[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Comments from Wells Fargo
The following comments were posted by Wells Fargo (Dustin Sauter) in conjunction with their "yes" vote for the WSS specifications as an OASIS Standard. I believe no action is required on the first, but that the second should be added as an issue. ----- Comment #1 Document: Web Services Security: SOAP Message Security (WS-Security) Comment: Although general guidance is provided regarding XML security tokens, WSS 1.0 does not include a security assertion markup language (SAML) assertion/token profile. This is a serious omission given the critical role of SAML in so many federated identity solutions now being deployed. The omission has forced a number of commercial web services security products to create their own SAML-SOAP bindings (or use the one promoted by the Liberty Alliance) in order to meet customer demand. Recommendation: Include a SAML 1.1 profile in the next WSS version as early as possible. Comment #2 Document: Web Services Security: Username Token Profile Comment: The UserName Token element (/wsse:UsernameToken) does not provide any means of qualifying the user name to indicate its type or domain. Optional sub-elements should be defined for type (with several types pre-defined including e-mail address and Microsoft SAM account name) and domain (DNS or NT/AD). Without such qualifiers a value can often be ambiguous or non-unique. For an example of XML type and domain qualifiers, refer to the Username schema in the security assertion markup language (SAML). Recommendation: Add optional qualifiers to UsernameToken in the next WSS version. ----- Hal
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]