[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: NEW ISSUE: Does IssuedTokenOverTransport require client-side digitalsignature?
*PLEASE DO NOT REPLY TO THIS EMAIL OR START A DISCUSSISON THREAD UNTIL THE ISSUE IS ASSIGNED A NUMBER. * *The issues coordinators will notify the list when that has occurred.* * * Protocol: ws-trust / ws-sc Interop Document: SX-Interop http://lists.oasis-open.org/archives/ws-sx/200602/msg00010.html Artifact: interop Type: editorial Title: Does IssuedTokenOverTransport require client-side digital signature? Description: There some ambiguity in the discussion under the "IssuedTokenOverTransport" in the interop document. Is the client supposed to sign the SAML token and SOAP payload with the key from the SAML token? If this is the intent, it should be made clear in the text. Or is the intent to use a SAML bearer token? This is a legitimate use-case we would like to see captured in some interop scenario. If that is the intent, we need to ensure that the SAML token returned by STS is a bearer token. This should be made clear in the text. Related issues: Proposed Resolution:: Need to understand intent of the author; I can then propose changes (if needed).
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]