Issue 47: Does IssuedTokenOverTransport require client-side digital signature?

["Marc Goodner" <mgoodner@microsoft.com>]

Logged as issue 47.


-----Original Message-----
From: Prateek Mishra [mailto:prateek.mishra@oracle.com] 
Sent: Monday, March 13, 2006 1:34 PM
To: ws-sx@lists.oasis-open.org
Cc: Marc Goodner
Subject: NEW ISSUE: Does IssuedTokenOverTransport require client-side
digital signature?

*PLEASE DO NOT REPLY TO THIS EMAIL OR START A DISCUSSISON THREAD UNTIL 
THE ISSUE IS ASSIGNED A NUMBER.  *

*The issues coordinators will notify the list when that has occurred.*

* *

Protocol:  ws-trust / ws-sc

Interop Document:  SX-Interop
http://lists.oasis-open.org/archives/ws-sx/200602/msg00010.html

 

Artifact: 

interop

Type:

editorial

 

Title:

Does IssuedTokenOverTransport require client-side digital signature?

 

Description:

There some ambiguity in the discussion under the 
"IssuedTokenOverTransport" in the interop document. Is the client 
supposed to sign the SAML
token and SOAP payload with the key from the SAML token?  If this is the

intent, it should be made clear in the text.

Or is the intent to use a SAML bearer token? This is a legitimate 
use-case we would like to see captured in some interop scenario. If that

is the intent,
we need to ensure that the SAML token returned by STS is a bearer 
token.  This should be made clear in the text.

Related issues:

 

Proposed Resolution::

Need to understand intent of the author; I can then propose changes (if 
needed).