Comments from Wells Fargo

The following comments were posted by Wells Fargo (Dustin Sauter) in conjunction with their "yes" vote for the WSS specifications as an OASIS Standard. I believe no action is required on the first, but that the second should be added as an issue.

-----
Comment #1
Document: Web Services Security: SOAP Message Security (WS-Security)
Comment: Although general guidance is provided regarding XML security tokens, WSS 1.0 does not include a security assertion markup language (SAML) assertion/token profile. This is a serious omission given the critical role of SAML in so many federated identity solutions now being deployed. The omission has forced a number of commercial web services security products to create their own SAML-SOAP bindings (or use the one promoted by the Liberty Alliance) in order to meet customer demand.
Recommendation: Include a SAML 1.1 profile in the next WSS version as early as possible.

Comment #2
Document: Web Services Security: Username Token Profile
Comment: The UserName Token element (/wsse:UsernameToken) does not provide any means of qualifying the user name to indicate its type or domain. Optional sub-elements should be defined for type (with several types pre-defined including e-mail address and Microsoft SAM account name) and domain (DNS or NT/AD). Without such qualifiers a value can often be ambiguous or non-unique. For an example of XML type and domain qualifiers, refer to the Username schema in the security assertion markup language (SAML).
Recommendation: Add optional qualifiers to UsernameToken in the next WSS version.
-----

Hal