WS-* Web Services Speci?¬?cations: The Rei?¬?cation of the Identity Metasystem 151
In the generic case, the reason for which C has to go to the STS
goes beyond the sheer need of changing token format. Usually S
does not trust C, so C needs to be endorsed by somebody who S
trusts. Remember our ever-present wine seller example. In this
case, the web service S is the wine seller, and the client C is the
buyer. The claim requested by S is the age, and the picture ID
that the buyer shows to the wine seller is the security token. Just
as the wine seller trusts the age written on the picture ID because
it is government issued, S trusts the content of the claim in
the SAML token because the latter is coming from the STS. The
analogy is not a perfect match. If it were, in the of?¬‚ine world it
would mean that your driver??™s license (or any other ID document)
would always be expired, and you??™d have to get one
freshly issued every time you need to show it to somebody. In
that case, you would need to contact your department of motor
vehicles on-the-?¬‚y, and they would want to verify your identity
(maybe checking your passport) before issuing you a new license.
As you probably have already discerned, the department
of motor vehicles plays the role of the STS, and your passport
Kerb
SAML
SAML
SAML
RST
?
RSTR
STS
C
S
Figure 2-6 WS-Trust in action.
Pages:
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261