RE: D-AG006 Security

I agree that we need to agree on a standard SOAP security 
header extension includes capabilities to pass message 
integrity, authentication (credential exchange), confidentiality, 
trust model descriptions pertaining to web services message 
exchnages. 

W.r.t. SAML Assertion passing in SOAP messages, please
keep in mind that this may become a deliverable from
the OASIS SSTC that has recently had preliminary discussion
on a "WS-Security Binding for SAML Assertions". I believe,
this work could be done by the OASIS SSTC/SAML group
with some assistance, i.e., inputs from the WS-Arch's 
Security WG.

So, my proposal is that although we do not need to support
the ability to pass SAML Assertion as part of WS-Arch
Security WG, we should allow such passing capbilities in
the future keeping in mind the extensibility and interoperability
considerations in whatever standard SOAP security header 
extension model we arrive/decide to accept. I believe, for
example, currently this requirement is met by WS-Security. I 
will be happy to help in this direction.

thanks,
Zahid



-----Original Message-----
From: David Orchard [mailto:dorchard@bea.com]
Sent: Wednesday, May 08, 2002 2:36 PM
To: 'Anne Thomas Manes'; 'Mark Baker'; 'Darran Rolls'
Cc: 'Dilber, Ayse, ALASO'; 'Joseph Hui'; 'Edgar, Gerald'; 'Abbie
Barbir'; 'Allen Brown'; www-ws-arch@w3.org
Subject: RE: D-AG006 Security


Anne,

Could you live with doing message integrity, authentication (credential
exchange), confidentiality, trust model description as our first security
WG, with a plan to do the SAML/XACML artifact passing in a second version?
This seems to be a great 80/20 point for our first cut at requirements, and
is what I proposed a few (many?) emails ago.

Agreed that WS-Security may be a good start.  I'm not as worried about the
fact that it's not a standard, but more whether msft/ibm/verisign want to
suggest ws-security be used.  They may have IPR concerns with W3C IP policy.
I figure we get the security wg going, and then ask the WG to evaluate the
best solutions available for it's use.  If WS-Security isn't available, then
it may have to create something different, but hopefully that won't happen.

Cheers,
Dave

> -----Original Message-----
> From: www-ws-arch-request@w3.org [mailto:www-ws-arch-request@w3.org]On
> Behalf Of Anne Thomas Manes
> Sent: Wednesday, May 08, 2002 2:29 PM
> To: Mark Baker; Darran Rolls
> Cc: Anne Thomas Manes; David Orchard; Dilber, Ayse, ALASO; Joseph Hui;
> Edgar, Gerald; Abbie Barbir; Allen Brown; www-ws-arch@w3.org
> Subject: RE: D-AG006 Security
>
>
> Mark,
>
> The problem does not already have a solution. There are a number of
> standards that will be cited by this working group (XML Signature, XML
> Encryption, XKMS, SAML, XACML, etc.), but there's no standard
> that ties
> these standards to Web services and SOAP. We need a standard
> that defines
> how to sign all or part of a SOAP message, how to represent the XML
> signature in a SOAP message, how to obtain the keys necessary
> to decrypt the
> message, how to pass credentials in a SOAP message, and how
> to represent
> credential delegation in a SOAP message, etc., etc.. The best
> specification
> at our disposal is IBM/Microsoft/Verisign's WS-Security, but
> it isn't a
> standard. And it doesn't talk about how to pass SAML
> assertions or XACML
> policies in a SOAP message. It doesn't tie in XKMS. That's
> why we need a
> working group.
>
> Anne
>
> > -----Original Message-----
> > From: www-ws-arch-request@w3.org
> [mailto:www-ws-arch-request@w3.org]On
> > Behalf Of Mark Baker
> > Sent: Wednesday, May 08, 2002 4:26 PM
> > To: Darran Rolls
> > Cc: Mark Baker; Anne Thomas Manes; David Orchard; Dilber,
> Ayse, ALASO;
> > Joseph Hui; Edgar, Gerald; Abbie Barbir; Allen Brown;
> www-ws-arch@w3.org
> > Subject: Re: D-AG006 Security
> >
> >
> > On Wed, May 08, 2002 at 02:12:27PM -0500, Darran Rolls wrote:
> > > Sounds like a potential part of the charter wording
> "ensuring reuse of
> > > existing web service security standards..."
> >
> > That would be good too, in case we miss any.  But do we really want
> > to charter a WG only to find out that the problem already has a
> > solution?
> >
> > As I said on our very first call, I strongly believe that we don't
> > have as much work to do as most WG members might believe, at least
> > for some areas (not all).  I request the opportunity to demonstrate
> > this.
> >
> > MB
> > --
> > Mark Baker, Chief Science Officer, Planetfred, Inc.
> > Ottawa, Ontario, CANADA.      mbaker@planetfred.com
> > http://www.markbaker.ca   http://www.planetfred.com
> >
>
>