What excatly is the purpose of `ATTRIBUTES`? Should it be removed?

[mjacoby]

In the spec, I can find the following definition / info

List of ABAC attributes that the access control list depends on. The list contains definitions for individual attributes or pre-defined attribute groups introduced with DEFATTRIBUTES. Attributes are described in Attributes. Source

describes an ABAC attribute which is to be used in an ACL Source

These definitions are quite vague and it is not clear what attributes actually are, how they are intended to be used.

Based on the CLAIM attribute I assumed, that each claim that will later be used in the FORMULA section must be define/listed in the ATTRIBUTE section. Although not formally defined anywhere in the specification, this is what all examples do.
However, this is not the case for any usage of GLOBAL or REFERENCE attributes such as GLOBAL(UTCNOW) in the examples. Those are used directly in the FORMULA without ever being listed in the ATTRIBUTES section.

This seems inconsistent and I cannot see anything in the specification explaining how this is intended to work and what putting something in ATTRIBUTES actually means.

In fact, I would argue that the whole concept of having an ATTRIBUTES section seems redundant and can/should be removed completely as the FORMULA section already contains all that information.

• I have signed the required Developer Certificate of Origin (DCO) already.

[Martin187187]

I agree that the current specification is unclear here, but I don't think ATTRIBUTES should be removed.

ATTRIBUTES and FORMULA have different purposes:

• ATTRIBUTES defines prerequisites for the ACL to be applicable. For example, CLAIM("email") means that this claim must be present. GLOBAL(ANONYMOUS) allows the rule to be applicable without requiring an authenticated subject.
• FORMULA evaluates the actual condition and resolves values such as CLAIM(...), GLOBAL(...) or REFERENCE(...) when they are used.

Therefore, ATTRIBUTES should not be understood as a declaration list for everything that may be used in FORMULA.

The time-related globals should also be distinguished from GLOBAL(ANONYMOUS):

• GLOBAL(UTCNOW) is provided by the server in UTC.
• GLOBAL(LOCALNOW) is provided by the server in local time.
• GLOBAL(CLIENTNOW) is provided by the client and is only available if it is contained in the authenticated client's verified token/claims.

These time values are inputs for formula evaluation; they do not themselves identify a subject or make a rule applicable. In particular, using GLOBAL(CLIENTNOW) does not mean that the client must already be authorized — it may itself be used as input to the authorization decision — but the client must be authenticated so that the value can be trusted.

This also explains why GLOBAL(UTCNOW), GLOBAL(CLIENTNOW) or REFERENCE(...) can be used directly in FORMULA without being listed in ATTRIBUTES.

I think the specification should make this distinction explicit and clarify that ATTRIBUTES defines rule applicability requirements, while FORMULA defines the actual authorization condition.

[mjacoby]

I think i at least partially get your point but I am not sure I agree.

As far as I understand, for basically all values besides GLOBAL(ANONYMOUS) there seems to be no benefit of explicitly listing them in the ATTRIBUTES section as, if relevant, they are used in the FORMULA part and their usage can therefore implicitly derived just based on their appearance there.

When writing conditions like this in a programming language if x > 1 and y < 5 then ... , nobody would expect to put a line like this before it USES x, y. This is what ATTRIBUTES (besides GLOBAL(ANONYMOUS) ) feel like for me - redundant and just making things more complicated and verbose.

GLOBAL(ANONYMOUS) is however a special case. To me, it feels like this should not be hidden in ATTRIBUTES but instead there probably should be a separate root-level property called ALLOW_ANONYMOUS with a boolean value defaulting to false.