Web Services Security
Kerberos Token Profile 1.1
OASIS Approved Errata, 01 November 2006
OASIS identifier:
wss-v1.1-errata-os-KerberosTokenProfile
Location:
http://docs.oasis-open.org/wss/v1.1
Technical Committee:
Web Service Security (WSS)
Chairs:
Kelvin Lawrence, IBM
Chris Kaler, Microsoft
Editors:
Anthony Nadalin, IBM
Abstract:
This document describes how to use Kerberos [Kerb] tickets (specifically the AP-REQ packet) with the WSS: SOAP Message Security [WSS] specification.
Status:
This is an OASIS Draft listing errata for the OASIS Standard produced by the Web
Services Security Technical Committee. The standard was approved by the OASIS
membership on 1 February 2006.
Technical Committee members should send comments on this specification to the technical Committee’s email list. Others should send comments to the Technical Committee by using the “Send A Comment” button on the Technical Committee’s web page at www.oasisopen.org/committees/wss.
For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the Security Services TC web page (http://www.oasis-pen.org/who/intellectualproperty.shtml).
Notices
OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be vailable; neither does it represent that it has made any effort to identify any such rights. Information on
OASIS's procedures with respect to rights in OASIS specifications can be found at the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification, can be obtained from the OASIS Executive Director. OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
Copyright (C) OASIS Open 2006. All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications, in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
OASIS has been notified of intellectual property rights claimed in regard to some or all of the contents of this specification. For more information consult the online list of claimed rights.
This section is non-normative.
Table of Contents
2 Typographical/Editorial Errors
2.1 Section 3.3 Identifying and Referencing
Kerberos Tokens
The following issues related to the Web Services Security
Kerberos Token Profile 1.1 listed in the Web Services
Committee Issues List [WSS-Issues] have been addressed in this document:
|
Description |
|
|
456 |
Correct Examples to have correct TokenType |
2.1 Section 3.3 Identifying and Referencing Kerberos Tokens
Line 229 added the correct TokenType to the example.
Line 255 added the correct TokenType to the example.
None
The following are normative references
[2119] S. Bradner, "Key words for use in RFCs to
Indicate Requirement Levels," RFC 2119,
[Kerb] J. Kohl and C. Neuman, "The Kerberos Network
Authentication Service (V5)," RFC 1510, September 1993, http://www.ietf.org/rfc/rfc1510.txt
.
[KEYWORDS] S.
Bradner, "Key words for use in RFCs to Indicate Requirement Levels," RFC
2119,
[S11] W3C Note, "SOAP:
Simple Object Access Protocol 1.1," 08 May 2000.
[S12] W3C Recommendation, "SOAP
Version 1.2 Part 1: Messaging Framework", 23 June 2003.
[URI] T. Berners-Lee, R. Fielding,
L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax,"
RFC 3986, MIT/LCS, Day Software, Adobe Systems, January 2005.
[WSS] A. Nadalin et al., Web Services Security: SOAP Message
Security 1.1 (WS-Security 2004), OASIS Standard, http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.1.pdf.
[1964] J.
Linn , The Kerberos Version 5 GSS-API Mechanism, RFC 1964, June 1996.
[4121] L,
Zhu, K. Jaganathan, S. Hartman, The Kerberos Version 5 Generic Security Service
Application Program Interface (GSS-API) Mechanism: Version 2, RFC 4121, July
2005.
The following are non-normative references
[ISG] Informational RFC 2828, "Internet
Security Glossary," May 2000.
[XML-ns] W3C Recommendation, "Namespaces in XML," 14 January 1999.
[DSIG] D.
