SAML

Security Assertion Markup Language is an XML framework for exchanging security information over the Internet and enables disparate security systems to interoperate using a single security mechanism. SAML resides within a system's security mechanisms to enable exchange of identity and entitlement with other services. It defines the structure of the documents that transport security information among services.

SAML has the following components:

  • Assertions and request/response protocols

  • Bindings (the SOAP-over-HTTP method of transporting SAML requests and responses)

  • Profiles (for embedding and extracting SAML assertions in a framework or protocol)

  • Security considerations while using SAML (highly recommended reading)

  • Conformance guidelines and a test suite

  • Use cases and requirements[3]

    [3] Byous, Jon. Single Sign-On Simplicity with SAML: An Overview of Single Sign-on Capabilities Based on the Security Assertions Markup Language (SAML) Specification. 2002.

SAML provides technology that supports a single sign-on using XML. Using SAML authentication, you can sign-on and receive a SAML authentication assertion as a response to the request. This authentication assertion is simple XML and is transportable using SOAP.

XHTML

Extensible HTML (XHTML) provides a compromise between traditional HTML and XML. Now in a working draft at the W3C, XHTML is thought by its creators to be the ultimate replacement for HTML. XHTML leverages XML for structure and extensibility, enabling authors to use language subsets.

Although it's too soon to tell if XHTML will set the Web world on fire, it does offer a nice compromise between the power of XML and the existing features and functions of HTML. In addition, it brings structure to HTML, which has been drifting off in many directions for some time now. This will be a big deal for site builders, so it is important to understand this new technology and its impact on your site. I recommend that you also visit www.w3c.org/TR/xhtml1 for further developments.

Why Another Standard?

With XML out there, along with DHTML, SSL, XSL, and other cryptic acronyms, why do we need yet another Web-born standard?

There are two reasons:

First, XHTML is built from the ground up as an extensible language. The extensibility depends on the XML requirement that the XHTML-compliant Web documents be well formed (conform to the standard, basically). This greatly eases the development and integration of new elements within the document.

Second, XHTML is built from the ground up for portability, and XHTML can run within a number of containers, including devices such as personal digital assistants (PDAs) and WebTV. Let's face it, folks, HTML is a mess, and portability across browsers is difficult enough, without considering portability across static devices.

From a practical point of view, site builders who already understand HTML won't have much of a learning process to understand XHTML. What's more, there is already a base of authoring tools that make creation of XHTML documents simple. (I'll talk about those below.)

One of the things I like most about XHTML is that it requires well-formed documents and won't accept sloppy coding. For example, you are required to stick to lowercase-only coding, and you have to use end tags no exceptions. You have to validate your code against three Document Type Definitions (DTDs) defined by the W3C. DTDs, as you may remember, are collections of XML declarations that define a legal structure. We got away with sloppy coding for years because browsers have been too forgiving, but to support portability, these constraints must exist.

The specification provides a definition of strictly conforming XHTML documents using the XHTML namespace found at www.w3c.org. A strictly conforming XHTML document is a document that supports only the facilities described in the XHMTL specification. This means it must meet the following criteria:

First, the XHTML document must validate against the XHTML DTD, as mentioned above. Second, the root element of the document must be <html>. Third, the root elements of the document must designate the XTHML 1.0 namespace. Finally, you must include a DOCTYPE declaration in the document before the root elements. The public identifier included in the DOCTYPE declaration must refer to the XHTML DTDs.

For example:

 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"   "http://www.w3.org/TR/xhtml1/DTD/strict.dtd"> <html xmlns="http://www.w3.org/TR/xhtml1">  <head>   <title>Title Goes Here</title>  </head>  <body>   <p>Moved to <a href="http://xxxx.org/">xxxx.org   </a>.</p> </body> </html> 

When using XHTML, all elements must either have closing tags or be written in a special form, and all the elements must nest. Although overlapping is illegal with traditional SGML, it works with most SGML-based browsers that have chosen to ignore the rules.

For example, here is an example of a correctly nested element:

 <p>it's raining today <em>paragraph</em>.</p> 

Here is an example of overlapping elements.

 <p>it's raining today <em>paragraph.</p/em> 



Next Generation Application Integration(c) From Simple Information to Web Services
Next Generation Application Integration: From Simple Information to Web Services
ISBN: 0201844567
EAN: 2147483647
Year: 2005
Pages: 220

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net