Minutes from July 13 Meeting Version 3

[Paula K Austel <pka@us.ibm.com>]

Corrections/additions were sent to me by Ramana Turlapati.

Look for additions marked with <RT>


1. Call to order, roll call 
Kelvin Lawrence and Chris Kaler chaired the session.
Paula Austel appointed secretary. 
Attendance of Voting Members
 
  Gene Thurston AmberPoint
  Frank Siebenlist Argonne National Lab
  Merlin Hughes Betrusted
  Hal Lockhart BEA
  Corinna Witt BEA
  Davanum Srinivas CA
  Thomas DeMartini ContentGuard
  Sam Wei Documentum
  Dana Kaufman Forum Systems
  Toshihiro Nishimura Fujitsu
  Kefeng Chen GeoTrust
  Kojiro Nakayama Hitachi
  Paula Austel IBM
  Derek Fu IBM
  Kelvin Lawrence IBM
  Mike McIntosh IBM
  Anthony Nadalin IBM
  Nataraj Nagaratnam IBM
  Ron Williams IBM
  Don Flinn Individual
  Bob Morgan Internet2
  Kate Cherry Lockheed Martin
  Paul Cotton Microsoft
  Vijay Gajjala Microsoft
  Alan Geller Microsoft
  Chris Kaler Microsoft
  Richard Levinson Netegrity
  Frederick Hirsch Nokia
  Senthil Sengodan Nokia
  Abbie Barbir Nortel
  Lloyd Burch Novell
  Jerry Schwarz Oracle
  Ramana Turlapati Oracle
  Ben Hammond RSA Security
  Andrew Nash RSA Security
  Martijn de Boer SAP
  Blake Dournaee Sarvega
  Pete Wenzel SeeBeyond
  Jeff Hodges Sun Microsystems
  Ronald Monzillo Sun Microsystems
  John Weiland US Navy
  Phillip Hallam-Baker VeriSign
  Maneesh Sahu Westbridge Technology
    
    
Attendance of Prospective Members and Observers
 
  Vamsi Motukuru Oracle

Membership Status Changes
 
  Vamsi Motukuru Oracle - Requested membership 7/6/2004
  Ari Kermaier Oracle - Requested membership 7/13/2004
  Peter Dapkus BEA - Lost voting status after 7/13/2004 call
  John Shewchuk Microsoft - Returned from LOA before 7/13/2004 call
Quorum achieved 
Meeting started at 10:12am 

2. Reading/approving minutes of last meeting (June 29th)[1]
Approved. 

3. Errata status and review 
Errata documents are posted but no acknowledgement has been sent to Tony.
Tony addressed comments from Frederick. Highlighting text did not work
out well. Did not add pdf to existing set of documents. General comments
applied to all errata. Use fragments for URI and make clear the full URI
in the clarification section. 
Chris asking if we are at last call for the errata. 
Ron - we should close all the issues first. 
Tony - some of the open issues are not errata but post errata. 
Move this discussion until after the issue list to see which issues are
resolved. 

4. Status of other profiles (SAML, XrML, Kerberos, SwA)
Ron - posted updates. There were some comments on errors in examples. Reset
change bars to reflect changes since draft 12. Issue 290, encoding type
- put an approach on the list, Mike McIntosh responded. 
Ron - there are some comments on REL profile but they have not been incorporated
into the profile. 
No updates to REL or Kerberos 
Frederick - comments on list 
- Need to discuss what to do with attachments that are XML. Treat them
as XML or text. Should attachment be treated as a whole.
- MIME part canonicalization. 
- Blake posted proposal for interop document 

