A trust relationship has been established between two organizations with web based services. One organization is acting as the Requesting Authority (RA) and the other acts as the Provisioning…

The trust relationship between a Requesting Authority (RA) and a Provisioning Service Provider (PSP) in web-based services uses SAML security tokens carried in SOAP message headers via the WS-Security framework. SAML assertions in the SOAP header provide the authentication and authorization context the PSP needs to validate and process provisioning requests from the RA, which is the standard pattern for federated web services trust.

XACML is a policy language for defining and evaluating access control rules, not for carrying authentication tokens or establishing trust between provisioning entities in a SOAP-based web service.

While SPML (Service Provisioning Markup Language) defines the provisioning operations and does use SOAP as transport, the trust mechanism itself relies on SAML assertions in the SOAP header rather than SPML being the trust protocol.

SPML is not embedded inside SAML headers - SPML provisioning requests are carried in SOAP envelopes, not nested within SAML assertion structures.