Overlapping OAM policy domains

Question

The OAM documentation addresses overlapping policies within a single policy domain, but I haven't been able to find anything about overlaps between different domains.
I have a policy domain for a host that protects everything under the root "/". However, I want the "access" virtual directory to be handled the same as the access directory on all of the other hosts, so I added the access resource to a domain that defines the policy for all of the access directories.
The result is an overlap-- the access directory for that host is protected in the specific "access" domain, and it's also protected under the domain that protects everything under the root for that host.
Is this a problem for OAM? Does OAM apply the most-specific policy domain for a resource, as hoped in this case? OAM allows me to explicitly order policies within a domain, but I don't see any way to order domains themselves.
Thanks,
Matthew

Answer 1

For policy domain mapping, the basic algorithm OAM follows is to use the host and path elements of the URI to 'map' into the 'most specifically relevant' policy domain.
As far as the path is concerned, OAM tries to match the path beginning with the most strict pattern and then working backwards to achieve a match.
For example, consider the following configuration:
Policy Domain A protects MY_HOST/access/bin
Policy Domain B protects MY_HOST/access
If a request for MY_HOST/access/bin/foo?param=1 comes in...
OAM looks for a policy domain protecting a resource MY_HOST/access/bin/foo and can't find one.
Next, OAM looks for a policy domain protecting a resource MY_HOST/access/bin and finds it and processing continues from there.
So, in the case you illustrate, /access is simply a 'more strict' pattern than / which will catch all requests that match that pattern.
As you noted, the evaluation of 'Policies (exceptions to the default rules)' is managed by explicit order.
It is also important to note, in this discussion, that OAM does not tolerate ambiguity on the HOST element of a protected resource. Configuring OAM to map the same hostname variation to more than one host identifier will produce unpredictable results. Validation in the admin application is in place to help avoid this.
Hope that helps.
Cheers,
Mark