These are the final results of the JSR Review Ballot for JSR #196. The Executive Committee for SE/EE has approved this ballot.

JSR196

StageJSR Review Ballot

Ballot durationOct 22, 2002 to Nov 4, 2002

Votes

SE/EE

Apache Software Foundation

Apple Computer, Inc.

BEA Systems

Borland Software Corporation

Caldera Systems

Cisco Systems

Compaq Computer Corporation

Fujitsu Limited

Hewlett-Packard

IBM

Lea, Doug

Macromedia, Inc.

Nokia Networks

Oracle

Progress Software

Sun Microsystems, Inc.

Vote Log

SE/EE

On 2002-10-29 Progress Software voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-10-28 Cisco Systems voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-10-22 Sun Microsystems, Inc. voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-01 Lea, Doug voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-02 Nokia Networks voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 IBM voted No with the following comment:
Subset of fuller explanatory note sent to the EC and Spec Lead. Our concerns fall into three areas:

1) Potential for adding the Liberty Bindings/Profiles into J2EE.

We do understand that Liberty is only one of many potential input specifications into this JSR. We
feel that such a decision may have enormous implications and it is too big to be left to an individual expert group to make. The significance is such that the EC should give some direction, as a subset of major J2EE licensees support the WS-Security approach, and potentially a subset support the Liberty Alliance. One solution could be for the JSR to only deal with defining a provider interface for the establishment (process of authentication i.e validating authentication data like userid/password, or tokens) of a authenticated identity. Therefore it would be authentication mechanism agnostic.

2) Over-broad scope for this JSR.

   a)  The 1st major bullet has a sub bullet that is out of scope "the  binding of received transport specific security credentials to    authentication modules" as this should be "the binding of received transport mechanism to     authentication modules". We feel that we
   should not mandate semantics in this JSR.
   b)  The 2nd major bullet opens up the scope:
      - "validating mechanism specific credentials received from container
transport mechanisms": * This is out of scope and should be left up to the modules.
      - The following bullets also talk about "run-as" and this JSR is performing  identity and credential mapping / translation.
* This is out of scope for a "Authentication Service Provider Interface" JSR, this should be done in a separate JSR.
      - "creating transport specific responses as necessary to implement authentication mechanisms "
* This is also out of scope as this JSR should not be defining any new transport specific mechanisms.

3) Other Clarifications; detail sent to the EC

------------------------------------------------------------------------------
On 2002-11-04 Macromedia, Inc. voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 Caldera Systems voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 Apple Computer, Inc. voted No with the following comment:
Apple votes "no" for this JSR and supports IBM's comments!
------------------------------------------------------------------------------
On 2002-11-04 Hewlett-Packard voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 Oracle voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 Fujitsu Limited voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 Borland Software Corporation voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 Apache Software Foundation voted Yes with no comment.
------------------------------------------------------------------------------
On 2002-11-04 BEA Systems voted Yes with the following comment:
IBM's points are well taken, but we believe that this JSR should progress.  The EC should indeed pay close attention to the ramifications of decisions made by the Expert Group, and should take the opportunity for thorough review at Community Draft.

We expect that the Expert Group will clarify and narrow its scope as they work, considering the scrutiny that this JSR will encounter.
------------------------------------------------------------------------------