Format of wsse:Embedded

[Michael McIntosh <mikemci@us.ibm.com>]

During a recent discussion with involving
some members of WS-I, an issue arose related to the format of the wsse:Embedded
element. Please note that I do not represent WS-I.

It is unclear what is expected to be
contained in this element. In the case of an X.509 certificate, it could
be the base64 encoded certificate as child text, or it could be a wsse:BinarySecurityToken
containing the certificate.

I am not sure what the WSS TC intends
for the content of this. The WS-I may decide to include a statement in
its profile of statement to the effect that any token that appears within
an wsse:Embedded element should be in the same format that it would if
it were a child of wsse:Security (in the example above that would mean
the wsse:Embedded would contain a wsse:BinarySecurityToken which would
contain the X.509 certificate).

It would be helpful if we knew whether
this ambiguity was intentional or whether the WSS TC intends to constrain
in some way the format of the wsse:Embedded element.

Thanks,
Mike