[wss] Adequacy of Error handling

[Vipin Samar <vipin.samar@oracle.com>]

A few comments about the current error handling (section 12 of WSS-Core-01):

- There is no support for any token-specific error propagation. For example,
expired certificate.
- If there are multiple tokens, how do we indicate the token that has the
problem?

- What about the security of the SOAP fault messages themselves?

- The current error list seems does not include the various generic errors that
are possible. For example, message replay, multiple IDs with same name, etc.
- The current error name/numbers have potentially confusing interpretation.  For
example, when should InvalidSecurityToken be used vs. when FailedCheck be used? 
Clarifications would be helpful here.

Also, how exactly are we going to map the wss error codes to the SOAP fault
codes? would the SOAP node be sending the "Sender" code for error (as defined in
section 5.4 of SOAP 1.2 spec)?  Would the wss errors be expressed as subcodes?

Thanks

Vipin Samar