OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

security-services message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Minutes for 19-Oct SSTC Focus call


·         Prateek Mishra (Netegrity)

·         Rob Philpott (RSA Security)

·         Darren Platt (Ping Identity)

·         Scott Cantor (Internet2)

·         Forrest Yin (Netegrity)

·         Ari Kermaier (Oracle)

·         Vamsi Motukuru (Oracle)

·         Ron Monzillo (Sun)

·         Rick Randall (BAH)

·         Frederick Hirsch (Nokia)

·         RL “Bob” Morgan (Internet2)

·         Greg Whitehead (Trustgenix)


1. Agenda bashing


2. SSTC Timelines and Schedule review



(a) Karl's message announcing the second review was sent out September 29

and has the and end-date for October 31. What impact does it have on our



Prateek: Is there a mismatch with the end of the review period (31-Oct) and or voting meeting schedule?

Frederick: WS-I meeting is on the 2nd

Rob: We have a voting call on 10/26 and on 11/9. We should try to vote on as many changes as possible next week.  Nov 9 will be the official vote on CD status/submission.

Scott: Not many comments – One note from Scott McAlpin.  Scott will officially respond.


(b) When will implementation attestations likely be available?

Scott: We had discussion on being less strict this time.

Rob: There was general agreement on that.

Scott: They’ve done some stuff with the Metadata spec.

Rob: We really need core implementers.  If we don’t have 3, do we want to postpone the vote? Thinks we can vote to submit without the attestations, but may not be the right thing to do.  Rob will send a note indicating that we must have the attestations to submit and without them, we will need to postpone the submission vote. Do folks think we should extend the review period? Or should we vote for CD and put them on the shelf and wait for attestations.

Scott: believes the latter is the best approach.  Prateek agrees.

Rob: But extending the current period may be more efficient for dealing with non-substantive changes we may decide we need to make as a result of work to get attestations.

Prateek: for now, we will recommend going ahead with CD vote on 11/9 and do submission vote once attestations are ready.


Scott: What about new OASIS IPR policy?

Rob: doesn’t affect us.  It has to be approved by the board and there is a transition period.

Frederick: Agrees that it shouldn’t impact SAML 2.0.


(c) Primer status and next steps

Prateek: Will synch up with John H and Eve re: the technical overview and get out an update in the near future.



3.  Recent e-mail threads and on-going discussions


(a) Metadata Support for Discovery Profile


Scott: this is closed.


(b) Propose changes to definition of Federation in glossary (long)


Prateek: this is still open. Main idea was 1) separate account linkage from federation.

Scott: Discussed this on previous call. Seemed to have general agreement except recommended adding a parenthetical about it not being restricted to a pair of providers. Also there isn’t necessarily an explicit agreement on the time period associated with the federation. Prateek will send out a new proposed re-spin of the text.


(c) "Registration" process for third-party SAML customizations


Prateek: Is this really about new Bindings and/or Profiles?

Scott: Yes.  Don’t necessarily like the term “customization”.  Perhaps “Bindings, Profiles, and Extensions” would be more appropriate.

Prateek and Rob agree.



4. Other discussions:


(a) Ron’s note to the list today. Could we consider going back to AssertionID instead of xs:ID?

Scott: there was overwhelming agreement to switch to xs:ID.

Ari, Ron, Scott, Frederick: Much debate.

Ron: so what do we want to ask WSS to do?

Scott: Such a change would be substantive (requiring a new public review) and doing it wouldn’t help that much anyway.

- Too much discussion to capture for minutes...

Ron: Will recommend to WSS to add SAML 1.1 AssertionID to their list and that they should be prepared to add SAML 2.0 ID as well. Will maybe suggest creating a different WSS reference form to deal with it.



Rob Philpott
Senior Consulting Engineer 
RSA Security Inc.
Tel: 781-515-7115
Mobile: 617-510-0893
Fax: 781-515-7020


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]