Re: [wss] ISSUE 190: text for SOAP MustUnderstand issue

[Rich Salz <rsalz@datapower.com>]

I re-read 2.4, etc., of the SOAP 1.2 spec.

Is it possible to fully conform to any SOAP header that has an extension 
point in its schema?  The minute someone can put
    <xs:any namespace="##other" processContents="lax"/>
it seems to me that the "mustUnderstand" requirements move up to the 
application level.

> what is it about the contents of the wsse:Security header block that allow 
> an implementation to know what it may or may not safely ignore?

A WS-Security header doesn't get spontaneously generated or processed; 
it's created and used because of specific application needs.  If you 
follow the slippery slope of Jerry's questions, you are led to 
conclusion that a receiver can ignore *everything* in a WS-Security 
header.  If it can ignore everything, what does it mean to understand 
it?  I believe that at this point, the concept of mustUnderstand becomes 
so useless at the WS-Security level, that the only feasible thing to do 
is leave it to the invoking application.

> STSM, Emerging e-business Industry Architecture

What's STSM?

	/r$
-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html