5. Issue list review 
Issue 256 - Paula - clarification added to errata. Mark this issue closed.
Issue 259 - closed 
Issues 260, 264 - closed 
287 - closed (rich levinson) 
290 - larger discussion needed (see discussion later in minutes)
293 - Ron wrote a proposal 3 weeks ago. Don't need to specify the version
of the certificate. Proposal can be found at this link: http://lists.oasis-open.org/archives/wss/200406/msg00068.html.
Need to fold clarification into errata 
ACTION: Mark this as pending, change issue list to state move this to errata
295B - mark as closed. 
290 (296?) - Discussion on the list. Defaults should be consistent independent
of the token type. Default values for attributes not codified in schema.
KeyIdentifiers mostly for binary content. SAML not used for only binary.
Need to use an encoding type to state that it is not encoded. Invent a
URI for a non-encoded value. 
Chris - Need to add a string or text identifier to core. Need to discuss
adding this to core. 
Encoding not buying us anything. Adding in the attribute is adding extra
confusion. 
Ron - make a schema change to specify the default.
Remove encoding type, specify a fixed encoding in the token profiles. 
Rich Levinson - should not remove encoding type attribute. remove
default from core. 
Ron - leave attributes and remove the defaults. If no token profile can
support multiple encodings than you remove the attribute all together.
Tony - profiles might have multiple encodings. Leave the attribute. 
Ron - we don't have a use case for multiple encodings. 
Chris - proposal - remove the default from core. Let profiles define their
own defaults. 
Chris - this will be better in next round of edits (change in behavior)
and not part of errata. 
Proposal to make change to next version of core to unblock SAML issue.
Problem with the SAML token profile with the way the core is currently
written. 
Ron - prefer to handle this is in errata so SAML profile doesn't have to
do something temporary to fix this issue. 
Does the schema make reference to base64 as default? Is this a schema change?
How to check that implementations to see if this change will effect them.
Rev the core with new SAML token profile. 
Kelvin - check with OASIS might have to put all specs together. How will
this effect the URLs? 
Chris - get clean changes of docs with errata folded in. 
Kelvin - need to rev the version numbers. 
Chris - fragment URIs don't work. Can include the full URIs in new rev
of docs. 
Ron - like to propose SAML token profile can work with core spec in a timely
fashion. Best solution to rev the specs together unless it will delay the
token profile. 
Paul Cotton - what would be the time table for this new rev of specs?
Chris - REL, SAML, changes in core - does it impact interoperability testing?,
Kerberos - interop going soon. Perhaps in the fall. 
Hal - keep Kerberos on a separate track. no further interop tests needed
for others. 
ACTION: Editors to make changes. 

Pending items: 
297 - Frederick - comments were correct and fix was added to draft, close
this issu 
296 - closed - Ron added clarifications for this issue.
298 - X509 issuer/serial - raised in WS-I. Issuer/serial better mechanism
to identify key. Issuer/serial is prohibited in X509 token profile
Mike - not prohibited in X509 token profile but limited in WS-I. 
Issuer/Serial should be child of KeyIdentifier.
Hal - Proposed change to specs: X509 token profile shows issuer/serial
used as direct reference. More logical to treat as keyidentifier. Issuer/Serial
is not a URI. 
Chris - We've kept structured data out of KeyIdentifier. (serial/issuer
is XML). Currently using SAML assertion Id, needs to be a string or base64
encoding. 
Mike - 4 different types of token references. Issuer/Serial does not fit
into any of the categories (STR, Direct Reference, KeyIdentifier, Embedded)
Chris - not a good idea to make KeyIdentifier content type mixed.
Chris - need a volunteer to create a proposal for a new reference type?
ACTION: Hal will create a new proposal 
299,300,301 - Closed. Comments from Frederick
302 - small errata to core spec - not addressed yet - leave open
ACTION: Tony to add to errata. 
303 - Pending 
ACTION: Editors to update (mainly editorial issue)
304 - Hal - suggest changing MAY to may. Is this normative? 
Propose not changing anything. No strong feeling to change this. May provide
some assistance to implementers. 
305 - Tony - Hal and Tim responded to comments. Concern going user to user
and using raw tickets. Not good to use raw tickets. More secure ways using
authenticators. 
Kerberos Authenticator protects the ticket. Multiple people cannot decode
the ticket? 
Ron - trying to add authenticator in addition to signatures? 
Proposal - yes 
Frank - want to exclude user to user all together?
Tony - yes 
Chris - machine level tickets are common (shared identity for the host).
If someone were to hijack the ticket off the wire they could feed it into
Kerberos and obtain a valid handle. Authenticators could prevent this.
No APIs to send in a raw ticket without authenticator. 
There is some overlap with WSS and Kerberos - we are trying to work with
legacy apps therefore we need to be compatible with Kerberos APIs. Authenticator
may be redundant for our app but needed to secure Kerberos. 
Hal - looking for clarification on when to use authenticator. 
Chris - don't need to reinvent all the Kerberos infrastructure. Focus on
protecting messages on the wire. 
Frank - can Tony write up reviews of security issues?
Tony will check to see if it's something he can share with the group. 
Chris - in user to user there are security issues.
Need a proposal on how to support user to user. 
3 actions items 
1. User to User is app specific 
2. tgt is app specific 
3. service ticket to ap_req 

