Hi Mike and Pete, Thanks for your efforts toward a spec! Michael Behrens wrote:
Could someone please verify the intent and meaning of "AA Instance" relative to web services.... Pete and I were drafting some content for the security section and ended up in a discussion on how to enforce different security policies for different AA Instances. This might also pertain to transport protocols as well since some transports are more secure than others and that might be specified somehow in the security policy.
Here is my understanding on AA instance: AA instance is a form of AA in a ACS repository and is a Web service resource. It could be created elsewhere, but it is most reasonable to create inside the ACS repository which is a constituting a part of an implementation of the system. Is this a wrong understanding?
ACS currently returns an EPR (or WS-Name perhaps) as a result of a create operation. That EPR could technically be anywhere on the network, although most likely it would be on the same box as the ACS service. Is it expected that each AA Instance is a separate web service or would it be a part of and managed by the ACS Web Service?
If I understand points here correctly, this is not a problem though it may need to be carefully taken into considered. Existig standards may not prohibit the EPRs (or resource) from being created outside of the ACS, and ACS spec. may or may not, but, I belive, we can specify the security or transport to be organized to be efficient, rather than accepting whatever possible. The transport to be used must be defined, supported and announced by the implementation of the ACS repository. The security policy to be used would be decided under the system level design, but still to be supported and announced by the implementation. These may vary among implementations. If one was to move an AA in between, basically those must have common security policy and transport type in agreement. Someone can implement a relay or a router converting or adapting things, but it will involve more advanced considerations in my opinion. We can discuss this more in detail. However, I propose we put our efforts in an incremental way, from basics to advanced. As they say Rome was not built in a day:-) -Keisuke