Re: [uddi-spec] Change request for discard transfer token API

From our perspective, as an implementor,
the lack of this API was an oversight as it means the only way that a token
can be invalidated is by expiry.  This could clearly be frustrating
for any user of this API set who forgets the opaqueToken or the more critical
case is where a party knows that the opaqueToken has been accidentally
seen by an unauthorized party and there is a need to invalidate it/

I would assume that other implementors
of this API set would draw the same conclusion that the lack of this mechanism
to discard tokens was an oversight.

Andrew Hately

IBM Austin

UDDI Development, Emerging Technologies 

Max Voskob <>

02/06/2003 02:19 AM

To



cc

Subject

Re: [uddi-spec] Change request
for discard transfer token API

Andrew,

 

I wonder what impact would this change have
on existing implementations of v.3? 

 

Are there any opinions from the vendors?

 

Cheers,

Max

 

----- Original Message ----- 

From: Andrew
Hately 

To: 

Sent: Thursday, February 06, 2003 6:55 PM

Subject: [uddi-spec] Change request for discard
transfer token API

Please review the attached CR-0024.  It covers a new API as there
is currently no means in the specification to invalidate a custrody/ownership
transfer token.  I view this as an oversight and potential security
issue should  a publisher lose track of the opaqueToken, there should
be a means to invalidate the token. 

Andrew Hately

IBM Austin

UDDI Development, Emerging Technologies