RE: [security-services-comment] Public review comments -saml-session-token-v1.0-csprd01

[Hal Lockhart <hal.lockhart@oracle.com>]

The disposition of these comments is noted below.

> -----Original Message-----
> From: Paul Knight [mailto:paul.the.knight@gmail.com]
> Sent: Friday, April 01, 2011 7:42 PM
> To: security-services-comment@lists.oasis-open.org
> Subject: [security-services-comment] Public review comments -
> saml-session-token-v1.0-csprd01
> 
> 
> Hi,
> 
> Most of this is minor editorial comments, with some comments 
> on the content.
> 
> line 12 - two right brackets on reference [RFC2965]].

corrected

> Section 1.2 - Five references using "et al." - each one is wrong -
> format is "J. Doe et al., Title of Work"

corrected

> line 23 - citing a working draft as a normative reference can delay
> progress to OASIS Standard

it has been clarified that the newly defined schema should not be listed as a normative reference - removed

> line 51 - need proper citation format for OASIS Standard

corrected in all six OASIS references

> line 86 - Figure 3 - since the flow depicted by the arrow DOES NOT
> happen, it might make sense to indicate this by a big "X" or something
> similar.

The flow DOES happen. The wording of the text was confusing. It has been improved.

> line 149 - missing period at end.

corrected

> Section 3 - might benefit from something like a ladder diagram to
> provide more detail on the sequence of messages flowing among SA,
> browser, and SC. This could be referenced in later sections.

The logical flow is always from SA to SC. It does not seem like a ladder diagram would make this clearer.

> line 283 - references in brackets should come before the period.

corrected

> Line 449 - remove word "use"

corrected

> line 450 - insert "the" before "past"

reworded

> 451 - lower case "R" in Running; it would be helpful to have a
> reference. Also, you might mean "published" instead of "publicized"?

corrected - non-normative reference added

> 455 - remove second "yet"

corrected

> 458 - Phrase ending in [RFC2965] is not a complete sentence.

reworded

> 460-464 - weak discussion - maybe re-write in terms of
> "man-in-the-middle attack"

paragraph reworded

> 465 - sever --> server

corrected

> 
> Useful spec!

Thank you,

Hal

> 
> Regards,
> Paul
> 
> -- 
> This publicly archived list offers a means to provide input to the
> OASIS Security Services (SAML) TC.
> 
> In order to verify user consent to the Feedback License terms and
> to minimize spam in the list archive, subscription is required
> before posting.
> 
> Subscribe: security-services-comment-subscribe@lists.oasis-open.org
> Unsubscribe: 
> security-services-comment-unsubscribe@lists.oasis-open.org
> List help: security-services-comment-help@lists.oasis-open.org
> List archive: 
> http://lists.oasis-open.org/archives/security-services-comment/
> Feedback License: 
> http://www.oasis-open.org/who/ipr/feedback_license.pdf
> List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
> Committee: 
> http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security
> 
>

--
This publicly archived list offers a means to provide input to the
OASIS Security Services (SAML) TC.

In order to verify user consent to the Feedback License terms and
to minimize spam in the list archive, subscription is required
before posting.

Subscribe: security-services-comment-subscribe@lists.oasis-open.org
Unsubscribe: security-services-comment-unsubscribe@lists.oasis-open.org
List help: security-services-comment-help@lists.oasis-open.org
List archive: http://lists.oasis-open.org/archives/security-services-comment/
Feedback License: http://www.oasis-open.org/who/ipr/feedback_license.pdf
List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
Committee: http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security