Skip to content

Commit 4714300

Browse files
peppelinuxpeppelinux
authored
Merge pull request #177 from vdzhuvinov/adjust-policyoperator-combinations
Adjust and simplify policy operator combinations
2 parents 050e63d + ded432a commit 4714300

File tree

1 file changed

+124
-51
lines changed

1 file changed

+124
-51
lines changed

‎openid-federation-1_0.xml‎

Lines changed: 124 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -2016,9 +2016,14 @@
20162016
a policy error.
20172017
</t>
20182018
<t>
2019-
MUST declare what other operators it may be combined within a
2020-
metadata parameter policy. Combinations that are not allowed
2021-
MUST result in a policy error.
2019+
MUST declare what other operators it may be combined with,
2020+
which applies to both individual as well as merged metadata
2021+
parameter policies, as described in
2022+
<xref target="metadata_policy_structure"/> and
2023+
<xref target="metadata_policy_enforcement"/>. A combination may
2024+
be unconditional, or conditional, requiring the configured
2025+
values of the two operators to meet certain criteria.
2026+
Combinations that are not allowed MUST produce a policy error.
20222027
</t>
20232028
<t>
20242029
MUST declare in what order it is to be applied to a metadata
@@ -2085,7 +2090,37 @@
20852090
Combination with other operators in a metadata parameter policy:
20862091
<list style="symbols">
20872092
<t>
2088-
MAY be combined with <spanx style="verb">essential</spanx>.
2093+
MAY be combined with <spanx style="verb">add</spanx>,
2094+
in which case the values of <spanx style="verb">add</spanx>
2095+
MUST be a subset of the values of
2096+
<spanx style="verb">value</spanx>.
2097+
</t>
2098+
<t>
2099+
MAY be combined with <spanx style="verb">default</spanx>
2100+
if the value of <spanx style="verb">value</spanx> is not
2101+
null.
2102+
</t>
2103+
<t>
2104+
MAY be combined with <spanx style="verb">one_of</spanx>,
2105+
in which case the value of <spanx style="verb">value</spanx>
2106+
MUST be among the <spanx style="verb">one_of</spanx> values.
2107+
</t>
2108+
<t>
2109+
MAY be combined with <spanx style="verb">subset_of</spanx>,
2110+
in which case the values of <spanx style="verb">value</spanx>
2111+
MUST be a subset of the values of
2112+
<spanx style="verb">subset_of</spanx>.
2113+
</t>
2114+
<t>
2115+
MAY be combined with <spanx style="verb">superset_of</spanx>,
2116+
in which case the values of <spanx style="verb">value</spanx>
2117+
MUST be a superset of the values of
2118+
<spanx style="verb">superset_of</spanx>.
2119+
</t>
2120+
<t>
2121+
MAY be combined with <spanx style="verb">essential</spanx>,
2122+
except when <spanx style="verb">value</spanx> is null and
2123+
<spanx style="verb">essential</spanx> is true.
20892124
</t>
20902125
</list>
20912126
</t>
@@ -2094,7 +2129,7 @@
20942129
</t>
20952130
<t>
20962131
Operator value merge: Allowed only when the operator values are
2097-
equal. If not, this MUST result in a policy error.
2132+
equal. If not, this MUST produce a policy error.
20982133
</t>
20992134
</section>
21002135

@@ -2134,6 +2169,12 @@
21342169
<t>
21352170
Combination with other operators in a metadata parameter policy:
21362171
<list style="symbols">
2172+
<t>
2173+
MAY be combined with <spanx style="verb">value</spanx>,
2174+
in which case the values of <spanx style="verb">add</spanx>
2175+
MUST be a subset of the values of
2176+
<spanx style="verb">value</spanx>.
2177+
</t>
21372178
<t>
21382179
MAY be combined with <spanx style="verb">default</spanx>.
21392180
</t>
@@ -2144,10 +2185,7 @@
21442185
<spanx style="verb">subset_of</spanx>.
21452186
</t>
21462187
<t>
2147-
MAY be combined with <spanx style="verb">superset_of</spanx>,
2148-
in which case the values of <spanx style="verb">add</spanx>
2149-
MUST be a superset of the values of
2150-
<spanx style="verb">superset_of</spanx>.
2188+
MAY be combined with <spanx style="verb">superset_of</spanx>.
21512189
</t>
21522190
<t>
21532191
MAY be combined with <spanx style="verb">essential</spanx>.
@@ -2192,25 +2230,22 @@
21922230
<t>
21932231
Combination with other operators in a metadata parameter policy:
21942232
<list style="symbols">
2233+
<t>
2234+
MAY be combined with <spanx style="verb">value</spanx>
2235+
if the value of <spanx style="verb">value</spanx> is not
2236+
null.
2237+
</t>
21952238
<t>
21962239
MAY be combined with <spanx style="verb">add</spanx>.
21972240
</t>
21982241
<t>
2199-
MAY be combined with <spanx style="verb">one_of</spanx>, in
2200-
which case the <spanx style="verb">default</spanx> value
2201-
MUST be among the <spanx style="verb">one_of</spanx> values.
2242+
MAY be combined with <spanx style="verb">one_of</spanx>.
22022243
</t>
22032244
<t>
2204-
MAY be combined with <spanx style="verb">subset_of</spanx>,
2205-
in which case the <spanx style="verb">default</spanx> values
2206-
MUST be a subset of the <spanx style="verb">subset_of</spanx>
2207-
values.
2245+
MAY be combined with <spanx style="verb">subset_of</spanx>.
22082246
</t>
22092247
<t>
2210-
MAY be combined with <spanx style="verb">superset_of</spanx>,
2211-
in which case the <spanx style="verb">default</spanx> values
2212-
MUST be a superset of the
2213-
<spanx style="verb">superset_of</spanx> values.
2248+
MAY be combined with <spanx style="verb">superset_of</spanx>.
22142249
</t>
22152250
<t>
22162251
MAY be combined with <spanx style="verb">essential</spanx>.
@@ -2222,7 +2257,7 @@
22222257
</t>
22232258
<t>
22242259
Operator value merge: The operator values MUST be equal. If the
2225-
values are not equal this MUST result in a policy error.
2260+
values are not equal this MUST produce a policy error.
22262261
</t>
22272262
</section>
22282263

