title: match evaluation of multiple multi-valued attributes
body: <p>The XACML 3.0 specs state that for <code>&lt;Match&gt;</code> evaluation "the MatchId
  function SHALL be applied between the <code>&lt;AttributeValue&gt;</code> and each
  element of the bag returned from the <code>&lt;AttributeDesignator&gt;</code> or
  <code>&lt;AttributeSelector&gt;</code> element." <a href="http://docs.oasis-open.org/xacml/3.0/errata01/os/xacml-3.0-core-spec-errata01-os-complete.html#_Toc489959586" rel="nofollow noreferrer">7.6 Match evaluation</a></p>
  
  <p>In the case that, for example, the attribute access-subject / 
  subject-id returns a bag with more than one value, one should iterate
  over these members until the matching function returns true. This is
  clear and obvious.  Now in case the <code>&lt;AllOf&gt;</code> element has two <code>&lt;Match&gt;</code>es as
  in conformance test <code>IIA007Policy.xml</code> (see below). It has a <code>Match</code> on
  access-subject / subject-id being equal to "Julius Hibbert" and
  access-subject / some-attribute being equal to "riddle me this".</p>
  
  <p>Now assume that in a request, there are two attributes having  multiple members, how should the match be evaluated now?  Attribute1 has bag [1, 2, 3] and attribute2 has bag [a, b]. One can
  start processing the members from the first attribute until a true is
  returned and than continue with processing the next attribute etc, but
  that would not cover all possible outcomes. Or, should the matching
  functions be simultaneously applied to all combinations of the members
  from the two bags <code>[{1,a},{1,b},{2,a},{2,b},{3,a},{3,b}]</code>? With large bags and/or many attributes, this will lead to a large set of combinations to process!</p>
  
  <p>The specs, as far as I know, give no clue how the situation is handled
  in case two or more attributes return bags with multiple members
  within the same <code>&lt;AllOf&gt;</code> element. My questions are:</p>
  
  <ul>
  <li>did I miss something in the specs,</li>
  <li>is my interpretation correct?</li>
  <li>how is this handled in real implementations?</li>
  </ul>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="no"?&gt;
  &lt;Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IIA007:policy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:rule-combining-algorithm:deny-overrides" Version="1.0" xsi:schemaLocation="urn:oasis:names:tc:xacml:3.0:policy:schema:os         access_control-xacml-2.0-policy-schema-os.xsd"&gt;
      &lt;Description&gt;
          Policy for Conformance Test IIA007.
      &lt;/Description&gt;
      &lt;Target/&gt;
      &lt;Rule Effect="Permit" RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IIA007:rule"&gt;
          &lt;Description&gt;
              Julius Hibbert can read or write Bart Simpson's medical record.
          &lt;/Description&gt;
          &lt;Target&gt;
              &lt;AnyOf&gt;
                  &lt;AllOf&gt;
                      &lt;Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"&gt;
                          &lt;AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"&gt;Julius Hibbert&lt;/AttributeValue&gt;
                          &lt;AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/&gt;
                      &lt;/Match&gt;
                      &lt;Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"&gt;
                          &lt;AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"&gt;riddle me this&lt;/AttributeValue&gt;
                          &lt;AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:some-attribute" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/&gt;
                      &lt;/Match&gt;
                  &lt;/AllOf&gt;
              &lt;/AnyOf&gt;
              &lt;AnyOf&gt;
                  &lt;AllOf&gt;
                      &lt;Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal"&gt;
                          &lt;AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI"&gt;http://medico.com/record/patient/BartSimpson&lt;/AttributeValue&gt;
                          &lt;AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="true"/&gt;
                      &lt;/Match&gt;
                  &lt;/AllOf&gt;
              &lt;/AnyOf&gt;
              &lt;AnyOf&gt;
                  &lt;AllOf&gt;
                      &lt;Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"&gt;
                          &lt;AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"&gt;read&lt;/AttributeValue&gt;
                          &lt;AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/&gt;
                      &lt;/Match&gt;
                  &lt;/AllOf&gt;
                  &lt;AllOf&gt;
                      &lt;Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"&gt;
                          &lt;AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"&gt;write&lt;/AttributeValue&gt;
                          &lt;AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/&gt;
                      &lt;/Match&gt;
                  &lt;/AllOf&gt;
              &lt;/AnyOf&gt;
          &lt;/Target&gt;
      &lt;/Rule&gt;
  &lt;/Policy&gt;
  </code></pre>