<RT>Ramana - "is there a use case that
requires u2u information to be transported as part of WS-Security headers?"
<RT>Frank - no 
<RT> Hal - This means only APREQ  needs
to be supported 
<RT> Ron - sounds reasonable, but will there
be case where only service tickets are required? 
<RT>Ramana - No proof of possession with service
tickets, authenticators are required. 

Raj - cannot make a statement that tgt should always be carried in the
body. Might be useful in the header. 
Hal - should pass ticket plus authenticator (ap_req). 
Ron - are we going to prohibit sending service tickets by themselves? 
Chris - for standard Kerberos API then MUST is needed. For hybrid Kerberos
profiles then SHOULD is needed. 
Ron - we recommend that authenticators get sent. 
Chris - Make this our proposal. 
ACTION: Editors make edits for this. Mark issue pending. 
<RT>Raj  or somebody - What about fwd'ble
tickets ? 
<RT>Ramana - Fwd'ble tkts are part of APREQ


306 - Frederick - MIME part canonicalization is the issue. Defined by MIME
definition. A clarification is needed in the text. MIME header processing
is well defined. Jerry sent out a note with some clarifications. http://lists.oasis-open.org/archives/wss/200407/msg00047.html

<RT>Ramana asked Frederick why cant canonicalization
be decoupled from the transform? His reply :"whether a mime type needs
to canonicalized or not is defined as part of mime definition. But will
determine if decoupling is required for cases where such definition is
missing or if applications choose not to." Jerry had some comments
on this as well. 
ACTION: Mark pending, editors to make changes to draft

307 - how to deal with attachment with XML. Can you sign portions of XML?
Why not treat as a whole attachment? Not being processed as XML. 
Blake - XML standards being recast as SOAP, putting XML in attachment.
Might not want to handle as opaque. Want to be explicit about how this
XML is processed. 
Frederick - can this be opaque to SOAP processing but not opaque to the
application layer? 
ACTION: Frederick - make editor pass to see if he can resolve this. 


6. Interop planning status (Kerberos, SwA) 

No update on Kerberos interop 

SwA interop 
Blake - sent out email outlining proposed tests. http://lists.oasis-open.org/archives/wss/200407/msg00027.html
Need to find out who is interested in interop tests. Should send out an
email to ask who is interested (lost too many people on the call). 
Jerry - might want to specify what MIME types you are going to use. 
Frederick - choose one binary and one XML. 

7. Other business 
Committee draft of errata and SAML token profile. 
Propose a vote on errata for next call (vote for committee draft). 
Create a new schema with an A in the name. Put information about changed
schema in errata. 
Start an electronic vote after 7 days for SAML token profile. Start vote
a week from today, will close the Monday before next call. 

8. Adjournment 
Adjourned at 11:55



----------------------------------------------------------
Paula K. Austel
Web Services Security
IBM T.J. Watson Research Center
(914)784-5025
Tieline 863-5025