Re: Doubt

[Srikanth Kotha <kotha@cse.Buffalo.EDU>]

Hi Konstantin,

	Thanks for your response.  Please see my argument about
PolicyEvaluatorAdmin interface (add_policy method) inline.

Srikanth.
On Fri, 29 Jan 1999, Konstantin Beznosov wrote:

> Hi Srikanth,
> 
> I'm cc-ing the response to hrac submitters mail list so that they can
> participate in answering your questions too.
> 
> > 
> > Hi Konstantin,
> >      
> >      Had another doubt; This is regarding PolicyName that is used in
> > the PolicyEvaluator.
> > 
> >      Suppose there is only one PolicyEvaluator for the whole system (It
> > understands and can evaluate all the policies).  Now, for each
> > ResourceName there could potentially be (though there will not be) a
> > unique Policy.  So will there be a PolicyName for each unique Policy
> > which would lead to a very large (ResourceName-PolicyName) list? I
> > hope you understand the question ?
> 
> It's correct. If for each resource name, there is a unique policy then the list
> that maps a resource name into a policy is proportional to number of resource
> names. However, if your policies are such that a group of resource names is
> associated with the same policy, then (but not with the current version of
> PolicyEvaluatorAdmin) some grouping mechanisms, such as regular expressions or
> assumptions about tree-like organization of resource names, could be used to
> reduce the mapping list size.
> 
> The question here, and it's more to the submitters than to you, is if
> PolicyEvaluatorAdmin should have the capability to manipulate with groups of
> resource names.
> 
> 
> > 
> >      Also in the PolicyEvaluatorAdmin Interface, there is a method
> > 
> >      replace_policy (
> >           in PolicyName policy_name
> >           in ResourceName resource_name);
> > 
> >      shouldn't it be PolicyNameList instead of PolicyName since
> > add_policy has the same arguments ??
> 
> no because add_policy takes only one policy. I do not see a mistake here.
> 

Does this mean that there could be only 1 policy/ ResourceName / Policy
Evaluator ???

I was under the impression that there could be multiple policies
corresponding to a single resourceName as this could help in limiting the
policy names.  

For eg., consider the following policyNames of individual resources.

AB, AC, AD, ABC, IJK, ABCD, ACIJ, IOJMN .....

where

AB stands for : A or B  

i.e. in order to satisfy policy AB, either subpolicies A or B should be
satisfied.

Similarly, in order to satisfy policy

IJK either of the subpolicies I or J or K should be satisfied.

Obviously the list of policyNames in the eg. above would be huge.

But if we allowed multiple (sub)policies (& policyNames) per resourceName
in the same policyEvaluator, by replacing the composite Policy by it's
constituent subpolicies, we would have a manageable size of policyNames.

eg. replace AB by A,B

However, this would require all the policies to be framed in either
Conjunctive Normal Form or Disjunctive Normal Form.

Please let me know if it makes sense or have I got it all wrong somewhere
??



> 
> Thanks for your questions.
> Konstantin
> 
> ----------------
> Broadcast message to hrac-rfp from Konstantin Beznosov <beznosov@baptisthealth.net>.
> Go to http://cadse.cs.fiu.edu/omg/hrac-rfp to browse the mail list archive.
> 

...............................................................................

Srikanth Kotha

Office Address : 334 Bell Hall,	      Home Address : 121 Heath St.(Lower),
		 UB North Campus,                    Buffalo,
		 Amherst, NY 14260.		     NY 14214.	

Office Phone # : (716) 645-2193.      Home Phone # : (716) 832-8996.

...............................................................................

----------------
Broadcast message to hrac-rfp from Srikanth Kotha <kotha@cse.Buffalo.EDU>.
Go to http://cadse.cs.fiu.edu/omg/hrac-rfp to browse the mail list archive.