SecurityProposal - Old Wiki

[Talk:WS-SecurityProposal Talk Page]

Proposal for WSS4J(?) A Web services - WS-Fx Subproject

21 January 2003, Davanum Srinivas (dims@yahoo.com)

(0) rationale

WSS4J will provide an open source implementation of WS-Security using open source libraries like XML-Security. WSS4J will provide resources for building interoperable, trusted Web services using the proposed WS-Security standard. These libraries can be deployed to provide protocol support for both client and server applications. In a typical situation, a Web service will rely on these libraries to add secure messaging to whatever business logic the Web service supports. The libraries will support both Apache Axis handlers and JAX-RPC based handlers for signing and verification of SOAP messages using WS-Security. Another major focus would be interoperability of this implementation with Microsoft's .NET and IBM's ETTK. If there is enough interest and support, this project could later be promoted to a "regular" project under ws.apache.org.

(1) scope of the subproject

The purpose of this subproject is to create and maintain an implementation of the WS-Security standard (originally defined by IBM, MSFT and VRSN) and currently submitted to the OASIS WSSTC . This subproject might include an implementation of the yet-to-be-published JSR-183 Web Services Message Security APIs.

(2) identify the initial source from which the subproject is to be populated

We have a working prototype, which will be the starting point for the subproject. Code is in Axis' CVS.

(3) identify the Web services resources to be created

(3.1) mailing list(s) fx-wss4j-user

fx-wss4j-dev

(3.2) CVS repositories

ws-fx-wss4j

(3.3) Bugzilla

(4) identify the initial set of committers

Davanum Srinivas (dims@yahoo.com)

Chris Haddad (haddadc@apache.org)

Berin Lautenbach (berin@ozemail.com.au)