> I sort of like the suggestion that a user explicitly state that they would
> like to engage with a specific profile and its associated implicit
> parameters, aka policy, aka WS-Policy, aka URN, aka WSDL URL, etc ... They
> can not later deny that they consciously were aware of the "terms of
> engagement" with the DSS Service.
Yes, totally agree. I favor putting a URN in the request packet. This
is, for example, what XKMS does.
/r$
--
Rich Salz Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
