RE: [security-services] Liberty IPR Issues (was: Liberty ID-FF 1. 2 submissionto the SSTC)

["Conor P. Cahill" <concahill@aol.com>]

Michael McIntosh wrote on 11/25/2003, 2:42 PM:

> Have the OASIS Members that have submitted
> these specifications asked for or received any statements from the
> other
> Liberty members regarding their intentions regarding licensing terms
> for
> their IP? Is it expected (or stated anywhere) that the same terms
> granted
> for Liberty implementations will apply to SAML implementations?
While this looks
like a good question, I think that this proactive approach is not
required by OASIS IPR rules.  In addition, and perhaps even more
importantly,  if someone were to ask me such a question, I would have
to respond with "Show me the derivation and I'll tell you", especially
if I was not participatingg in the SSTC.

This is, in part, because I can't even tell you if the derivation will
still covered by any IP that I may have and in part that I don't know
if the derivation will include new IP that the current implementation
does not include.

I think our options in this area are to:

a) ensure that the 2.0 work remains compliant with the ID-FF submission
so that it is covered under the existing IPR disclosures.  Note that
this is much easier than if we were to try to work-around any IPR.

b) once the 2.0 work is done, ask the Liberty folks to "adopt iit" as
part of their next release (which, I can tell you unofficially, is
their intent -- the SSTC is the primary location for further ID-FF
work).

c) Ignore the IPR issues and just include a statement about the IPR
with the 2.0 specs.

There are, of course, other steps that could be taken, these are just
the big options that I see.

Conor