Re: [ws-rx] compromise proposal for i122-4

[Anthony Nadalin <drsecure@us.ibm.com>]

There is more to each proposal then where to place the STR as pointed out oin the call.

-----------------
Sent from Tony's BlackBerry.


----- Original Message -----
From: Tom Rutt [tom@coastin.com]
Sent: 07/17/2006 12:31 PM
To: Paul Fremantle <paul@wso2.com>
Cc: wsrx <ws-rx@lists.oasis-open.org>
Subject: [ws-rx] compromise proposal for i122-4

Paul Fremantle wrote:

>I'm trying to understand the latest "concrete" proposals for the
>security issues.
>
>Based on Doug Buntings note last week, and the discussions since then.
>
>1) latest from Microsoft and IBM
><http://lists.oasis-open.org/ws-rx/200607/msg00036.html> modified by Gil
>-  http://lists.oasis-open.org/ws-rx/200607/msg00070.html, and agreed to
>at least by Marc.
>
>2) latest from Oracle and SAP
>http://lists.oasis-open.org/ws-rx/200607/msg00075.html also modified by
>Gil's http://lists.oasis-open.org/ws-rx/200607/msg00070.html
>
>3) Close no action from Doug Bunting.
>http://lists.oasis-open.org/ws-rx/200607/msg00088.html
>
>Can the owners of these proposals (and any others I missed) please
>confirm these are the latest that you support.
>
>Thanks
>Paul
>
>
>
I have a new compromise proposal to discuss.

Let the sending side pick either Oracle or Microsoft way to send STR.
(some implementations seem to be able to support one way better over the
other).

The receiving side would have to accept create sequence messages with
the str in either place (i.e., in security header with usage attribute,
or directly in
createSequence element in body).

The receiving implementation would look in both places if the
wsrm:UsesSequenceSTR element is present as a soap header.

Tom Rutt

--
----------------------------------------------------
Tom Rutt	email: tom@coastin.com; trutt@us.fujitsu.com
Tel: +1 732 801 5744          Fax: +1 732 774 5133