RE: [security-services] Proposed Charter Update

[Scott Cantor <cantor.2@osu.edu>]

> I Did not see anything that isn't consistent, but I just have not seen
> anything posted on the composability of SAML with other proposals, other
> specifications such as transactions, reliable messaging, etc. If there has
> been work I would like to review maybe this has been in the past and I
just
> don't have the long history with the TC.

There was a brief mention at one point about some kind of exploration of how
certain aspects of SAML would fit into CORBA's security model a while back.
I'm not a CORBA afficionado, so I don't know specifics.

AFAIK, there are no other standard specs for anything resembling
transactions or reliable messaging. Maybe J2EE, but I was under the
impression it was fairly CORBA-derived in those areas.

Personally, I think distibuted transactions are an idea whose time has come
and mercifully gone, but I'll let those with the energy to keep struggling
with buggy products continue to do so. ;-)

I don't think that identity federation per se has much impact on whether
SAML does or doesn't fit with those technologies. Done with minimalism in
mind, the SAML data, domain, and processing models don't know anything in
particular about federation, nor does SSO. Identity federation is simply one
way of looking at identity, no differently than X.500 is another.

-- Scott