Issue 99: KeyIdentifier without ValueType

[merlin hughes <merlin@baltimore.ie>]

Issue 99 relates to the semantics of a KeyIdentifier without
QName:

  Resolution: "Profiles must define what value is implied if specific
  value is not specified"

I don't see how this makes sense: A Security header does not
explicitly indicate that it conforms with a particular profile,
so how do I determine which profile a KeyIdentifier fits. If
this is somehow implicit, what happens if a message employs
two profiles?

I'd suggest that we either make ValueType mandatory, although
I know it is late in the day for such a suggestion, or else
that we state that an unspecified ValueType is interpreted
in an application-specific manner.

Further, the text currently states that 'any value specified
for binary security tokens [...] can be specified here', which
seems odd - why not just let profiles define KeyIdentifier
ValueType QNames. In many cases, there will be no 1:1 mapping
between KeyIdentifier types and token types; e.g., a
KeyIdentifier ValueType of wsse:PKCS7 makes no sense.

merlin


-----------------------------------------------------------------------------
The information contained in this message is confidential and is intended
for the addressee(s) only.  If you have received this message in error or
there are any problems please notify the originator immediately.  The 
unauthorised use, disclosure, copying or alteration of this message is 
strictly forbidden. Baltimore Technologies plc will not be liable for
direct, special, indirect or consequential damages arising from alteration
of the contents of this message by a third party or as a result of any 
virus being passed on.

This footnote confirms that this email message has been swept for Content
Security threats, including computer viruses.
http://www.baltimore.com