Subject: RE: Comparison of ICAP and SOAP

From: "Tomlinson, Gary" <[email-masked]>
Date: Mon, 9 Jul 2001 22:17:30 -0700

On Monday, July 09, 2001 @9:12 PM Randy Bush wrote:

>>> I would add one clarification. SOAP encompasses much 
>>> broader scope that iCAP. SOAP is a whole architecture for messaging;
>> *architecture*?
>> it's a simple, lightweight instance of XML use along with a bunch of
>> kludged http headers.
>
>hey, don't knock it.  where else can you get remote procedure call,
>intermediate proxies which can remove and add message/command content,
>and not one whiff of authentication or authorization to pollute it
>with silly security ideas?
>
>can you say loaded fusion bomb?

Agree on the lack of authentication and authorization issues, these are 2 
items OPES is proposing to address. Several of us have long believed that
with
an OPES framework, multiple existing remote procedure call protocols
including
iCAP and SOAP can be added to an authenticated and authorized intermediate
proxy model.  By applying AAA in the form of an Admin Server, where
authorization is classically a policy model with PRC modules and the like
and
authentication is capable of  using protocols such as SSL, we have the
opportunity to disarm the bomb.

Several of us have been preparing drafts for discussion that begin to
address
these issues.

Gary

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 9 Jul 2001 23:42:00 -0700 (PDT)

> with an OPES framework, multiple existing remote procedure call
> protocols including iCAP and SOAP can be added to an authenticated and
> authorized intermediate proxy model.  By applying AAA in the form of an
> Admin Server, where authorization is classically a policy model with PRC
> modules and the like and authentication is capable of  using protocols
> such as SSL, we have the opportunity to disarm the bomb.

The missing feature is security between endpoints. You cannot get there by
adding AAA, admin servers, and yet more proxies. That is like trying to
prevent your car from being stolen by loading it up with several tons of
steel. Why not just lock the door? Object based security techniques ought
to do the job.

---

From: Keith Moore <[email-masked]>
Date: Tue, 10 Jul 2001 09:12:25 -0400

>  Several of us have long believed that with an OPES framework, multiple 
> existing remote procedure call protocols including iCAP and SOAP can 
> be added to an authenticated and authorized intermediate proxy model.

so by adding components that can alter data in transit, you're going 
to increase the level of integrity?    right.

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 10 Jul 2001 09:57:50 -0500

Web Services intermediaries will certainly exist and use SOAP; whether
they are exactly like the current OPES model is still unclear. Indeed
the security/integrity problems have to be solved, and this is more
fundamental than debating the ICAP hammer and the SOAP screwdriver.

  Brian

---

From: "Jim Fleming" <[email-masked]>
Date: Tue, 10 Jul 2001 10:38:12 -0500

Can you describe the "architecture" of the Internet you are referring to ?

Jim Fleming
http://www.unir.com/images/architech.gif

----- Original Message -----
From: "Brian E Carpenter" <[email-masked]>
To: "Keith Moore" <[email-masked]>
Cc: "Tomlinson, Gary" <[email-masked]>; "Randy Bush"
<[email-masked]>; "Lloyd Wood" <[email-masked]>; "John Martin"
<[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Tuesday, July 10, 2001 9:57 AM
Subject: Re: Comparison of ICAP and SOAP

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 10 Jul 2001 09:09:30 -0700

SOAP intermediaries must be explicitly targetted by the message
(using the 'actor' attribute). In this respect, they are completely
unlike the OPES model.

Of course, other kinds of intermediaries (HTTP, etc.; they may even
be interposed with the SOAP intermediary) may make other decisions
about messages and what to do to them.

-- 
Mark Nottingham, Research Scientist
Akamai Technologies (San Mateo, CA USA)

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 10 Jul 2001 17:17:07 +0100 (BST)

On Tue, 10 Jul 2001, Mark Nottingham wrote:

> (using the 'actor' attribute). 

All actors are bad actors.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: "Michael W. Condry" <[email-masked]>
Date: Tue, 10 Jul 2001 09:39:17 -0700

>(using the 'actor' attribute). In this respect, they are completely

The charter says the intermediaries are explicitly addressed. I am
a bit confused by your comment.

> > > to increase the level of integrity?    right.

Michael W. Condry
Director,  Network Edge Technology

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 10 Jul 2001 09:59:45 -0700

> a bit confused by your comment.

Does the charter state that they will be targetted by an in-message
mechanism (e.g., HTTP response header, arbitrary message content,
etc.)?

---

From: "Michael W. Condry" <[email-masked]>
Date: Tue, 10 Jul 2001 10:54:50 -0700

>mechanism (e.g., HTTP response header, arbitrary message content,

No it is not that restricted.

Michael W. Condry