October 2015 - WG-UMA - mailman.kantarainitiative.org

Noting a few calendar adjustments
by Eve Maler 17 Oct '15

17 Oct '15

Let’s try and review all the outstanding public review-era comments in next week’s WG call. (Maciej, shall you and I do the outstanding stylesheet work as well, this coming week?) I’m going to remove the APAC-friendly sync meeting on (Pacific) Wed Oct 28/(APAC) Thu Oct 29 because it conflicts with IIW. Voting participants, please mark your calendars for the Nov 5 call so that we can make quorum and dispose of the post-public review comments/specifications and hopefully move them to LC consideration as Draft Recommendations for All-Member Ballot as the next step. I’ll be on vacation Nov 7-14; I'll plan to cancel the APAC, WG, and legal calls that week (as is our habit) unless I get offers from volunteer chairs pro tem by Monday. Any questions? Let me know. Thanks! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Ninth Circuit taking up password sharing legitimacy as authorized access [legal]
by Eve Maler 16 Oct '15

16 Oct '15

https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/10/15/shared-… ...and this is why explicit delegation without credential sharing and without mental state guessing would be so awesome. :-) Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Reminder: UMA legal subgroup telecon 2015-10-16
by Eve Maler 15 Oct '15

15 Oct '15

Fri Oct 16 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Report from the APAC-friendly UMA sync discussion <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/1vA-frUlo…> Take a look at the latest CommonAccord artifacts and progress What are the appropriate next steps and timeline? What artifacts will give concrete assistance to UMA deployers in 2015? Anything worth retaining/saving from Binding Obs? Should we sunset it? Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Notes from UMA telecon 2015-10-15
by Eve Maler 15 Oct '15

15 Oct '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-10-15 Minutes Public review status There appear to be no big comments yet. We have a few editorial/minor text comments. We should be prepared to vote on edited versions of the specs on Nov 5, and make quorum. Eve and Katie have been getting quite familiar with using the V1.0.1 versions of the specs. Mike and folks will be looking closely at them for OxAuth purposes. AI: Eve: Publish low-level UMA swimlane and WSD source code (with new V1.0.1 spec section references) for general use. Mike's diagram <http://ox.gluu.org/lib/exe/fetch.php?media=oxauth:umademodetail.png> (currently up to 33,708 hits!) seems very popular. Robert notes that the diagrams by themselves, without a narrative, kind of start in the middle (or at the end). Should we be providing a new area of the site for videos, training, documentation, etc.? Stories from the Alice and Bob perspectives could be good too. Intro to UMA? UMA 101 would be ambiguous. UMA for Beginners? And then we could have Advanced UMA materials etc. AI: Mike: Create a new UMA video/screencast. An interesting discussion as part of this intro material would be a discussion of best practices around scopes and scope design. See, e.g., this page <https://developers.google.com/identity/protocols/googlescopes?linkId=178862…> that catalogues Google API scopes that are actually used. AI: Eve: Create new wiki area for UMA intro material. Report from UMA Dev Roland will have some RS library work done by IIW. Mike also has a sample library effort going, at the level of Hello, World. We can perhaps combine efforts under UMA Dev to accelerate that effort. Who from this call is at IIW? Eve, Mike, Adrian, Sarah, Maciej, Jin, Justin. Surely we'll convene a session on this topic, if not more. Independent Submission Originally the WG had planned to contribute our specs to IETF, with the hope/anticipation that the OAuth WG might pick up the specs as part of its work stream. Subsequently, when Kantara softened its requirement for contributions elsewhere, the WG had decided to go the Independent Submission to the RFC Editor route (resulting in Informational RFCs) because of the value of the RFC imprimatur and the relative lack of likely impact on the specs through that process. Now we are reconsidering. Pros of going the Informational RFC route: The RFC imprimatur does seem to be valuable to some; Debbie has noted this. The specs get more "marketing". Cons: The process of AD review (and, possibly, WG attention) is onerous. The confusion around multiple versions of specs, KI vs. I-D, is potentially considerable. The original motivation for contributing I-Ds was that people in IETF don't pay attention to spec input unless it's in the I-D/RFC ecosystem, but that hasn't help our cause to date, as far as we can tell. Justin proposes updating the I-Ds we've got now with I-Ds that have no content except for URLs that point to the "real" specs. Justin notes that his implementation of RSR in the non-UMA context, prior to implementing it for UMA, had to be changed considerably to work with his later UMA implementation. So maybe it's not as modular as we think. Can we learn more about Debbie's rationale? If we do go the Informational RFC route, in fact it wouldn't go through an IETF WG; does that impact her thinking? Andi cautions that some who are interested to deploy UMA may not take it seriously if it doesn't come through a certain organization. Mike looks at the SEO/marketing angle. Even with possible confusion, getting the specs out there through more channels would be valuable. AI: Eve: We apparently need more information about who would reject UMA if not published as an RFC; float the question with those who care about this. Permission registration extension idea AI: Eve: Send email about permission registration extension ideas. Previous AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Andi and Zhanna: Please look at the section on optional and extension properties to see what might need an update to account for V1.0.1. [DONE] AI: Maciej: Review and correct the Redirecting the Requesting Party to the Client After Claims Gathering section. AI: Maciej: Write up some recommendations for the RPT Refreshing section. AI: Maciej: Try to find Justin's old recommendations for the Permission Ticket Management section. Attendees As of 13 Oct 2015, quorum is 7 of 13. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Sourav, Lisa, Arlene, Mike) Eve Andi Arlene Mike Robert Maciej Non-voting participants: David Maisenberg - attorney (non-practicing) - works with biotech - didn't know about UMA but was looking for it! - trying to get up to speed - hopes to contribute to writing and research - based in Colorado Sarah Steve Greenberg - technologist/consultant - obsessed with delegated consent and identity - following with interest Adrian Katie Justin Ishan Jin Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Some UMA deltas related to [legal] goals
by Eve Maler 15 Oct '15