Current Contributors:
|
Michael |
Hu |
Actional |
|
Maneesh |
Sahu |
Actional |
|
Duane |
Nickull |
Adobe Systems |
|
Gene |
Thurston |
AmberPoint |
|
Frank |
Siebenlist |
|
|
Hal |
Lockhart |
BEA Systems |
|
Denis |
Pilipchuk |
BEA Systems |
|
Corinna |
Witt |
BEA Systems |
|
Steve |
|
BMC Software |
|
Rich |
Levinson |
Computer Associates |
|
Thomas |
DeMartini |
ContentGuard |
|
Merlin |
Hughes |
Cybertrust |
|
Dale |
Moberg |
Cyclone Commerce |
|
Rich |
Salz |
Datapower |
|
Sam |
Wei |
EMC |
|
Dana S. |
Kaufman |
Forum Systems |
|
Toshihiro |
Nishimura |
Fujitsu |
|
Kefeng |
Chen |
GeoTrust |
|
|
Reid |
Hewlett-Packard |
|
Kojiro |
Nakayama |
|
|
Paula |
Austel |
IBM |
|
Derek |
Fu |
IBM |
|
Maryann |
Hondo |
IBM |
|
Kelvin |
|
IBM |
|
Michael |
McIntosh |
IBM |
|
Anthony |
Nadalin |
IBM |
|
Nataraj |
Nagaratnam |
IBM |
|
Bruce |
Rich |
IBM |
|
Ron |
Williams |
IBM |
|
Don |
Flinn |
Individual |
|
Kate |
Cherry |
Lockheed Martin |
|
Paul |
Cotton |
Microsoft |
|
Vijay |
Gajjala |
Microsoft |
|
Martin |
Gudgin |
Microsoft |
|
Chris |
Kaler |
Microsoft |
|
|
Hirsch |
Nokia |
|
Abbie |
Barbir |
Nortel |
|
Prateek |
Mishra |
Oracle |
|
Vamsi |
Motukuru |
Oracle |
|
Ramana |
Turlapi |
Oracle |
|
Ben |
|
RSA Security |
|
Rob |
Philpott |
RSA Security |
|
Blake |
Dournaee |
Sarvega |
|
Sundeep |
Peechu |
Sarvega |
|
Coumara |
Radja |
Sarvega |
|
Pete |
Wenzel |
SeeBeyond |
|
Manveen |
Kaur |
Sun Microsystems |
|
Ronald |
Monzillo |
Sun Microsystems |
|
Jan |
Alexander |
Systinet |
|
Symon |
Chang |
TIBCO Software |
|
John |
Weiland |
US Navy |
|
Hans |
Granqvist |
VeriSign |
|
Phillip |
Hallam-Baker |
VeriSign |
|
Hemma |
Prafullchandra |
VeriSign |
Previous Contributors:
|
Peter |
Dapkus |
BEA |
|
Guillermo |
Lao |
ContentGuard |
|
TJ |
Pannu |
ContentGuard |
|
Xin |
Wang |
ContentGuard |
|
Shawn |
Sharp |
Cyclone Commerce |
|
Ganesh |
Vaideeswaran |
Documentum |
|
Tim |
Moses |
Entrust |
|
|
Canales-Valenzuela |
Ericsson |
|
Tom |
Rutt |
Fujitsu |
|
Yutaka |
Kudo |
|
|
Jason |
Rouault |
HP |
|
Bob |
Blakley |
IBM |
|
Joel |
Farrell |
IBM |
|
Satoshi |
Hada |
IBM |
|
Hiroshi |
Maruyama |
IBM |
|
David |
Melgar |
IBM |
|
|
Tamura |
IBM |
|
|
Vicknair |
IBM |
|
Phil |
|
Individual |
|
Mark |
Hayes |
Individual |
|
John |
Hughes |
Individual |
|
Peter |
Rostin |
Individual |
|
Davanum |
Srinivas |
Individual |
|
Bob |
Morgan |
Individual/Internet2 |
|
Bob |
Atkinson |
Microsoft |
|
Keith |
Ballinger |
Microsoft |
|
Allen |
Brown |
Microsoft |
|
Giovanni |
Della-Libera |
Microsoft |
|
Alan |
Geller |
Microsoft |
|
Johannes |
Klein |
Microsoft |
|
Scott |
Konersmann |
Microsoft |
|
Chris |
Kurt |
Microsoft |
|
Brian |
LaMacchia |
Microsoft |
|
Paul |
Leach |
Microsoft |
|
John |
Manferdelli |
Microsoft |
|
John |
Shewchuk |
Microsoft |
|
Dan |
Simon |
Microsoft |
|
Hervey |
|
Microsoft |
|
Jeff |
Hodges |
Neustar |
|
Senthil |
Sengodan |
Nokia |
|
Lloyd |
Burch |
Novell |
|
Ed |
Reed |
Novell |
|
Charles |
Knouse |
Oblix |
|
Vipin |
|
Oracle |
|
Jerry |
Schwarz |
Oracle |
|
Eric |
Gravengaard |
Reactivity |
|
Andrew |
Nash |
Reactivity |
|
Stuart |
King |
Reed Elsevier |
|
Martijn |
de Boer |
SAP |
|
Jonathan |
Tourzan |
Sony |
|
Yassir |
Elley |
Sun |
|
Michael |
Nguyen |
The IDA of |
|
Don |
|
TIBCO |
|
Morten |
Jorgensen |
Vordel |
|
Rev |
Date |
By Whom |
What |
|
01 |
08-25-2006 |
Anthony Nadalin |
Issue 456 |