Avoiding Cleartext Passwords

Keith's suggestion for avoiding cleartext passwords seems totally feasible to me. The question is what to use for scopeURI. One approach is to use the endpoint address, scoping the validator to all operations available at the endpoint. Another approach is to use the action, scoping the validator to the specific operation. Either seems reasonable but using action seems more appropriate to me for some reason.

When Keith says that WSE2 literally uses cleartext passwords, I think he means that the automated support for hashing/signatures relies on the cleartext password provided when instantiating a UsernameToken. However, it seems possible to implement Keith's technique using WSE2 today by supplying his notion of validator (for the password) when instantiating theUsernameToken on the client, and generating and returning the same validator from your UTM on the server. Then WSE2 will use the validator for hashing/signing instead of the cleartext password. I'm itch'in to try this now.