Thank you for the SOA-TEL presentation + next-steps

[Thomas Hardjono <hardjono@MIT.EDU>]

Enrico, Federico and Paolo,

Thank you for your presentation today regarding the work of the SOA-TEL. As we indicated, the SSTC would welcome any new work items into the SSTC.

The list of current work-items of the SSTC is actually listed in the agenda (Part-II) of today's meeting:
http://www.oasis-open.org/apps/org/workgroup/security/email/archives/201004/msg00023.html

Based on my experience in the SSTC and other working groups, it is usually more practical if somebody (person[s]) owns the work-items in the SSTC to ensure there is continual progress.  Most (if not all) the SSTC members are already busy with their work-items in the SSTC. 

I would therefore recommend the following two steps:

(a) Telecom Italia join the SSTC as a member, own these two security-related problems (eg. SAML Token Correlation and User-ID Forwarding), and write/develop a specification(s) in the SSTC that solve them.  [NB. This is similar to the approach of NSN in addressing the attribute management protocol.  As Scott Cantor and Hal Lockhart mentioned, the usual approach of the SSTC is to create SAML2.0 Profiles (and not modify the SAML2.0 Core specification).  Thus, perhaps the outcome of your work could be a SAML2.0 SOA-TEL Profile.]

(b) Develop a close liaison between SOAL-TEL and SSTC, such that any SOA-TEL security specification (developed in the SSTC) can be voted in the SOA-TEL TC. In this manner, SOA-TEL TC retains its independence from the SSTC. (We need to understand the Oasis process to see if this is possible).


Please let us know what you think of this suggestion.

Thank you again for your presentation. We look forward to working with you to address these SOA-TEL problems.

Regards.

Nate/Thomas
-----------
SSTC Co-chairs