Advertisement

Collecting Requirements and Preferences

Bill Venners: Both the server and the client provide what constraints they want.

Bob Scheifler: Right. We've got these individual constraints, and now we want to collect them together. We also have this class called SecurityConstraints which is a way to collect constraints together. It collects constraints into two sets, one of which we call requirements and the other preferences. A requirement means this absolutely has to be done for the call. A preference means I'd like this to be done, but it doesn't have to be. An example of a preference might be anonymity. I would like to be anonymous, but if the server insists that I authenticate, that is OK.

Bill Venners: How would I express that with security constraints objects?

Bob Scheifler: If I prefer to be anonymous, I would put ClientAuthentication.NO as a preference. If I want confidentiality, I would put Confidentiality.YES as a preference.

Bill Venners: And if I don't say yes or no, I am saying I don't care.

Bob Scheifler: If you say nothing, you are saying you don't care. You get whatever you get. You get whatever the server decides is the right answer.