[dsml] SOAP Header and Authentication

[Andy Harjanto <andyhar@windows.microsoft.com>]

Per our discussion in this week conference call, this is the write up.

 

 

SOAP Header.

 

I agree with the revision that Christine did (10/31/01 draft).  The spec now states that the DSML does not specify any SOAP Headers, but it does not prevent SOAP Headers from being transmitted.

 

SOAP Authentication

 

I would like to add just a few sentences from draft 8 to include the reason for HTTP 1.1 authentication and some words about SOAP security.

 

The revised paragraph:

 

Authentication in this binding is dependent upon the transport that is used with SOAP.  At the present time, the SOAP specification does not define authentication mechanisms. A few SOAP Security proposals have been submitted for consideration.  In the future, once a SOAP Security standard emerges, the DSML working group will revisit and decide whether the standard should be adopted. Today, in the absence of a SOAP Security standard, the DSML working group sets a guideline for SOAP authentication over HTTP. When using HTTP 1.1 the authentication information is transferred in accordance with RFC 2617 which covers Basic and Digest forms. It is also recommended that TLS 1.0 (RFC 2246) be used in particular with the Basic form of authentication.

 

 

Thanks.

--andy