Proposed WS-R/WS-S Composability Interop activity for WS-RM TC approval

["Alan Weissberger" <ajwdct@technologist.com>]

Proposal for new work item related to WS-R and WS-Security Composability Project:

Alan Weissberger, NEC and Jacques Durand, Fujitsu

Fujitsu and NEC are proposing a new activity associated with the composability of WS-R and WS-Security.  We would like to demonstrate several interoperable implementations of these composed OASIS standards at an interoperability event to be hosted by Fujitsu in early June.  The WS-R implementations may be based on those developed for previous interop demos, or on the open source RM4GS (which runs under Linux OS).  The WS-Security implementations may be based on company implementations, new implementations for this demo, or the Apache open source________________.  

Both Fujitsu and NEC will have implementations for this interop and we encourage other companies to participate as well.

Our test scripts/ test assertions will be compliant with both the WS-Security standard and the corresponding WS-I BSP WG drafts (to be identified). 

We would like to base our interop test assertions on four security requirements:

-authentication

-authorization

-confidentiality (encryption)

-integrity (tamper proofing)

For each of these requirements, we plan to identify the constituent functionality and ordered WS-R/WS-S header processing at the sender. That is, we would like to allow for different composability processing configurations on the sender side, while specifying only the composed message format transmitted (we assume over HTTP transport) on the wire. 

The transmitted message format will implicitly specify the test case for receiver processing.  From this defined functionality, we will specify the test assertions, which will be the essence of the composed WS-R/WS-S implementations to be tested for interoperability.  

Our goal is to specify no more than 12 test assertions.

Here are a few functionality type questions we have pondered:

• What parts of the SOAP message are signed, what type of signature?
• What parts of the SOAP message are encrypted (only the message body or headers too)?
• What type of encryption and key management should we select? 
• Do we require integrity of the WS-R header, payload or both? 
• What type of digital signature will be needed, e.g. detached (subset of SOAP message) or embedded (entire SOAP message/ envelope)? 
• What token type(s) will be used for authentication- X.509, REL, SAML, Kerberos? 

Our proposed TC work plan is as follows:

-Agree on requirements on the Tuesday April 5 call

-Agree on functionality and start work on test assertions this week (ending Friday April 8).  We are willing to have a task force call this week, if there is sufficient interest.

-Agree on test assertions on April 19 call or f2f meeting (if call is cancelled)

-Begin implementations immediately thereafter.  Assume implementations will be completed by end of May

-Interop event to be held at Fujitsu Software, Sunnyvale, CA in early June.

-Upon successful interop event testing, participants are invited to provide an Internet end point for future interoperability testing of the composed specs.  Additional test assertions may be included at that time.

Alan Weissberger
NEC Labs America
1 408 863 6042