Changes between Version 5 and Version 6 of FeddABAC

Timestamp:

Jan 16, 2011 5:49:56 PM (14 years ago)

Author:

faber

Comment:

--

FeddABAC

@@ -68 +68 @@
 The first rule names the conjunction of two experiment controller attributes and the second line maps that to a local create attribute.  The first attibute is used to map to local credentials.
 
-The mapping to local credentials is accomplished by a 
+The mapping to local credentials is accomplished by a map file that maps an ABAC credential to a local data tuple.  The encoding above would be:
+
+{{{
+ac_fedid.project_proj1_user_user1 -> (DETER, faber, faber)
+}}}
+
+The tuple has the same format as the non-ABAC [FeddDatabases#AccessComponentAccessDB access control database] for that kind of controller.
+
+== ABAC Logic: RT0 vs. RT1 ==
+
+ABAC can support several underlying logics.  The current logic, RT0, implemented by [http://abac.deterlab.net libabac] represents attributes as simple strings.  This is why encoding a project takes the form {{{project_}}}''name''.
+
+RT1 allows for parameterized attributes, that is an attribute is a string and 0 or more typed parameters.  Those attributes would take the form of {{{project(}}}''name''{{{)}}}, and would allow some more sophisticated deduction rules.  While the RT0 vs. RT1 distinction is only a convenience for the encoding of three-names, we intend to pursue implementing the more powerful logic.
+
+