RE: ACTION-48 update

"Applied to a Web services based system, policy
<http://dev.w3.org/cvsweb/~checkout~/2006/ws/policy/ws-policy-framework.
html?content-type=text/html;%20charset=utf-8#policy>  is used to convey
conditions on the interaction between two Web service endpoints"

 

In general, I think the proposed text for the first paragraph in section
3.4, is better than the current text. The only (minor) concern I have is
that the proposed text looks too restrictive. A policy may not
necessarily be used "to convey conditions on the interaction..." It may
just specify a particular requirement on an entity without any
interaction involved - let's say "log something every 30 seconds".

 

I would consider changing the proposed text from "policy
<http://dev.w3.org/cvsweb/~checkout~/2006/ws/policy/ws-policy-framework.
html?content-type=text/html;%20charset=utf-8#policy>  is used to convey
conditions on the interaction..." to "policy
<http://dev.w3.org/cvsweb/~checkout~/2006/ws/policy/ws-policy-framework.
html?content-type=text/html;%20charset=utf-8#policy>  may be used to
convey conditions on the interaction..."

 

Regards,

 

Yakov Sverdlov

CA

 

 

________________________________

From: public-ws-policy-request@w3.org
[mailto:public-ws-policy-request@w3.org] On Behalf Of Maryann Hondo
Sent: Tuesday, October 10, 2006 6:57 PM
To: public-ws-policy@w3.org
Subject: ACTION-48 update

 



In summary, we propose a  resolution for ACTION-48 (related to
http://www.w3.org/Bugs/Public/show_bug.cgi?id=3705): 
========================================================================
===================== 
Title: Clarify what an interaction represents in a Web services based
system and provide guidance that assertion authors must define the
interaction scope of an assertion 
 
Description: Section 3.4 in the WS-Policy Framework spec currently
contains the following text [1]: 
 
Applied in the Web services based system, policy is used to convey
conditions on an interaction between entities (requester application,
provider service, Web infrastructure component, etc). Any entity in a
Web services based system may expose a policy to convey conditions under
which it functions. Satisfying assertions in the policy usually results
in behavior that reflects these conditions. For example, if two entities
- requester and provider - expose their policies, a requester might use
the policy of the provider to decide whether or not to use the service.
A requester may choose any alternative since each is a valid
configuration for interaction with the service, but a requester MUST
choose only a single alternative for an interaction with a service since
each represents an alternative configuration. 
 
This text does not clearly define what an "interaction between entities"
in a Web services based system is. 
-------------- 

Also, policy assertion authors need to define the scope of the
interactions that an assertion applies to, including the policy subjects
to which the assertion may be attached and the messages within the
interaction scope.   This guidance should be in the Guidance for Policy
Assertion Authors doc. 

Description: Section 2.1.1 in the Policy Assertions Guidelines document
contains the following text: 

WS-Policy Domain authors must also specify how to associate the
assertions they have defined with the policy subjects identified by the
WS-Policy attachment specification. An example of this is also provided
by the WS-Security Policy specification in Appendix A. 

Justification: 
 
It is not clear from the current text that an interaction between
entities involves one or more messages between two entities.   
 
We need to make sure that we provide guidance to policy assertion
authors on how to clearly define their assertions.   
 
Proposal: 
 
New text for the first paragraph in section 3.4 of the WS-Policy spec: 

3.4 Policies of Entities in a Web Services Based System 
Applied to a Web services based system, policy
<http://dev.w3.org/cvsweb/~checkout~/2006/ws/policy/ws-policy-framework.
html?content-type=text/html;%20charset=utf-8#policy>  is used to convey
conditions on  the interaction between two Web service endpoints.  An
interaction involves one or more message exchanges between two
entities(requester application, provider service, Web infrastructure
component, etc). It is the responsiblity of assertion authors to define
the interaction scope of an assertion including any constraints on the
policy subjects to which the assertion may be attached and a clear
specification of the message(s) within that interaction scope to which
the assertion applies. 

Any entity in a Web services based system may expose a policy to convey
conditions under which it functions. Satisfying assertions in the policy
usually results in behavior that reflects these conditions. For example,
if two entities - requester and provider - expose their policies, a
requester might use the policy of the provider to decide whether or not
to use the service. A requester may choose any alternative since each is
a valid configuration for interaction with the service, but a requester
MUST choose only a single alternative for an interaction with a service
since each represents an alternative configuration. 

New text for the Guidelines Document:
An important part of defining assertions is documenting the interaction
scope of the assertions. There are several attachment mechanisms defined
in the WS-PolicyAttachement specification and assertion authors are
responsible for defining assertions and their policy subjects.  An
example of how this might be accomplished can be seen in the WS-Security
Policy specification Appendix A.  In this section the WS-SecurityPolicy
authors have classified the assertions according to their suggested
scope.