RE: SSL Mutual Authentication and the Message Service Spec

[David Fischer <david@drummondgroup.com>]

	"Perhaps we should lobby the MSG TC to remove the
	requirement to support basic authentication in the 1.1 spec."

Agreed.

David Fischer
Drummond Group.

-----Original Message-----
From: Arvola Chan [mailto:arvola@tibco.com]
Sent: Thursday, August 23, 2001 11:41 AM
To: ebxml-cppa@lists.oasis-open.org
Cc: ebxml-msg@lists.oasis-open.org
Subject: Re: SSL Mutual Authentication and the Message Service Spec


I took a look at the Communication Protocol Bindings section (Appendix B) in
the Message Service Spec. Lines 2843 to 2845  state:

"Both [RFC2246] and [SSL3] require the use of server side digital
certificates. In addition client side certificate based authentication is
also permitted. ebXML Message Service handlers MUST support  hierarchical
and peer-to-peer trust models."

Therefore, I think the CPP/A 1.1 spec needs to be fixed to support mutual
authentication.

In addition, lines 2823 to 2828 in the Message Service spec state:

"Implementers MAY protect their ebXML Message Service Handlers from
unauthorized access through the use of an access control mechanism. The HTTP
access authentication process described in "HTTP Authentication: Basic and
Digest Access Authentication" [RFC2617] defines the access control
mechanisms allowed to protect an ebXM L Message Service Handler from
unauthorized access. Implementers MAY support all of the access control
schemes defined in [RFC2617] however they MUST support the Basic
Authentication mechanism, as described in section 2, when Access Control is
used."

More changes to the CPP/A spec will be necessary to support Basic
Authentication. However, I seriously doubt if basic authentication which
sends user name and password in cleartext is suitable for conducting E
business transactions. Perhaps we should lobby the MSG TC to remove the
requirement to support basic authentication in the 1.1 spec.

-Arvola


----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>