RE: [ws-rx] FW: [ws-sx] Issue 76: How to reference a specific SC when initiating a session?

["Marc Goodner" <mgoodner@microsoft.com>]

This issue was closed with no action on yesterday's SX TC call.
http://docs.oasis-open.org/ws-sx/issues/Issues.xml#i076 

Note that a follow on issue was opened.
http://docs.oasis-open.org/ws-sx/issues/Issues.xml#i077 

I think the new issue still has the same concerns from the perspective
of the discussion here regarding the semantics of the reference to the
token Martin makes below.

-----Original Message-----
From: Raepple, Martin [mailto:martin.raepple@sap.com] 
Sent: Wednesday, June 21, 2006 6:26 AM
To: ws-rx@lists.oasis-open.org
Subject: [ws-rx] FW: [ws-sx] Issue 76: How to reference a specific SC
when initiating a session?

FYI - my response on the SX mailing list to Prateeks issue regarding a
generic mechanism to secure sequences.

-Martin

Martin Raepple
Platform Ecosystem Industry Standards
SAP AG
Dietmar-Hopp-Allee 16
69190 Walldorf, Germany
T  +49/6227/7-60365
F  +49/6227/78-44724
mailto: martin.raepple@sap.com
http://www.sap.com

-----Original Message-----
From: Raepple, Martin [mailto:martin.raepple@sap.com]
Sent: Mittwoch, 21. Juni 2006 15:21
To: Prateek Mishra
Cc: ws-sx@lists.oasis-open.org
Subject: RE: [ws-sx] Issue 76: How to reference a specific SC when
initiating a session?

Prateek,

I think SC is not about defining the semantics for a session, sequence
etc. From my understanding, SC's scope is to define the (token) format
for a shared security context and the protocol messages to manage such a
context. Anything beyond this will be/is defined by other specs.

Even though SC defines a lifecycle for a context, this is still
independent of any higher level session/sequence semantics. In other
words, protocols like Reliable Messaging (RM) that define these
semantics can definitly take adventage of the generic context mechanisms
defined by SC, but there is always a non-generic part wrt security that
is specific to these higher-level protocols which should be specified by
the corresponding TCs. A session/(coordination)context/sequence has
special security requirements due to different semantics and I doubt
that we can find a common denominator in the SX TC.

Best regards
Martin

Martin Raepple
Platform Ecosystem Industry Standards
SAP AG
Dietmar-Hopp-Allee 16
69190 Walldorf, Germany
T  +49/6227/7-60365
F  +49/6227/78-44724
mailto: martin.raepple@sap.com
http://www.sap.com
 

>-----Original Message-----
>From: Marc Goodner [mailto:mgoodner@microsoft.com]
>Sent: Dienstag, 20. Juni 2006 17:23
>To: Prateek Mishra; ws-sx@lists.oasis-open.org
>Subject: [ws-sx] Issue 76: How to reference a specific SC when 
>initiating a session?
>
>Tracked as Issue 76.
>
>-----Original Message-----
>From: Prateek Mishra [mailto:prateek.mishra@oracle.com]
>Sent: Tuesday, June 20, 2006 11:12 AM
>To: ws-sx@lists.oasis-open.org
>Cc: Marc Goodner
>Subject: NEW ISSUE: How to reference a specific SC when initiating a 
>session?
>
>*PLEASE DO NOT REPLY TO THIS EMAIL OR START A DISCUSSISON THREAD UNTIL 
>THE ISSUE IS ASSIGNED A NUMBER.  *
>
>*The issues coordinators will notify the list when that has occurred.*
>
>* *
>
>Protocol:   ws-sc
>
>http://www.oasis-open.org/apps/org/workgroup/ws-sx/download.php
>/18838/ws
>-secureconversation-1.3-spec-ed-01-r06-diff.doc
>
>
> 
>
>Artifact:  spec
>
> 
>
>Type:
>
>design
>
> 
>
>Title:
>
>NEW ISSUE: How to reference a specific SC when initiating a session?
>
> 
>
>Description:
>
>This issue concerns the following use-case: a requestor wishes to 
>participate in a multi-message session with a recipient.
>The requestor  acquires a SC token by some means from its local 
>security system and adds it to the security header of a SOAP message.
>The SOAP message is meant to initiate a sequence of exchanges with the 
>recipient, all of which are to be protected by the SC token.
>Notice that
>in general, the SOAP message may carry several security headers 
>including other security tokens.
> 
>How can the requestor indicate to the recipient that a specific SC 
>token is to be used for the session?
>
> 
>
>Related issues:
>
>http://lists.oasis-open.org/archives/ws-rx/200606/msg00036.html
>
> 
>
>Proposed Resolution:
>
>My best guess here is that the requestor add a new STR to the header. 
>The STR would include a reference to the SC and include in its usage 
>attribute a URI referencing the message body. If this is acceptable to 
>the TC, we need to include some text explaining this "security 
>pattern".
>
>