In the past few days, I have been diving into GeoXACML and have read several articles. What has made me quite confusing is that those GeoXACML papers write that GeoXACML(PEP) intercepts both the access request and the response from service. However, the XACML does not say anything about intercepting response. From what I perceived from the XACML specification, PEP only intercepts user's access request and enforces PDP's decision with possible obligations.
Here is the sentences from OGC GeoXACML Implementation specification 6.2:
"The Policy Enforcement Point (PEP) can be characterized as a binary switch that either forwards the intercepted request from the client to the service (and the response from the service to the client respectively) or replies with an adequate error message."
And this is from XACML specification 3.1:
3 The PEP sends the request for access to the context handler in its native request format, optionally including attributes of the subjects, resource, action and environment.
...
12 The context handler translates the response context to the native response format of the PEP . The context handler returns the response to the PEP.
13 The PEP fulfills the obligations.
14 (Not shown) If access is permitted, then the PEP permits access to the resource; otherwise, it denies access .
Do I miss some of the texts or just misunderstand them? Any response would be appreciated.
