[internal] RE: Issue PR029: Move capability assertions (e.g.,MustNotSendCancel, MustNotSendRenew, etc.) which are properties of the STSnot the token, into WS-Trust assertion

[Paul Cotton <Paul.Cotton@microsoft.com>]

> Fold these STS capability assertions into WS-Trust assertion

 

Is it obvious how to do this?  It is a significant enough change to change the namespace?

 

/paulc

 

Paul Cotton, Microsoft Canada

17 Eleanor Drive, Ottawa, Ontario K2E 6A3

Tel: (613) 225-5445 Fax: (425) 936-7329

mailto:Paul.Cotton@microsoft.com

 

 

 

 

 

_____________________________________________
From: Greg Carpenter
Sent: April 16, 2007 10:19 AM
To: ws-sx@lists.oasis-open.org
Subject: Issue PR029: Move capability assertions (e.g., MustNotSendCancel, MustNotSendRenew, etc.) which are properties of the STS not the token, into WS-Trust assertion

 

[[ gleaned from the spreadsheet of SP PR comments posted at http://lists.oasis-open.org/archives/ws-sx-comment/200704/msg00000.html ]]

Protocol:  ws-securitypolicy

http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/ws-securitypolicy-1.2-spec-cd-02-diff.pdf

Artifact:  spec / schema

Type: design

Title:  Move capability assertions (e.g., MustNotSendCancel, MustNotSendRenew, etc.) which are properties of the STS not the token, into WS-Trust assertion

Description:

section 5.4.5:
The SpnegoContextToken includes STS capabilities assertions, e.g., MustNotSendCancel, MustNotSendRenew, etc., which are properties of the STS not the token. This tight coupling between the token and the STS server requires the list of assertions be adjusted.
section 5.4.7:
The SecureConversationTokens includes STS capabilities assertions which are properties of the STS not the token. This tight coupling between the token and the STS server requires the list of assertions be adjusted

Related issues:

None.

Proposed Resolution:

Fold these STS capability assertions into WS-Trust assertion