@@ -2260,9 +2295,12 @@
22602295
Combination with other operators in a metadata parameter policy:
22612296
<list style="symbols">
22622297
<t>
2263-
MAY be combined with <spanx style="verb">default</spanx>,
2264-
in which case the value of default MUST be among the
2265-
<spanx style="verb">one_of</spanx> values.
2298+
MAY be combined with <spanx style="verb">value</spanx>,
2299+
in which case the value of <spanx style="verb">value</spanx>
2300+
MUST be among the <spanx style="verb">one_of</spanx> values.
2301+
</t>
2302+
<t>
2303+
MAY be combined with <spanx style="verb">default</spanx>.
22662304
</t>
22672305
<t>
22682306
MAY be combined with <spanx style="verb">essential</spanx>.
@@ -2285,14 +2323,12 @@
22852323
Name: <spanx style="verb">subset_of</spanx>
22862324
</t>
22872325
<t>
2288-
Action: If the metadata parameter is present, this operator
2289-
computes the intersection between the values of the operator and
2290-
the metadata parameter. If the intersection is non-empty, the
2291-
metadata parameter is set to the values in the intersection. If
2292-
the intersection is empty, the metadata parameter MUST be
2293-
removed. Note that this behavior makes
2294-
<spanx style="verb">subset_of</spanx> a potential value modifier
2295-
in addition to it being a value check.
2326+
Action: If the metadata parameter is present, it is assigned the
2327+
intersection between the values of the operator and the
2328+
metadata parameter. Note that the resulting intersection may
2329+
thus be an empty array <spanx style="verb">[]</spanx>. Also note
2330+
that <spanx style="verb">subset_of</spanx> is a potential value
2331+
modifier in addition to it being a value check.
22962332
</t>
22972333
<t>
22982334
Metadata parameter JSON values:
@@ -2320,17 +2356,20 @@
23202356
Combination with other operators in a metadata parameter policy:
23212357
<list style="symbols">
23222358
<t>
2323-
MAY be combined with <spanx style="verb">add</spanx>, in
2324-
which case the values of <spanx style="verb">add</spanx>
2359+
MAY be combined with <spanx style="verb">value</spanx>,
2360+
in which case the values of <spanx style="verb">value</spanx>
23252361
MUST be a subset of the values of
23262362
<spanx style="verb">subset_of</spanx>.
23272363
</t>
23282364
<t>
2329-
MAY be combined with <spanx style="verb">default</spanx>, in
2330-
which case the values of <spanx style="verb">default</spanx>
2365+
MAY be combined with <spanx style="verb">add</spanx>, in
2366+
which case the values of <spanx style="verb">add</spanx>
23312367
MUST be a subset of the values of
23322368
<spanx style="verb">subset_of</spanx>.
23332369
</t>
2370+
<t>
2371+
MAY be combined with <spanx style="verb">default</spanx>.
2372+
</t>
23342373
<t>
23352374
MAY be combined with <spanx style="verb">superset_of</spanx>,
23362375
in which case the values of
@@ -2348,8 +2387,9 @@
23482387
<t>
23492388
Operator value merge: The result of merging the values of two
23502389
<spanx style="verb">subset_of</spanx> operators is the
2351-
intersection of the operator values. If the intersection is
2352-
empty, this MUST result in a policy error.
2390+
intersection of the operator values. Note that the resulting
2391+
intersection may thus be an empty array
2392+
<spanx style="verb">[]</spanx>.
23532393
</t>
23542394
</section>
23552395

