Subject: policyRuleDebugMode needed?

From: "Chris Martin" <[email-masked]>
Date: Wed, 17 Feb 1999 19:42:30 -0500

Since we didn't have enough time to cover everything at the meeting, I'd
like to cover one of the (hopefully;) less controversial
questions/comments I had.  This comment concerns the attribute
policyRuleDebugMode (definition at end).

Does it really make sense to have this in the schema?  My first thought
was that 'no' for a few reasons.  I'm not against the <function> (or
"service", if you want to call it that) the attribute provides, but
question the need for putting the attribute in the schema.  I think, as
it is defined right now, it has limited utility.

First, I look at a "debug" or test function as a "volatile" type of
activity.  I just need to test one instance of a policy rule, perhaps.
Since the rule itself can take no actions, I can't have a rule action to
turn my test function off.  This would be viewed as a "one-shot" test
invocation.  I would potentially want to do this.  Second, I assume (in
general) the need here is to test something at the PDP level-- and
probably a specific PDP and not all PDPs in general.  Putting a test
reference in at a shared (among PDPs) rule violates this assumption.   I
would also argue that perhaps a "debug" at the policy rule level is
misplaced, and that test points may apply at the policy group or even at
the whole PDP level.  Finally, I think having an attribute that
describes a "did execute" as opposed to a "would execute" scenario (aka,
audit?) would be more useful.

Nothing prohibits implementations from addressing the debug/test
operations outside of the schema through other, potentially more optimal
mechanisms.

Proposal 1:
Remove the section 5.4.12

Alternate proposal:
Add the sentence at the end of the (5.4.12) paragraph: "Further
interpretation of the policyRuleDebugMode is beyond the scope of this
document."

chm

5.4.12  The Attribute policyRuleDebugMode

This attribute indicates that the policyRule should be evaluated, but no

actions taken.  It serves as a debug vehicle when attempting
to determine what policies would execute in a particular scenario, but
not to take any actions to change state due to that
scenario. Further interpretation of the policyRuleDebugMode is beyond
the scope of this document.

The attribute definition is as follows:

  NAME           policyRuleDebugMode
  DESCRIPTION    A flag indicating that the evaluation of the
                 policyRule's policyConditions should occur, but the set

                 of actions specified for the rule should not be
                 executed.
  SYNTAX         Boolean
  OID            <to be assigned>
  EQUALITY       booleanMatch
  SINGLE-VALUED
  DEFAULT VALUE  FALSE

---

From: Silvano Gai <[email-masked]>
Date: Wed, 17 Feb 1999 17:26:02 -0800

>it is defined right now, it has limited utility.

I agree, it is an important function, but it has nothing to do with the schema.

-- Silvano

Silvano Gai               
Cisco Systems                  Empowering the Internet Generation
170 West Tasman Drive                         Tel. (408) 527 2690
San Jose, CA, 95134-1706                      Fax. (408) 526 2690
                                                   [email-masked]