[security-services] Question on the use of <RespondWith>

["Sanfilippo, Joe" <joe.sanfilippo@commerceone.com>]

Title: Question on the use of <RespondWith>

I have a question on the use of <RespondWith> in the RequestAbstractType of the protocol. How would this be used to obtain an Assertion with multiple Statements? In general, are there a use cases (maybe to be added to the binding model)  that define when multiple Statements within a single assertion would be returned to a client? Is there a use case for multiple Statements of different types within the same Assertion?

Any pointers to discussion threads on this topic would be appreciated.

For example, I would like to obtain both Authentication information and Attribute information. It appears that there is a great deal of flexibility in the spec for doing this which may lead to interoperability issues.

Here are some potential ways to do it...
1) Separate Request/Response pairs
    <Request ...>
      <RespondWith>AuthenticationStatement</RespondWith>
      <AuthenticationQuery...> 
  </Request>

  <Response ...>
      <Status>...</Status>
        <Assertion ...>
          <AuthenticationStatement ...>
      </Assertion>
  </Response>

    <Request ...>
      <RespondWith>AttributeStatement</RespondWith>
      <AttributeQuery...>      
  </Request>

  <Response ...>
      <Status>...</Status>
        <Assertion ...>
          <AttributeStatement ...>
      </Assertion>
  </Response>

2) Multiple Assertions returned in a single Request/Response
    <Request ...>
      <RespondWith>AuthenticationStatement</RespondWith>
      <RespondWith>AttributeStatement</RespondWith>
      <AuthenticationQuery...> 
  </Request>

  <Response ...>
      <Status>...</Status>
        <Assertion ...>
          <AuthenticationStatement ...>
      </Assertion>
        <Assertion ...>
          <AttributeStatement ...>
      </Assertion>
  </Response>

3)Single Assertion with multiple Statements in a single Request/Response
    <Request ...>
      <RespondWith>MultipleStatement</RespondWith> <!-- Is this how it works? -->
      <RespondWith>AuthenticationStatement</RespondWith>
      <RespondWith>AttributeStatement</RespondWith>
      <AuthenticationQuery...> 
  </Request>

  <Response ...>
      <Status>...</Status>
        <Assertion ...>
          <AuthenticationStatement ...>
          <AttributeStatement ...>
      </Assertion>
  </Response>

Thanks,
Joe

Joe Sanfilippo
Commerce One
19191 Vallco Parkway, Cupertino, CA 95014
Tel 408 517 9245; Fax 408 517 3992
joe.sanfilippo@commerceone.com