OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

ws-sx message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: RE: [ws-sx] WS-SX TC Minutes, Mar 01 2006


Thanks for the clarifications.  I found some of the discussion very hard
to record and I apologize for any errors and false attributions.

I will try to fix these parts when I add the roll call to the minutes.

If anyone else has suggested changes please let me know ASAP.

/paulc

Paul Cotton, Microsoft Canada
17 Eleanor Drive, Ottawa, Ontario K2E 6A3
Tel: (613) 225-5445 Fax: (425) 936-7329
mailto:Paul.Cotton@microsoft.com

 



> -----Original Message-----
> From: Scott Cantor [mailto:cantor.2@osu.edu]
> Sent: March 1, 2006 12:15 PM
> To: Paul Cotton; ws-sx@lists.oasis-open.org
> Subject: RE: [ws-sx] WS-SX TC Minutes, Mar 01 2006
> 
> > Scott Cantor asked why SP supported supporting tokens if there was
not
> > enough information for the client to know what to do with it.  Scott
> > asked how the usage attribute in the security token reference will
get
> > filled in.
> 
> This wasn't me. Not sure who it was. All I said was that I felt the
> discussion was conflating one sort of policy (I think security is too
> vague
> a word, period) with what I would call "authorization" policy, but you
> could
> use the words access or application there as well. I think TonyN used
> "application" to mean the same thing I meant.
> 
> > i031   Clarification for UsernameToken assertion See thread at:
> > http://lists.oasis-open.org/archives/ws-sx/200602/msg00091.html
> > Corina Witt stated that the SP should define what features of a
token
> > are used.  Scott Cantor asked why SP shouldn't be used to specify
what
> > SAML assertions were required in a specific token instance.
> 
> Actually, I think I was more saying that based on what I was hearing,
it
> shouldn't (and I did say that it's not confined to SAML, almost all
tokens
> have a lot of variability, including some Kerberos flavors). I wasn't
> expressing an opinion as to whether it should.
> 
> > Scott Cantor suggested that it would be useful to know how to link
> > "application level security" to the information expressed by SP.
> 
> Not sure I said it, but I agree with it.
> 
> Thx,
> -- Scott



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]