@@ -2388,16 +2428,16 @@
23882428
Combination with other operators in a metadata parameter policy:
23892429
<list style="symbols">
23902430
<t>
2391-
MAY be combined with <spanx style="verb">add</spanx>, in
2392-
which case the values of <spanx style="verb">add</spanx>
2431+
MAY be combined with <spanx style="verb">value</spanx>,
2432+
in which case the values of <spanx style="verb">value</spanx>
23932433
MUST be a superset of the values of
23942434
<spanx style="verb">superset_of</spanx>.
23952435
</t>
23962436
<t>
2397-
MAY be combined with <spanx style="verb">default</spanx>, in
2398-
which case the values of <spanx style="verb">default</spanx>
2399-
MUST be a superset of the values of
2400-
<spanx style="verb">superset_of</spanx>.
2437+
MAY be combined with <spanx style="verb">add</spanx>.
2438+
</t>
2439+
<t>
2440+
MAY be combined with <spanx style="verb">default</spanx>.
24012441
</t>
24022442
<t>
24032443
MAY be combined with <spanx style="verb">subset_of</spanx>,
@@ -2452,6 +2492,11 @@
24522492
<t>
24532493
Combination with other operators in a metadata parameter policy:
24542494
<list style="symbols">
2495+
<t>
2496+
MAY be combined with <spanx style="verb">value</spanx>,
2497+
except when <spanx style="verb">value</spanx> is null and
2498+
<spanx style="verb">essential</spanx> is true.
2499+
</t>
24552500
<t>
24562501
MAY be combined with any other operator.
24572502
</t>
@@ -2602,8 +2647,8 @@
26022647
Statement claim, in which case the operator MUST be understood
26032648
and processed. If an additional operator listed in
26042649
<spanx style="verb">metadata_policy_crit</spanx> is not understood
2605-
or cannot be processed, then this MUST result in a policy error
2606-
and the Trust Chain MUST be considered invalid.
2650+
or cannot be processed, then this MUST produce a policy error and
2651+
the Trust Chain MUST be considered invalid.
26072652
</t>
26082653

26092654
</section>
@@ -2652,7 +2697,7 @@
26522697
</t>
26532698

26542699
<t>
2655-
An important procedure during the iteration is the
2700+
An important task during the iteration is the
26562701
<spanx style="verb">metadata_policy</spanx> validation. It MUST
26572702
ensure the data structure is compliant and that every metadata
26582703
parameter policy contains only allowed operator combinations, as
@@ -2662,7 +2707,7 @@
26622707
contains no operators that cannot be understood and processed
26632708
whose names are among the collected
26642709
<spanx style="verb">metadata_policy_crit</spanx> values. An
2665-
unsuccessful validation MUST result in a policy error.
2710+
unsuccessful validation MUST produce a policy error.
26662711
</t>
26672712

26682713
<t>
@@ -2682,7 +2727,7 @@
26822727
</t>
26832728

26842729
<t>
2685-
The merge is performed at all three levels of the
2730+
The merge is performed at each of the three levels of the
26862731
<spanx style="verb">metadata_policy</spanx> data structure
26872732
described in <xref target="metadata_policy_structure"/>, by
26882733
starting from the top level:
@@ -2739,7 +2784,7 @@
27392784
that are not allowed, as described in
27402785
<xref target="metadata_policy_operators"/> and in
27412786
accordance with the specifications of the operators, this
2742-
MUST result in a policy error.
2787+
MUST produce a policy error.
27432788
</t>
27442789
<t>
27452790
Subordinate metadata parameter policies that are not
@@ -2761,7 +2806,7 @@
27612806
<xref target="metadata_policy_operators"/> and in
27622807
accordance with the operator specification. If an operator
27632808
value merge is not allowed or otherwise unsuccessful this
2764-
MUST result in a policy error.
2809+
MUST produce a policy error.
27652810
</t>
27662811
<t>
27672812
Subordinate operators that are not present in the current
@@ -10045,6 +10090,34 @@ Host: op.umu.se
1004510090
<t>
1004610091
-42
1004710092
<list style="symbols">
10093+
<t>
10094+
Addresses #11, #180:
10095+
10096+
Allows the following unconditional operator combinations:
10097+
add + superset_of.
10098+
10099+
Makes the following previously conditional operator combinations unconditional:
10100+
default + one_of, default + subset_of, default + superset_of.
10101+
10102+
Makes the following previously unconditional operator combination conditional:
10103+
value + essential.
10104+
10105+
Allows the following conditional operator combinations:
10106+
value + add, value + default, value + one_of, value + subset_of, value + superset_of.
10107+
</t>
10108+
<t>
10109+
Addresses #182: When applying the subset_of operator on a metadata
10110+
parameter, if the resulting intersection is empty, then the metadata is
10111+
made empty. Previously it was removed, which may lead to policy override
10112+
for metadata parameters that a have default value, for instance
10113+
grant_types RP metadata or grant_types_supported OP metadata. The merge of
10114+
two subset_of operators is changed to allow empty intersection as well.
10115+
</t>
10116+
<t>
10117+
Addresses #129: Clarifies that the combination rules for a metadata
10118+
policy operator apply to both individual as well as merged metadata
10119+
parameter policies.
10120+
</t>
1004810121
<t>
1004910122
Fixed #184: Clarified that Request Objects can be passed by value or by reference.
1005010123
</t>

0 commit comments

Comments
 (0)