15 Oct '15

Completing an action item I took (with Adrian) on Friday’s legal subgroup call: We had done some work a few weeks back to analyze various deltas between the “UMA-that-is” and the “UMA-that-he-posited” could solve many of the concerns of potential RS’s in the healthcare space. I captured these in a GDoc table <https://docs.google.com/document/d/1N6tocmA0KaBE6v3u-cZSyw0N52lG_LdWHAaPybS…> (not the friendliest format, nor perhaps even accurate). I’ll paraphrase/correct that information here and comment further… In the GDoc, We started calling these “technical UMA safe harbor propositions”, meaning that if UMA could build in some solutions at a technical layer, then it could powerfully convey to RS’s that they would be safe in outsourcing authorization to an AS chosen by Alice (our RS-AS meta-use case). Don’t take the appearance of the phrase “safe harbor” to mean that other thing. :-) Here were the propositions we looked at and the solution spaces I thought were viable. I’m sure there are other potential propositions beyond these. Accounting for Disclosures at AS (HIPAA calls these “accounting of disclosures”.) This is a regulatory requirement that apparently isn’t really honored yet. The idea is that patients have the right to know who has received their health information for reasons other than treatment, payment, or health care operations, or disclosures specifically authorized. In other words, it’s a kind of monitoring capability. Can this be done in UMA V1? Technically, only “attempts at access” can be detected at the AS at all, and this is only if the RPT was introspected by RS at the AS. Token introspection at the AS is required by the default token profile, but it needn’t be done if (e.g.) the token can be cached and is still fresh. And if the token introspection revealed that the client isn’t authorized, or if the RS maliciously took action that was contrary to what the token said, then the introspection wouldn’t be a good clue as to whether anything was disclosed. Can UMA be extended to do this? The UMA AS-RS communications channel could be extended to let the RS report actual accesses to the AS, so that A4D could be made interoperable. Can software outside of UMA add value to do this? An UMA-enabled software system could throw events about and log access. RS takes client/RqP-dependent actions on access requests Normally the RS knows nothing at all about the client or requesting party that approaches it. But even if the AS says the client has a valid token with the right permissions in it, the RS may want to reserve the right to make up its own mind. Adrian has called this “you cut, I choose”. I don’t like this analogy because it implies 50/50; I prefer the federated identity analogy (which he hates!), which is that a relying party always has the right to refuse service. Can this be done in UMA V1? In the UMA V1.0.1 spec, we added/tweaked text to make clear the RS’s rights: “The client's presentation of a valid RPT associated with sufficient authorization data as determined through RPT status checking (see Section 3.4) indicates that the resource owner's policies have been met for access to the protected resource. The resource server MAY apply additional authorization controls when determining how to respond.” Can this be done on a business/legal level? Yes. We have woven this recommendation throughout the spec, e.g. “Parties operating and using UMA software entities have opportunities to establish agreements about the parties' rights and responsibilities on a legal or contractual level, along with common interpretations of UMA constructs for consistent and expected software behavior. These agreements can be used to improve the parties' respective security postures, and written profiles are a key mechanism for conveying and enforcing these agreements.” AS displays to RO notices that were contributed by RS that reflect RS’s statutory responsibilities to adhere to RO/RS contract, signed by RO (or AS?) This one is a doozy. It’s an interesting idea, but I’m not sure I understand all the ramifications. This came out of Release of Information (ROI) form discussions. Can this be done in UMA V1? No. (This was causing me to freak out, as I thought I heard Adrian claiming this was just a tiny thing that would be easy to add. :-) See his issue 224 <https://github.com/KantaraInitiative/wg-uma/issues/224> in GitHub. Can UMA be extended to do this? Perhaps an endpoint/capability for registering either only a “dead” version of the ROI, or elements of the RS/RO contract of record, could be added. Adrian has proposed that this could include a label, an endpoint for notification of changes or cancellation (in both directions), an expiration date of the contract, and an option for the RO’s unilateral cancellation since this is always their right (as it it always the right of the RS too). Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 2

