RE: [ws-rx] Proposed resolution for i007 WSS 1.0/1.1 token support

[Christopher B Ferris <chrisfer@us.ibm.com>]

All,

The specification at line 502 currently reads as follows:

/wsrm:CreateSequence/wsse:SecurityTokenReference
This optional element uses the extensibility mechanism defined next to 
communicate an explicit reference to the security token to be used to 
authorize messages for the created outbound Sequence and if offered the 
inbound Sequence, using a  as documented in WS-Security [WSSecurity]. All 
subsequent messages in the outbound Sequence and if offered the inbound 
Sequence MUST demonstrate proof-of-possession of the referenced key. 
Nowhere in that text is there any specification of a token format. An STR 
can refer to *any* WSS token format, 1.0 or 1.1 and even those that are 
not yet or not formally (by the WSS TC) specified. That said, I would note 
that the WSS1.1 spec retained the 1.0 namespace URI for elements that were 
not changed from the 1.0 standard. Only new elements and changed elements 
were assigned the 1.1 namespace. Hence, this issue is moot since the 
element referenced above is unchanged in the WSS1.1 spec. There is no need 
IMO to make any reference(s) other than that which already exists in the 
current draft.
Cheers,

Christopher Ferris
STSM, Emerging e-business Industry Architecture
email: chrisfer@us.ibm.com
blog: http://webpages.charter.net/chrisfer/blog.html
phone: +1 508 377 9295

"Gilbert Pilz" <Gilbert.Pilz@bea.com> wrote on 08/15/2005 12:06:09 AM:

> Agreed. The charter states:
> 
> -------
> While composition with other specifications is a goal of the TC, it is
> also a goal to leave the specifics of how that composition is achieved
> outside the scope of the RM specifications.
> -------
> 
> I think that describing the details of the token formats is getting
> pretty specific about the composition of WS-RM with WSS.
> 
> - g 
> 
> > -----Original Message-----
> > From: Anish Karmarkar [mailto:Anish.Karmarkar@oracle.com] 
> > Sent: Thursday, August 11, 2005 1:45 PM
> > To: Marc Goodner
> > Cc: ws-rx@lists.oasis-open.org
> > Subject: Re: [ws-rx] Proposed resolution for i007 WSS 1.0/1.1 
> > token support
> > 
> > Marc Goodner wrote:
> > > I believe we do not want to exclude WSS 1.1 tokens from being used 
> > > with the specification. I have examined the spec for what 
> > references 
> > > are needed and whether or not we need any other changes such as new 
> > > elements. We do not need to add anything in addition to the 
> > existing 
> > > /wsrm:CreateSequence/wsse:SecurityTokenReference as the new 
> > 1.1 token 
> > > all are referenceable from wsse:SecurityTokenReference. In addition 
> > > there is an extensibility point defined in wsrm:CreateSequence that 
> > > should accommodate other token types.
> > > 
> > 
> > I'm beginning to wonder as to why have this element in the 
> > spec at all, since there is an extensibility point anyway. In 
> > terms of composibility of specs, it makes sense to stay 
> > silent on any security tokens and let extensibility be used 
> > for all kinds of composition (not just security).
> > 
> > -Anish
> > --
> > 
> > > 
> > > 
> > > To make it explicit that WSS 1.1 is supported I propose the 
> > following 
> > > changes to the specifications to allow referencing of WSS 1.1. The 
> > > namespaces and references will need to be updated with the 
> > final dates 
> > > after public review closes.
> > > 
> > > 
> > > 
> > > WS-ReliableMessaging
> > > 
> > > Add prefix and namespace for WSS 1.1 to table at line 142:
> > > 
> > > wsse11
> > > 
> > http://docs.oasis-open.org/wss/2005/xx/oasis-2005xx-wss-wssecurity-sec
> > > ext-1.1.xsd
> > > 
> > > 
> > > 
> > > 
> > > Add reference to WSS 1.1 after [WSSecurity] (lines 844-847):
> > > 
> > > [WSSecurity11]
> > > 
> > > Web Services Security: SOAP Message Security 1.1 (WS-Security 2005)
> > > 
> > > 
> > http://www.oasis-open.org/committees/download.php/13396/wss-v1.1-spec-
> > > pr-SOAPMessageSecurity-01.htm
> > > 
> > > 
> > > Anthony Nadalin, Chris Kaler, Ronald Monzillo, Phillip 
> > Hallam-Baker, 
> > > eds, OASIS Standard xxxxxx, final date
> > > 
> > > 
> > > 
> > > WS-ReliableMessagingPolicy
> > > 
> > > Add reference to WSS 1.1 after [WSS] (lines 306-308):
> > > 
> > > [WSSecurity11]
> > > 
> > > Web Services Security: SOAP Message Security 1.1 (WS-Security 2005)
> > > 
> > > 
> > http://www.oasis-open.org/committees/download.php/13396/wss-v1.1-spec-
> > > pr-SOAPMessageSecurity-01.htm
> > > 
> > > 
> > > Anthony Nadalin, Chris Kaler, Ronald Monzillo, Phillip 
> > Hallam-Baker, 
> > > eds, OASIS Standard xxxxxx, final date
> > > 
> > > 
> > > 
> >