The need to adopt a policy framework - concerns over the current approach taken on modeling security/auth

["Luc Clement" <luc.clement@systinet.com>]

Andrew,

 

Something hadn’t been sitting well with me with the approaches you’ve taken on these two TNs

 

• Modeling Web services Security in UDDI: http://www.oasis-open.org/apps/org/workgroup/uddi-spec/download.php/12217/uddi-spec-tc-tn-wssecurity-20040328.doc
• Modeling HTTP Access Auth in UDDI: http://www.oasis-open.org/apps/org/workgroup/uddi-spec/download.php/11960/uddi-spec-tc-tn-httpauth-20050321.doc

 

The problem stems from the fact that we’ve yet to adopt a policy framework for registry and the approach you’ve taken though not strictly incorrect is only delaying what in my opinion is the inevitable – the adoption of a policy framework for UDDI.

 

Had we one, we wouldn’t take the approach you’ve taken which as far as I’m concerned is the only reasonable one for you at this point within the current framework – or lack-thereof. That said, it isn’t reasonable for us to delay adopting a policy framework – dare I say WS-PolicyAttachment and WS-Policy.

 

I’m very concerned about making any recommendations that should (MUST) be expressed using policy by any other means. I think we should take a step back; finally take that bold move and adopt WS-Policy; and recast these two TNs using WS-Policy/PolicyAttachment.

 

Luc

 

Luc Clément | Senior Program Manager | Systinet Corporation |

One van de Graaff Drive Burlington, MA 01803

Phone +1 781.362.1330 | Mobile +1 978.793.2162 | Fax +1 781.362.1400 |