Issue 48: Revised proposal

I have refined my 
initial proposal based on discussions at the F2F. To avoid the complexities of 
defining special rules for merging multiple binding assertions I propose that 
binding assertions should apply to either the endpoint or the operation, but not 
both. I've included some proposed text based on the ws-securitypolicy spec version http://www.oasis-open.org/apps/org/workgroup/ws-sx/download.php/16289/ws-securitypolicy-1.2-spec-ed-01-r04.pdf.

 

Section 7.4 lines 
1529 - 1530 should be changed from:

 

This assertion MUST 
apply to [Endpoint Policy Subject].

 

to:

 

This assertion 
SHOULD apply to [Endpoint Policy Subject]. This assertion MAY apply to 
[Operation Policy Subject]. If this assertion is 
applied to [Operation Policy Subject] it MUST NOT also be applied to [Endpoint 
Policy Subject].

 

Section 7.5 lines 
1606 - 1607 should be changed from:

 

This assertion MUST 
apply to [Endpoint Policy Subject].

 

to:

 

This assertion 
SHOULD apply to [Endpoint Policy Subject]. This assertion MAY apply to 
[Operation Policy Subject]. If this assertion is 
applied to [Operation Policy Subject] it MUST NOT also be applied to [Endpoint 
Policy Subject].

 

The following should 
be added after line 2201 in Appendix A:

 

A.2.2 Security 
Binding Assertions

 

SymmetricBindingAssertion            
(8.4)

AsymmetricBindingAssertion          
(8.5)