RE: [security-services] OASIS SSTC letter to authors of WS-Security(draft)

Is it 
our intent to move forward with the use of WS-Security for the SAML SOAP profile 
even if it is never taken over by a standards body? If the answer is no then we 
should probably state that directly by adding a sentence of the form... 

 

"The 
OASIS Security Services Technical Committee feels that movement towards open 
standardization of WS-Security is a requirement for it to be incorporated into 
the upcoming SOAP profile for SAML."

 

If the 
answer is yes, then I'm concerned about the stability and adoption of it 
and the negative effect that could have on interoperability for the SAML SOAP 
profile.

 

-Allen

  
 

  
 -----Original 
  Message-----
From: Mishra, Prateek 
  [mailto:]
Sent: Friday, June 14, 2002 9:05 
  AM
To: ''; ''; 
  ''
Subject: [security-services] OASIS SSTC letter 
  to authors of WS-Security (draft)

  

  
Folks,

  
 

  
this is the proposed text 
  of the message we plan to send to WS-Security authors.
I am circulating it 
  to the list as (1) we voted on the contents on the message, not
its exact 
  form, so here is a last chance to object, (2) neither jeff nor joe was on 
  the
call, so here is a chance for them to object.

  
 

  
Bob M. and 
  Prateek

  
-----------------------------------------------------------------------------------------------------

  
 

  
 

  
In April 2002, Microsoft and IBM jointly published a 
  document entitled

  
"Security in a Web Services World: A Proposed Architecture 
  and

  
Roadmap" 
  (http://www.verisign.com/wss/architectureRoadmap.pdf), and

  
Microsoft, IBM, and VeriSign published a companion 
  specification, "Web

  
Services Security (WS-Security) Version 1.0"

  
(http://www.verisign.com/wss/wss.pdf). The OASIS Security 
  Services

  
Technical Committee, which has produced the Security 
  Assertion Markup

  
Language (SAML) specification, considers these documents 
  to be

  
important contributions to web services security. The SSTC 
  views the

  
WS-Security technical specification as complementary to 
  SAML, and

  
intends to use WS-Security in specifying the use of SAML 
  for adding

  
security features to SOAP messages.

  
The SSTC urges the authors of the WS-Security 
  specification to submit

  
the specification to an open standards body for further 
  development,

  
standardization, and building of industry consensus. In 
  particular,

  
intellectual property rights issues regarding this 
  specification and

  
its technologies should be addressed to enable broad use 
  of this work.