OASIS members have published a draft charter for a proposed "Cross-Enterprise Security and Privacy Authorization (XSPA) Technical Committee" healthcare enterprises. The XSPA profile would provide a mechanism to exchange privacy policies, consent directives and authorizations in an interoperable manner. The need for an XSPA profile has been identified by the security and privacy working group of the Healthcare Information Technology Standards Panel (HITSP).

Organizers of the 2008 ACM Workshop on Secure Web Services (SWS) have issued a call for participation in the workshop, to be held 31 October 2008 in Fairfax, VA, USA in conjunction with the Fifteenth ACM Conference on Computer and Communications Security (CCS-15). The SWS workshop will explore basic security protocols for Web Services, such as XML Security, the WS-* series of proposals, SAML, and XACML. The workshop will provide a forum for presenting research results, practical experiences, and innovative ideas in web services security.

The State Services Commission has completed a four-month project with the Microsoft Innovation Centre and Datacom, aimed at integrating its new ‘ Shared Services’ element of the Government’s Authentication Programme with Microsoft’s Windows Cardspace. This project was one of the first in the world to attempt to integrate Windows Cardspace with the SAML standard.

Read the full article at Geekzone .

The UK Access Management Federation has reported rapid growth as the deadline approaches for the further education (FE) and higher education (HE) sectors and the publishing industry to decide on future access to learning materials. Education institutions and publishers have until July 31st to join the Federation. Joining the Federation offers members the option to transition to new open standard access management systems that are SAML compliant, such as Shibboleth.

Read the full article at Response Report .

Web service clients can be implemented as JavaServer Pages, servlets, or Java applications, or as executables written in C++, Perl, Visual Basic, JavaScript. A truly ubiquitous protocol. In this article, I use a Java application as a Web service client and show how to secure that client from an authentication and authorization standpoint via Role-based Access Control (RBAC). Basically, role-based authorization is achieved by using: