[security-services] OASIS SSTC letter to authors of WS-Security (draft)

["Mishra, Prateek" <pmishra@netegrity.com>]

Folks,

 

this is the proposed text of the message we plan to send to WS-Security authors.
I am circulating it to the list as (1) we voted on the contents on the message, not
its exact form, so here is a last chance to object, (2) neither jeff nor joe was on the
call, so here is a chance for them to object.

 

Bob M. and Prateek

-----------------------------------------------------------------------------------------------------

 

 

In April 2002, Microsoft and IBM jointly published a document entitled

"Security in a Web Services World: A Proposed Architecture and

Roadmap" (http://www.verisign.com/wss/architectureRoadmap.pdf), and

Microsoft, IBM, and VeriSign published a companion specification, "Web

Services Security (WS-Security) Version 1.0"

(http://www.verisign.com/wss/wss.pdf). The OASIS Security Services

Technical Committee, which has produced the Security Assertion Markup

Language (SAML) specification, considers these documents to be

important contributions to web services security. The SSTC views the

WS-Security technical specification as complementary to SAML, and

intends to use WS-Security in specifying the use of SAML for adding

security features to SOAP messages.

The SSTC urges the authors of the WS-Security specification to submit

the specification to an open standards body for further development,

standardization, and building of industry consensus. In particular,

intellectual property rights issues regarding this specification and

its technologies should be addressed to enable broad use of this work.