<?xml version="1.0"?>
<!--<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" "docbookx.dtd">-->

<book xmlns:ci="http://apache.org/cocoon/include/1.0">

	<bookinfo>
		<graphic fileref="logo.jpg"/>
		<productname>Open Source Native XML Database</productname>
		<title>Access Control in eXist: XACML Developer's Guide</title>
		<author>
			<firstname>Mark</firstname>
			<surname>Harrah</surname>
			<affiliation>
				<address format="linespecific">
					<email>harrah@umd.edu</email>
				</address>
			</affiliation>
		</author>
	</bookinfo>

	<ci:include src="sidebar.xml"/>

	<chapter>
		<title>Access Control in eXist: XACML Developer's Guide</title>
		<para>
			This guide provides information to developers interested in adding access
			control to eXist or potentially users writing applications that use eXist's
			internal XACML-related classes (note that this is not supported, though).
		</para>
		<section>
			<title>Selecting XACML for Access Control</title>
			<para>
				XACML is a powerful standard for controlling access to resources, but as
				with any technology it has advantages and disadvantages.  One potential
				disadvantage is the learning curve required by administrators to write
				policies.  This may be somewhat mitigated by a graphical policy editor,
				such as the one in eXist's graphical client.  However, this takes more
				work on the part of the developer (although, hopefully not too much: see
				the section (PENDING) on adding graphical editing for new access control
				points).  Additionally, the administrator still needs to know some general
				information about the concepts behind XACML.  This is certainly more work
				than applying previous knowledge about and experience with Unix-based
				permissions or role-based access control.
			</para>
			<para>
				The second potential disadvantage is performance.  Currently, the support that
				eXist provides to the Policy Decision Point (PDP) does not include indexing
				policies.  This means that when the PDP receives an access request, it must
				ask each policy if it applies to the request until a policy applies.  This
				simple method is quite sufficient for the current use of XACML in eXist; however,
				more advanced methods such as indexing and perhaps intelligent caching of results
				might be needed for uses that involve a substantial number of access requests
				in a short time or uses that will likely encourage the use of many policies
				or large policies.
			</para>
			<para>
				Given these two disadvantages, XACML is still a good choice for access control
				in many situations.  It is highly flexible, it is a well designed standard, and
				the disadvantages can be compensated for.
			</para>
			<para>
				TODO: Finish section
			</para>
		</section>
		<section>
			<title>Adding a Policy Enforcement Point (PEP)</title>
			<para>
				TODO: Write section
			</para>
		</section>
		<section>
			<title>Generating a Request</title>
			<para>
				TODO: Write section
			</para>
		</section>
		<section>
			<title>Interpreting a Response</title>
			<para>
				TODO: Write section
			</para>
		</section>
	</chapter>
</book>