Q:

Standard(s) for XACML resource-id format or structure?

Is there a standard or an approved profile for the format / structure of resource identifiers (urn:oasis:names:tc:xacml:1.0:resource:resource-id) that is actively in use by IdAM product vendors? I have been developing prototype code against products such as Oracle Entitlements Server (OES), ForgeRock OpenAM and WSO2 Identity Server (WSO2IS) for about a year, and resource identifiers appear to be vendor-specific in nature. For example, based on my experience:
In OES the resource identifiers take the form of /application name/resource type/resource elements separated by slashes
In OpenAM the resource identifiers appear to take the form of /realm/application name/resource elements separated by slashes
In WSO2IS there does not appear to be a specific format enforced, at least not through the management GUI
In Axiomatics Policy Server, users can choose the format they like.
I've reviewed the Hierarchical Resource Profile, but I am not seeing (or have missed) where the above vendors specifically support this profile. (I'm also not 100% certain of its applicability to the specific question I am asking, which is why I am mentioning it.)
One of the specific areas of concern is the modelling of resources to be protected by an application acting in the role of a PEP, since there does seem to be a certain amount of vendor- / implementation-specific information that is part of modelling the resource identifiers. Within our customer there is a strong desire to remain vendor / provider neutral, which is one of the main reasons they are interested in a standards-based (XACML) implementation.
Any guidance or references on this subject would be greatly appreciated.

A:

In XACML you are free to choose your structure. There is no predefined structure. Both OES and WSO2 shoehorn you into a structure to make it easier on their management tool which as you point out locks you into these vendors.
There is - a you point out - a profile called the hierarchical resource profile which defines how you can create your own resource ids. I checked the oasis committee technical list and as far as I can see only SunXACML and Axiomatics implement it.
If you look at pure play XACML 3.0 implementations e.g. Axiomatics Policy Server you'll see that you can define your own attributes, your own taxonomy and policy structure. You're not bound to a vendor's view of the world.

