RE: Ballot Attached - Group 3: Sessions

[George_Robert_Blakley_III@tivoli.com]

All,

Here's my vote on issue group 3:

(See attached file: Group3VoteBlakley.html)

--bob

Bob Blakley
Chief Scientist
Enterprise Solutions Unit
Tivoli Systems, Inc. (an IBM Company)

Title: Session Management Scenarios

Issue: [UC-3-1:UserSession]

2. Do not add this requirement and/or use cases

ISSUE:[UC-3-02:ConversationSession]

1. Do not pursue this requirement as it is not in scope.

ISSUE:[UC-3-03:Logout]

2. Do not add this requirement and/or use cases

Issue: [UC-3-6:Destination Logout]

3. Abstain

bb> I don't feel that I understand well enough what we'd consider doing here to express an opinion yet.

Issue: [UC-3-7:Logout Extent].

3. This is something which should be determined by the owners of the particular set of web sites in question

and not presumed by our specification.

ISSUE:[UC-3-04:StepUpAuthc]

1. Move this issue to the AuthC issue group and leave open for discussion and voting.

ISSUE:[UC-3-05:SessionTimeout]

1. Add this requirement and/or use cases to [OSSML]

bb> However I believe that the phrasing of the requirement is wrong.  I think what we should support

bb> is expiration of assertions.  Timeout is an action a receiving system implements based on observing

bb> that an assertion has timed out.

Issue: [UC-3-8:Destination Timeout]

2. Do not add this requirement and/or use cases