OGC 13-099
xacml:PolicySetIdReference... xacml:PolicyIdReference...
xacml:Rule... The base type paws:BaseRequestType is defined in section 7.2.
19.2.1.1 PolicyStoreId parameter mandatory
The value of the PolicyStoreId parameter shall be a valid URN cp. 6.5 and specifies the policy store in which a policy element shall be updated.
19.2.1.2 PolicyContainerId parameter mandatory
The value of the PolicyContainerId parameter shall be a valid URN cp. 6.5 and defines the name of the policy container in which a policy element shall be updated.
19.2.1.3 Query parameter mandatory
The value of the Query parameter shall be a valid XPath 2.0 expression cp. 7.3 and defines one or multiple nodes that shall be updated by the XACML policy element node
defined in the XacmlPolicyElement parameter cp. 19.2.1.4.
The paws:Query element shall never be missing or empty in an UpdatePolicyElement request and must point to one or multiple element nodes of type xacml:PolicySet,
xacml:Policy, xacml:Rule, xacml:PolicySetIdReference or xacml:PolicyIdReference.
19.2.1.4 XacmlPolicyElement parameter mandatory
The XacmlPolicyElement parameter defines the updated version of an existing XACML policy element or at least a part of it. As mentioned above the new update element shall
only be of type: xacml:PolicySet, xacml:Policy, xacml:Rule, xacml:PolicySetIdReference and xacml:PolicyIdReference. The details on the update style are defined by the
UpdateStyle parameter cp. 19.2.1.5.
Identifiers of XACML policy elements within the same policy container shall be unique. Note: It needs to be highlighted that through a PAWS UpdatePolicyElement operation
one can add PolicySet and Policy elements that already have children of type PolicySet, Policy, PolicySetIdReference, PolicyIdReference or Rule. It is
however highly recommended to deny through an administrative access control rule that PolicySet and Policy elements can be inserted via the update that have children of
type PolicySet, Policy or Rule. Such an administrative rule will imply that XACML policy trees have to be build step-by-step – i.e. successive – through separate Insert- or
UpdatePolicyElement requests. A strict enforcement of such a successive policy generation is an essential property to be able to support the simple definition of rich
administrative rights.
OGC 13-099
19.2.1.5 UpdateStyle parameter mandatory
