RE: [wsrp-wsia] [I#59] Need wsdlURL field in ServiceDescription?

[Andre Kramer <andre.kramer@eu.citrix.com>]

The following use case for keeping the wsdlURL in ServiceDescription seems
convincing for me:

Someone emails you their WSRP service wsdl or you obtain it from a (non
secure v2.0) public UDDI registry. You will want to bootstrap a secure
connection to the provider. You use the https URL for the service
description factor in the (unverified) wsdl to get the Service Description.
You then https GET the service wsdl document pointed to by the wsdlURL field
(using a https URL) in the Service Description returned to you and you
compare it with the one you started with. Or you just (re)extract all the
endpoint URLs from the trustable wsdl. [How you obtain the libraries to
process the wsdl in a trustworthy manner is another matter.] Adding a secure
digest of the wsdl to the service description would also do, but I think the
use case shows that the wsdURL field in service description can be useful
(in somewhat unexpected ways).

I also believe we still need some guidance on how secure ports are put into
a producer's wsdl. The following approach produces two stubs for Axis and
.NET (The one for the secure factor is named WSRP_v1_Markup_Binding_SOAP1 in
.NET, while Axis uses a more meaningful WSRPSecureBaseService):

<wsdl:service name="WSRPServiceService">
    <wsdl:port binding="bind:WSRP_v1_Markup_Binding_SOAP"
name="WSRPBaseService">
      <wsdlsoap:address location="http://localhost/WSRPService"/>
    </wsdl:port>
    <wsdl:port binding="bind:WSRP_v1_Markup_Binding_SOAP"
name="WSRPSecureBaseService">
      <wsdlsoap:address location="https://localhost/WSRPService"/>
    </wsdl:port>
    ...
</wsdl:service>

Then the consumer can go look for WSRP* and WSRPSecure* ports (independent
of http/https URLs).

-----Original Message-----
From: Rich Thompson [mailto:richt2@us.ibm.com]
Sent: 11 November 2002 22:14
To: wsrp-wsia@lists.oasis-open.org
Subject: [wsrp-wsia] [I#59] Need wsdlURL field in ServiceDescription?







By the end of the F2F, I think we had left just this one issue for
discussion / vote in the regular conference call on 11/14. Please be
prepared to resolve this last one at that time.

Thanks, Rich


----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>