RE: [wsrp-wsia] [I#174] The Consumer SHOULD NOT assert a role for arole which the Producer does not have

[Gil Tayar <Gil.Tayar@webcollage.com>]

I agree with the alternative statement in that it asserts a stronger
statement.

As to roles being/not being in the spec, shouldn't you be adding an issue
sometime soon? (says the keeper of the issues list :->)

Gil

-----Original Message-----
From: Rich Thompson [mailto:richt2@us.ibm.com]
Sent: Tue, December 10, 2002 15:04
To: wsrp-wsia@lists.oasis-open.org
Subject: Re: [wsrp-wsia] [I#174] The Consumer SHOULD NOT assert a role
for a role which th e Producer does not have







The alternative suggestion is the intent currently (at least for me ...), I
think it is important to not weaken the statement about what roles a
Consumer is allowed to send (i.e. must be one the Producer supplied in its
service description) so that it is likely meaningful to the Producer. This
does not imply a requirement that the Consumer check that the role is still
supported at the point of usage.

All this discussion is contingent on roles remaining in the protocol of
course. I still haven't seen convincing arguments that WSRP should be
defining how access control is passed to a web service (yes, roles are
about entities using access control when generating their markup).

Rich Thompson


 

                      Gil Tayar

                      <Gil.Tayar@webcol        To:
wsrp-wsia@lists.oasis-open.org                                         
                      lage.com>                cc:

                                               Subject:  [wsrp-wsia] [I#174]
The Consumer SHOULD NOT assert a role for a role   
                      12/10/2002 03:18          which th       e Producer
does not have                                         
                      AM

 

 




Issue: 174
Status: Active
Topic: interface
Class: Minor_Technical
Raised by: Eilon Reshef
Title: The Consumer SHOULD NOT assert a role for a role which the Producer
does not have
Date Added: 10-Dec-2002
Document Section:   v0.85/4.1.6
Description:
"The Consumer ""MUST NOT"" assert a role for which no RoleDescription was
part of the Producer's ServiceDescription. This should be a ""SHOULD NOT""
because changes to the service description can happen arbitrarily and we
can't require Consumers to validate that the service description hasn't
changed before each operation invocation.
alternative would be to add verbiage to the effect that the Consumer MUST
NOT assert a role the Producer has not said it supports. The Producer
SHOULD be prepared to receive a role it does not currently support as it
may have existed in a previous service description. The Consumer is not
required to get a current snapshot all the time, but must abide by the
snapshot it has."


----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>