Re: Question about IPR on the final SAML V2 specs

[James Bryce Clark <jamie.clark@oasis-open.org>]

>From: nishimura.toshi@jp.fujitsu.com
>
>Hello, I think some part of the submitted Liberty specs are incorporated 
>to SAML V2 specs.  Though there is an IPR statement on the submitted 
>Liberty specs (http://www.oasis-open.org/committees/security/ipr.php), it 
>only mentions about patent licenses which are required to implement the 
>final "Liberty Alliance" specifications.  5 companies have disclosed their 
>patents and license terms on Liberty web page and some of the license 
>terms are non-RF.  (http://www.projectliberty.org/about/ipr.php)
>Do we need these patents (and licenses) to implement the final "SAML V2" 
>specs? (And what are their license terms?) I hope such information will be 
>available on TC IPR page before the final OASIS Standard ballot.
>Best Regards, Toshi
>---
>NISHIMURA Toshihiro (FAMILY Given)
>nishimura.toshi@jp.fujitsu.com
>STRATEGY AND TECHNOLOGY DIV., SOFTWARE GROUP, FUJITSU LIMITED

Mr. Nishimura:
     Obviously any implementer should consult their own experts about the 
details of patent and other intellectual property claims that may apply to 
a specific method.
     Four OASIS member companies contributed some specific material from 
the Liberty Alliance program to the OASIS SSTC in 2003.  Their disclosure 
statement, which can be found at the TC's IPR notices page, 
http://www.oasis-open.org/committees/security/ipr.php, indicates that they 
had permission to do so, as is required by the terms of the OASIS IPR Policy.
     The IPR Policy also requires that each contributor represent "that he 
has disclosed the existence of any proprietary or intellectual property 
rights in the contribution that are reasonably and personally known to the 
contributor," so it is reasonable to assume that all of the claims known to 
those individuals are posted on the SSTC notices page.  There are several 
specific patents, and licenses for those patents, identified there.
     You point out an additional reference to some disclosures published by 
Liberty Alliance, without any information regarding their applicability to 
any work incorporated into SAML v2.0.  OASIS has received no information 
regarding the identity, applicability or accuracy of any such 
claims.  Other than those explicitly listed on the SSTC notices page, none 
have been identified to OASIS as relevant to SAML.   As with all such work, 
each member and implementer must make its own evaluation of the adequacy of 
assurances and availability.
     Regards  JBC

~   James Bryce Clark
~   Director, Standards Development, OASIS
~   +1 978 667 5115 x 203 central office
~   +1 310 293 6739 mobile