Defines the source for the standard environment attributes specified in §10.2.5: current-time, current-date and current-dateTime. The options are:

REQUEST_ELSE_PDP

The default choice, that complies with the XACML standard (§10.2.5): If values for these attributes are not present in the decision request, then their values MUST be supplied by the context handler. In our case, context handler means the PDP. In other words, the attribute values come from request by default, or from the PDP if (and *only if* in this case) they are not set in the request. More precisely, if any of these standard environment attributes is provided in the request, none of the PDP values is used, even if some policy requires one that is missing from the request. Indeed, this is to avoid such case when the decision request specifies at least one date/time attribute, e.g. current-time, but not all of them, e.g. not current-dateTime, and the policy requires both the one(s) provided and the one(s) not provided. In this case, if the PDP provides its own value(s) for the missing attributes (e.g. current-dateTime), this may cause some inconsistencies since we end up having date/time attributes coming from two different sources/environments (current-time and current-dateTime for instance). In short, since this option introduces some ambiguities with regards to the XACMl specification, we strongly recommend to use the other options below.

REQUEST_ONLY

Always use the value from the request, or nothing if the value is not set in the request, in which case this results in Indeterminate (missing attribute) if the policy evaluation requires it.

PDP_ONLY

Always use the values from the PDP. In other words, Request values are simply ignored; PDP values systematically override the ones from the request. This also guarantees that they are always set (by the PDP). NB: note that the XACML standard (§10.2.5) says: "If values for these attributes are not present in the decision request, then their values MUST be supplied by the context handler" but it does NOT say "If AND ONLY IF values..." So this option could still be considered XACML compliant in a strict sense.