RE: [security-services] AI 0031 Clarify text around AuthorityKind

[Scott Cantor <cantor.2@osu.edu>]

> I realize I'm yanking on something that wasn't part of the presumed 
> original problem...  I'm sorry for any confusion (and for any 
> annoyance at my "thinking out loud" on this).

No, I was pretty sure I knew what you meant, but I wanted to see it spelled out. ;-)

Looking at this whole problem from another perspective, one of the things that's obvious when you approach the metadata is that what
you really want to talk about here is an interface, a WSDL abstract service definition (forgive the terminology if I'm getting the
WSDL term wrong, but I think my meaning is clear).

So I wonder, what does the WSDL for an Attribute Authority, look like? Does it say you must get Assertions with AttributeStatement
elements in them? Does it just say the statements have to be of AttributeStatementType? Does it say neither, because of the whole
statement/assertion issue and just say you'll get a Response, period?

If the latter, ignore that for a moment, and say you did define a service that returned attribute statements directly, and answer
the question again.

Put still another way, I'm more than willing to concede that AuthorityKind is underspecified until it can carry or reference the
actual WSDL, but I wonder if that really helps address something like this except by moving the problem to another layer.

-- Scott