CONTENTS

1 Scope 
2 References
3 Definitions
        3.1 Imported definitions        
        3.2 Additional definitions     
4 Abbreviations  
5 Conventions    
6 Overview  
7 XACML core  
        7.1 Background         
        7.2     XACML models  
        7.3 XACML context 
        7.4 Policy syntax        
        7.5 Context syntax     
        7.6     XACML functional requirements
        7.7 XACML extensibility points       
        7.8     Conformance       
 8     Core and hierarchical role based access control (RBAC) profile          
        8.1     RBAC background          
        8.2 RBAC example    
        8.3     Assigning and enabling role attributes     
        8.4     Implementing the RBAC model  
        8.5     Profile   
        8.6 Identifiers
 9     Multiple resource profile of XACML    
        9.1     Requests for multiple resources   
        9.2 Requests for an entire hierarchy  
        9.3 New attribute identifiers  
        9.4     New profile identifiers     
10     SAML 2.0 profile of XACML 
       10.1     Mapping SAML and XACML attributes           
       10.2     Authorization decisions  
       10.3     Policies 
       10.4     Element <saml:Assertion>          
       10.5 Element <samlp:RequestAbstractType>
       10.6     Element <samlp:Response>        
11     XML digital signature profile   
       11.1     Use of SAML     
       11.2     Canonicalization 
       11.3     Signing schemas  
12     Hierarchical resource profile of XACML         
       12.1 Representing the identity of a node       
       12.2     Requesting access to a node       
       12.3     Stating policies that apply to nodes        
       12.4 New DataType: xpath-expression           
       12.5 New attribute identifiers 
       12.6 New profile identifiers    
13     Privacy policy profile    
       13.1     Standard attributes         
       13.2     Standard rules: Matching purpose          
Annex A – Data-types and functions     
        A.1 Introduction        
        A.2 Data-types           
       A.3      Functions
Annex B – XACML identifiers     
        B.1 XACML namespaces      
        B.2 Access subject categories
        B.3 Data-types           
        B.4 Subject attributes
        B.5 Resource attributes          
        B.6 Action attributes 
        B.7 Environment attributes    
        B.8 Status codes        
        B.9 Combining algorithms     
Annex C – Combining algorithms     
        C.1 Deny-overrides    
        C.2 Ordered-deny-overrides  
        C.3 Permit-overrides  
        C.4 Ordered-permit-overrides           
        C.5 First-applicable    
        C.6 Only-one-applicable        
Annex D – XACML schema     
        D.1 XACML context schema
        D.2 Policy schema     
        D.3 XACML SAML protocol schema          
        D.4     XACML SAML assertion schema         
Appendix I – Security considerations     
        I.1 Threat model        
        I.2 Safeguards
Appendix II – XACML examples     
       II.1 Example one        
       II.2 Example two        
Appendix III – Example description of higher order bag functions     
      III.1     Example of higher-order bag functions   
BIBLIOGRAPHY