SwA Interop 2 Issue List

["Blake Dournaee" <blake@sarvega.com>]

All,

Below are the issues that were encountered in the second interop. I believe
that only #4 affects the main profile document.

1. When sending attachments that are of content type text/xml, some
implementations were erroneously using application/xml when the profile
document specifies text/xml

2. Direct references to security token material should be used as specified
by the profile document; some implementations where erroneously using key
identifiers

3. "Content-ID" is a MIME header and is case sensitive. Implementations
should take care to perform the appropriate case change if the header
arrives incorrectly.

4. When doing Attachment-Complete-Transform for signatures, Oracle code was
canonicalizing original headers ie "Content-ID" without "<>" whereas Sun &
Actional was canonicalizing headers with Content-ID that includes the "<>".
Oracle changed their implementation to match the other vendors.

Oracle believes that this goes against Section 4.4.4 of SwA profile which
states that first you must Canonicalize the attachment content, then
headers, and then use the CID reference scheme. Doesn't this mean we should
be canonicalizing original Content-ID header and not the one that include
"<>"?


Thanks,

Blake