[Prev]

9.5.2 Web Service Provider (WSP) Questions

  1. Is your software TAS3 or ID-WSF 2.0 compliant?

    Is it certified? When, by whom: ____

  2. Have you determined

    1. SOAP endpoint URL: ___________________

    2. Human friendly name for your service: _______________

    3. Entity ID of your service (usually different from SOAP endpoint): __________________________

    4. Service Type URI of your service: _______________________

      The Service Type URI designates the type of service you provide. If you are providing a standardized service, the relevant standard should specify what the Service Type URI is for services of that type. All instances of the service use the same Service Type URI. Some well known Service Types:

      • "urn:ios:pds:2010-05:dst-2.1" - Internet of Subjects Personal Data Store

      • "urn:liberty:id-sis-dap:2006-08:dst-2.1" - Liberty ID Directory Access Protocol

      • "urn:liberty:id-sis-cb:2004-10" - Liberty Contact Book Service

      • "urn:liberty:id-sis-gl:2005-07" - Liberty Geolocation Service

      • "http://www.3gpp.org/ftp/Specs/archive/23_series/23.140/schema/REL-6-MM7-1-4"

        • ID-MM7 messaging service

      If you created the service yourself, you can pick the URI as you please, provided that it is globally unique. The usual convention is to use the namespace URI of the top level XML element of the service payload, i.e. the namespace of the first child element of SOAP Envelope Body element.

  3. Have you registered your service end point with a Discovery Service?

    Often the Discovery Service Provider or IdP provides a registration interface on the web. For example the TAS3 IdP provides "Circle of Trust Manager" at URL https://idp.tas3.eu/cot/

    If you do not plan to use discovery, what arrangements do you plan to use to locate your service? What arrangements do you plan to make for issuing security tokens for accessing your service?

  4. Have you successfully tested calling your web service from a third party web service client?

  5. Is your service an identity service, i.e. does it need to know something about the user?

  6. Does your service need persistent handle to user, e.g. to track something about the user (this question aims to establish whether your service needs to see persistent or transient NameID)?

  7. What types of credentials need to be presented upon web service call to authorize the call?

    This question aims at determining what credentials your callers will need to gather and present. We do not need full description of your policy.

  8. Do you need user to consent to anything and how do you arrange to obtain consent when needed? Do you plan to use the Interaction Service facility and/or handle Interaction Redirect?

  9. Are you capable to act as a Credentials and Privacy Negotiation server? If yes, please provide end point URL: ________________

  10. What security mechanisms are you willing and able to support

    1. (__) Bearer Token

    2. (__) Holder of Key Token

    3. (__) X509 signature without token

    4. (__) None

  11. Which Policy Enforcement Points do you implement?

    1. (__) Request Out PEP

    2. (__) Response In PEP

    3. (__) Other, please describe: _______________

  12. Which Policy Decision Point do you use?

    1. (__) Internal or built in

    2. (__) External XACML PDP

    3. (__) Other: _______________

  13. Which obligations or policy languages do you use or support? (tick all that apply)

    1. (__) SOL1

    2. (__) Permis

    3. (__) XACML2

    4. (__) Other, please specify: _____________

[Prev | Next]