
>
> So, can we go ahead with adding this method?
>
>> In addition, I was being circumspect when I stated registration
>> of QNames ... this is a first stage pass of the winnow process,
>> which is high level and easy to do. After that, a higher level
>> processing unit (higher than the modules) would need to examine
>> each alternative and ask each module about its support statement
>> on the assertions in its domain. This two stage approach is what
>> our code does and in doing so, stops when a suitable alternative
>> is found, rather than the exhaustive approach you suggest. I
>> understand that in small policies, with no or simple choice,
>> there is very little difference, but in the larger, more complex
>> cases, this will matter.
>
> See above; what you described is a good improvement of the above
> algorithm. In any case, it still requires the same method to be
> added to the Module class.
agreed
>
>> It should also be stated that there is still the possibility with
>> your model of a bad choice. If the model you choose is that
>> domain A just removes all alternatives it cannot support, and it
>> leaves 2 alternatives ... which does it use? It could select one
>> that some other domain could not support ... when in fact there
>> is an alternative which could pass everyone's tests. In this
>> respect, you have to have some central point of control, a Policy
>> Decision Point, and it can't be farmed out to the domains. Am I
>> just confusing the issue?
>
> No that cannot happen. If domain A leaves 2 alternatives, that
> means it CAN handle both. The policy decision point can pick any of
> those alternatives and then life must be good with that. Period.
agreed
Sanka
>
> Sanjiva.
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [EMAIL PROTECTED] For
> additional commands, e-mail: [EMAIL PROTECTED]
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.1 (GNU/Linux)
iD8DBQFEohfM/Hd0ETKdgNIRAjJCAKCOY3ZEJ4eSJH2oyMs4E/Hztm3YkgCggZbP
QtiWGL0JeuQ2YNqqgGZy34w=
=79qu
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
