RE: [security-services] New Issue: AssertionID/ WSS Direct reference compatability

["Scott Cantor" <scantor@internet2.edu>]

A couple of XML questions, probably for Eve...

> SAML 2.0 should also anticipate future XML standardization of an identity`
> attribute (e.g. xml:id)  as a replacement for wsu:id.

Is this likely? All I've seen in the past is a lot of handringing about
things being broken, but I never heard any real plans for any specific
solution.

A related question is whether it's illegal to have two ID-typed attributes
*declared* in the schema for an element, or only illegal to actually include
two in an instance. That would greatly affect the set of possible solutions.

Finally, I might ask why it matters at all to WSS that wsu:Id is even an
ID-type? From what I can tell from your note, the goal here is to basically
bypass standard ID attribute processing, since the DOM calls and so forth
don't care what the name of the attribute is, they just care that it's an
ID. If you're taking the effort to actually look up the attribute value by
name, you don't really care whether it's an ID or not, do you?

So it might be argued that wsu:Id is the culprit. Why isn't it a string?

Not trying to be difficult, but I think invading foreign schemas to this
degree is a pretty untenable direction long term.

What does XrML do?

-- Scott