[wsf-c-dev] [wsf-php] Security Implementation

[James Clark]

> Hence, what would be the benefit of taking that as SimpleXML or DOM?

Because it allows developers to use PHP to create simple, easy-to-use
interfaces (like our case 2 interface) on top the case 1 interface that
we provide.

As well as allowing average PHP users to use our interface directly, we
want to enable more sophisticated PHP developers to use our interface to
create other PHP libraries, for example to provide customized interfaces
to particular Web services.

>  I 
> think, for many users, it would be far simple to drop the policy file 
> somewhere and use it.

Sure, but that's trivial, natural and efficient to do with an interface
that accepts XML (by using file_get_contents()). If the interface
accepts only filenames, then you make anything but the simple case
awkward. What if the policy is on an HTTP server? What if it's in a
database? What if they need to dynamically create the XML by
substituting some values into an existing policy file?

Interfaces that accept only filenames are evil.  Add a policyFile option
if you feel it's too inconvenient for the user to use file_get_contents
(provided you appropriately use the PHP file IO layer), but it shouldn't
be the only way to specify the policy.

James