RE: New Name ! (A new suggestion)

[George_Robert_Blakley_III@tivoli.com]

All

OK, as long as we're naming, I'll float two proposals, both designed to be
short, descriptive, easy to pronounce, and
voted off Temptation Island :-)

SAML (Security Assertion Markup Language)
SAX (Security Assertion Exchange)

I like the second better because it doesn't implicitly exclude from scope
things we really seem to want
to do, such as protocol bindings and request-response metaprotocols (which
strictly speaking aren't part
of the "markup language").

--bob

Bob Blakley
Chief Scientist, Security
Tivoli Systems, Inc.


Carlisle Adams <carlisle.adams@entrust.com> on 01/26/2001 10:53:26 AM

To:   security-services@lists.oasis-open.org, "'Eve L. Maler'"
      <eve.maler@east.sun.com>
cc:
Subject:  RE: New Name ! (A new suggestion)





Hi,

I believe that the group has (rough) consensus that "S2ML" should be
changed as the overall name of this OASIS TC spec because "Security
Services" is too broad.  I, for one, would not want to be in the shoes of
the PR spokesperson (currently Eve!) trying to explain to some analyst or
press representative why XKMS -- which is clear a security service -- is
not within the scope of this TC.

Perhaps not surprisingly, I have no objections to "A2ML", but I can
understand the hesitation on the part of some who either feel that
"Authentication" implies too much, or that "Authentication and
Authorization" may be too narrow in scope.

Therefore, I will offer another name for consideration (if only so that we
have some competition for SEX-ML!).  It seems to me that what this group
would like to do is create a specification for the exchange of credentials.
These credentials (today covering both authentication credentials and
authorization credentials, but open in the future to other kinds of
credentials that we may choose to embrace) will be expressed in XML.
Furthermore, I think it is fair to say that the payload to be exchanged
will always include at least one "active" -- that is, currently valid --
credential (name assertion, entitlement assertion, whatever).

Thus, my suggestion is:  "Active XML Credentials Exchange Specification",
which has the intuitive and somewhat appropriate acronym "AXCES"
(pronounced "access").

Carlisle.