Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:28811
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain ctindustries.net from 216.117.147.250 cause and error)
Message-ID: <4620B68B.80502@ctindustries.net>
Date: Sat, 14 Apr 2007 07:10:03 -0400
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: Antony Dovgal <antony@zend.com>
CC: Lukas Kahwe Smith <mls@pooteeweet.org>, internals@lists.php.net
References: <461E4437.2090105@pooteeweet.org> <461E8888.7080108@zend.com>
In-Reply-To: <461E8888.7080108@zend.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP6 todo list
From: rrichards@ctindustries.net (Rob Richards)

Antony Dovgal wrote:
> On 04/12/2007 06:37 PM, Lukas Kahwe Smith wrote:
>>     7. ext/soap
>>           1. ext/soap will be turned on by default
>>           2. implement some of the security extensions to ext/soap
>>           3. watch axis2 based implementation development
>>
>> I am guessing the security stuff could take a bit to implement. Does 
>> anyone feel "responsible" for this item?
>
> IIRC Rob was working on some XMLSec stuff, no idea what's its status 
> though..
>
An XMLSec extension is close to an alpha release. There are a few of us 
actually working on it, Alexandre Kalendarev is doing the bulk of the 
work right now, and we're almost there. It's based on the xmlsec library 
and we decided to add WS-Security functionality directly into that 
library and just leverage that functionality, so we keep getting delayed 
fixing problems we're creating within xmlsec itself while trying to 
maintain BC while adding the functionality we need to hook into it properly.

As far as implementing these into soap, I still think having these as 
external extensions that can be accessed from ext/soap rather than 
baking directly into ext/soap is best option and would mean just adding 
some additional plugin-in points during the message processing. The PHP 
code I wrote for WS-Security (which really amounts to only a small 
portion of that actualy specs) seems to satisfy at least 90% of the 
people looking to implement some of the basic WS-* stack with PHP. The 
functionality we are looking to add to an XMLSec extension would not 
only help speed up the processing but also expand the amount of 
supported algorithms, transformations, etc.. detailed in the specs. 
Projects needing to support more complex situations would probably would 
want a much larger SOAP framework (like .NET, WCF, XFire, etc.. - 
personally I like .NET/WCF here).

As far as axis2 (WSF for PHP), I have been playing around with it for 
quite some time now. It still has a lot of bugs to be worked out but 
does seem to be aiming to compete with the larger SOAP frameworks. This, 
however, is one of the reasons I really don't think it should replace 
the existing soap extension. The current source for WSF for PHP is 
almost 6MB in size and its not as simple to use as ext/soap. It would 
add a lot of bloat and confusion when in most cases creating simple SOAP 
clients is the desired functionality. Basically I think it might make a 
good alternative for someone to use as a more complex SOAP framework, 
but not one to be included in PHP core.

Rob