Re: [security-services] New Issue: AssertionID/ WSS Direct referencecompatability

[Ron Monzillo <Ronald.Monzillo@Sun.COM>]

Frederick,

I think WSS core should consolidate its "wrapping" mechanisms
such that one "wrapper" element with id, valuetype, and encodingtype
attributes could be used in lieu of BSTs, xml tokens without ids, or
for in-lining tokens in STRs. I think this should be done in the core,
and as you know, there has been some reluctance to do this in the past.

I don't think the STP needs this mechanism (as it can use a KID) in lieu
of a direct local reference, at least until the dust settles on the id 
thoughts
occuring in the W3C and that have so far produced the xml:id note.

I think this is a case where revisiting this issue in a couple of months,
will likely prevent SAML and the STP from defining short-lived accomodations
just as the path to a more permanent solution becomes evident and available.

Ron

Frederick.Hirsch@nokia.com wrote:

> One approach is to define a generic XML envelope structure in WSS TC. 
> An immediate opportunity would be to use this approach in the SAML 
> Token Profile in WSS.
>
> regards, Frederick
> Frederick Hirsch,  Nokia
>
> > -----Original Message-----
> > From: ext John Kemp [mailto:john.kemp@nokia.com]
> > Sent: Tuesday, July 13, 2004 5:02 PM
> > To: ext Greg Whitehead
> > Cc: 'SAML'
> > Subject: Re: [security-services] New Issue: AssertionID/ WSS
> > Direct reference compatability
> >
> > Couldn't such an envelope be defined within WSS itself, where
> > the wsu:Id attribute is defined?
> >
> > - JohnK
> > 
> > ext Greg Whitehead wrote:
> >
> > > Can we sidestep this issue by defining an envelope to use in
> > > combination with the STP?
> > >
> > > In other words:
> > >
> > > <wsse:Security>
> > >   <saml:AssertionEnvelope wsu:id="foo">
> > >     <saml:Asssertion ID="bar">...</saml:Assertion>
> > >   </saml:AssertionEnvelope>
> > > </wsse:Security>
> > >
> > > -Greg
> > >
> > >
> > > To unsubscribe from this mailing list (and be removed from
> > the roster
> > > of the OASIS TC), go to
> > >
> > http://www.oasis-open.org/apps/org/workgroup/security-services
> /members/leave_workgroup.php.
> > >
> > >
> > >
> >
> >
> > To unsubscribe from this mailing list (and be removed from
> > the roster of the OASIS TC), go to
> > http://www.oasis-open.org/apps/org/workgroup/security-services
> /members/leave_workgroup.php.
> >
> >
>