More on Attribute Filtering.

[Cantor, Scott]

> > I have a lot more I can say, but we should get on Skype and do this, it's
> > too hard to cover in an email.
> 
> Did you skype ?
> 
> I'm interested in the discussion, just catching up.

Just email, my follow up message seemed to clarify the major source of confusion about how the attributeID gets used. I think there are some bugs in the v2 code that probably are making the confusion worse.

I have to help produce some test cases so we can flush out the more esoteric stuff.

The corner cases involve building attribute rules that actually reference a different attribute then the one being released. For example, "release any value of attribute X if attribute Y has value Z". That's why you would supply an attributeID inside a PermitValueRule.

Ordinarily that's more intuitively done as a PolicyRequirementRule (e.g. apply policy only if attribute Y has value Z, and then release any value of X in that policy) but the language was designed to be sort of pivotable on that dimension.

-- Scott