Subject: Re: Comparison of ICAP and SOAP

From: Mark Nottingham <[email-masked]>
Date: Tue, 10 Jul 2001 10:34:24 -0700

Wayne,

On Tue, Jul 10, 2001 at 10:13:21AM -0700, Carr, Wayne wrote:
> SOAP intermediaries don't have to be explicitly targetted. 
> Anything along the way could read and act on a soap message.  If
> you do use the soap actor attribute, how you use it is very
> flexible.  You can ask the next node to act on it.  You can use a
> uri that indicates a specific node or you can use a URI that
> indicates some action you want and you don't care who does it.

What you describe isn't a SOAP intermediary by the WG's definition -
see [1]. Of course the actor which nominiates the intermediary
doesn't have to be tied to the network identity of that node; my
point was that there must be an explicit targetting of the block for
a SOAP intermediary to be able to process it.

As I noted, other devices may choose to fiddle with SOAP messages (as
with any other payload); however, they're not interposed by SOAP.
This 'failing' is perhaps why one of the first SOAP Modules submitted
was for XML digital signatures [2], and it's more than likely that it
will be joined by XML Encryption ASAP.

Cheers,

[1]  http://www.w3.org/TR/2001/WD-soap12-20010709/#_Toc478382082
[2]  http://www.w3.org/TR/SOAP-dsig/

-- 
Mark Nottingham, Research Scientist
Akamai Technologies (San Mateo, CA USA)

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 10 Jul 2001 18:22:39 +0100 (BST)

On Tue, 10 Jul 2001, Carr, Wayne wrote:

> SOAP intermediaries don't have to be explicitly targetted.  Anything along
> the way could read and act on a soap message.  

There's SOAP's first problem.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: "Carr, Wayne" <[email-masked]>
Date: Tue, 10 Jul 2001 10:13:21 -0700

SOAP intermediaries don't have to be explicitly targetted.  Anything along
the way could read and act on a soap message.  If you do use the soap actor
attribute, how you use it is very flexible.  You can ask the next node to
act on it.  You can use a uri that indicates a specific node or you can use
a URI that indicates some action you want and you don't care who does it.  

From http://www.w3.org/TR/2001/WD-soap12-20010709/#_Toc478383602
"While the purpose of a SOAP actor name is to identify a SOAP node, there
are no routing or message exchange semantics associated with the SOAP actor
name. For example, SOAP Actors MAY be named with a URI useable to route SOAP
messages to an appropriate SOAP node. Conversely, it is also appropriate to
use SOAP actor roles with names that are related more indirectly to message
routing (e.g. "http://example.org/banking/anyAccountMgr") or which are
unrelated to routing (e.g. a URI meant to identify "all cache management
software"; such a header might be used, for example, to carry an indication
to any concerned software that the containing SOAP message is idempotent,
and can safely be cached and replayed.)"

> -----Original Message-----
> From: Mark Nottingham [mailto:[email-masked]]
> Sent: Tuesday, July 10, 2001 9:10 AM
> To: Brian E Carpenter
> Cc: Keith Moore; Tomlinson, Gary; Randy Bush; Lloyd Wood; John Martin;
> [email-masked]; [email-masked]
> Subject: Re: Comparison of ICAP and SOAP
> 
> 
> 
> 
> SOAP intermediaries must be explicitly targetted by the message
> (using the 'actor' attribute). In this respect, they are completely
> unlike the OPES model.
> 
> Of course, other kinds of intermediaries (HTTP, etc.; they may even
> be interposed with the SOAP intermediary) may make other decisions
> about messages and what to do to them.
> 
> 
> On Tue, Jul 10, 2001 at 09:57:50AM -0500, Brian E Carpenter wrote:
> > Web Services intermediaries will certainly exist and use 
> SOAP; whether
> > they are exactly like the current OPES model is still 
> unclear. Indeed
> > the security/integrity problems have to be solved, and this is more
> > fundamental than debating the ICAP hammer and the SOAP screwdriver.
> > 
> >   Brian
> > 
> > Keith Moore wrote:
> > > 
> > > >  Several of us have long believed that with an OPES 
> framework, multiple
> > > > existing remote procedure call protocols including iCAP 
> and SOAP can
> > > > be added to an authenticated and authorized 
> intermediate proxy model.
> > > 
> > > so by adding components that can alter data in transit, 
> you're going
> > > to increase the level of integrity?    right.
> > > 
> > > Keith
> > 
> 
> --