OTP and the "charter" discussion.

Okay – I’ll start 

 

First, IMO, the claim that the proposal
for the TC to take up a work item on an additional token profile is out of
scope of the charter is wrong.

 

Before responding, I STRONGLY recommend
that people go back and read the following carefully:

a)       the current TC charter (http://www.oasis-open.org/committees/wss/charter.php)

b)       the OASIS TC process (http://www.oasis-open.org/committees/process.php)

 

Here is the paragraph in the WSS charter that
explicitly defines the SCOPE of the TC:

------------------------------------------

The scope
of the Web Services Security Technical Committee is the support of security
mechanisms in the following areas:

 
Using XML signature to provide SOAP message
     integrity for Web services

 
Using XML encryption to provide SOAP message
     confidentiality for Web services

 
Attaching and/or referencing security tokens in
     headers of SOAP messages

 
Carrying security information for potentially
     multiple, designated actors

 
Associating signatures with security tokens

------------------------------------------

So when we talk about something being IN
or OUT of scope, THIS is the definition that applies to our TC.

 

Now, I believe this scope can only be read
two ways. Since this scope says nothing about the TC producing ANY token
profiles, we can either define any number of token profiles that support the
bullets defined in the scope, or we’ve already violated the scope of the
charter in producing the various token profiles we’ve already built. 

 

The charter then lists an **initial** set
of deliverables that lists as:

 
The "core"specification (final name
     TBD)

 
A SAML profile

 
An XrML profile

 
A Kerberos profile

 
An X.509 profile

 That list did not EXPLICITLY include
a Username/Password Token Profile, a REL Token Profile, or a SwA Token Profile,
which the TC produced.  Sure, the Username/Password Token was in the
original “core” submission, but it wasn’t a
deliverable.  Support for attachments was tangentially mentioned in an
input document, but it wasn’t a deliverable.  The REL Profile is NOT
the same as an XrML Token Profile.

 

And I’d like to call attention to
XCBF.  Do folks remember this work item we took up at one point?  The
minutes from the Dec-2002 Baltimore F2F discuss it, but Kelvin summarized in a
follow-up email ([wss] XCBF profile). At that time, “”3. It was
agreed that this was another profile that should be worked on”.

 

Work was done on this profile for about a
year IIRC.  The point is that the TC decided it was appropriate to work on
it and it was started.  I believe the same may have been true about the
proposal for the “minimalist” profile.  I didn’t hear anyone
yelling about that one being out of scope at the time.  It was dropped not
because of a scope issue, but because of a prioritization issue/lack of
interest.

 

So the argument that taking up an OTP
Token profile is out of scope is, IMO, way off base.

 

Rob Philpott

Senior Consulting Engineer

RSA Security Inc.

Tel: 781-515-7115

Mobile:
617-510-0893

Fax: 781-515-7020

Email: 

I-name:  =Rob.Philpott

From: Kelvin Lawrence
[mailto:] 

Sent: Tuesday, September 20, 2005
12:20 PM

To: 

Subject: [wss] OTP Discussion

 

We need to find a way to close on the OTP Profile
proposal. We have not had much list traffic on this in the past several weeks
but today on the call there were clearly several very strong opinions raised. I
apologise that we ran out of time today. At the end of the call we tried to
start an e-Vote on the proposal as posted but there were objections to that
e-Vote also. Therefore, we really need to discuss this here on the list in the
next few days so that we can get a decision for the folks that have introduced
the proposal no later than the next call. Please would people use this e-mail
to start that discussion.  Please raise any objections you have here or
likewise express support here.  This list is not in anyway a binding vote
but at least we can get the discussion moving. It's hard to close tings like
this when there is no list traffic prior to the calls. At the next meeting we
need to have a vote to resolve this proposal one way or the other. Please come
to the next meeting prepared to vote. Also, if people have proposed wording for
the vote (there was a lot of discussion around that today also) please post it
and debate it here. It would be nice if we could have a draft of the text for a
motion ready before the next call as a result of e-mail discussions here.
Thanks. 

Cheers

Kelvin