Notes from APAC-friendly UMA WG sync 2015-10-14 [legal]
by Eve Maler 15 Oct '15

15 Oct '15

Attending: Eve, Gil, Allan, Colin We discussed the impending “grand unified theory” that seems to involve CommonAccord, consent receipts, dynamic OAuth client credentials issuance, etc. Some of this involves ideas for major UMA extensions or value-add on top. Allan strongly suggests that any business logic that complicates “core UMA” be layered carefully, so that it doesn’t compromise the spec. No one wants a new X.400. :-) We do have a “Modular” design principle, so we should adhere to that. There is definitely a challenge coming with “multi-AS” environments on a technical level, not just on a legal level (a la the business models described here: https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Business-Models ). How would such an environment work as we look at more complex use cases? This could give color to the “Free-Love” business model. This is where Justin has been heading with his critiques of our V1 design, and we know that certain simplifying assumptions have made certain value-add features work nicely in “single-AS” environments. On the other hand, solving all the problems of multi-AS environments is really really hard, and it impacts user experiences too. Maybe imagine that a single RO has to deal with multiple AS’s in their life. What problems need to be solved? Another piece of simplifying assumption is when the AS = IdP. When they’re not, what does this mean? What changes? What attack vectors might there be, specifically in the context of chained delegation, if there are multiple AS’s and a requesting party has a different AS? An RS might hesitate to engage in these interactions if it’s not sufficiently protected. This is perhaps precisely where we need “UMA-specific model clauses” that are not just about privacy, not just about security, but about access control that goes beyond what the technology can enforce. This is what the Binding Obs doc attempted (imperfectly) to do. The enterprise UMA use cases are where Gil comes in. Employees would have contractual requirements with their employer, for example. In these cases, corporate policy would take effect, and it would probably be single-AS for the most part (a la Google Apps for Business?), and the PAT and AAT would likely be issued silently based on those employment agreements. Actually, multi-organizational sharing/delegation that has proper trust elevation would be a great use case that goes one better than Google. :-) What if we could take this as a multi-AS use case to solve? We’d be looking at “PDP proxies” here or something, or policy sharing. XACML!!!!!! :-) (Side note: Gil is moving back to the US in January.) Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Agenda for UMA telecon 2015-10-15
by Eve Maler 14 Oct '15

14 Oct '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-10-15 Date and Time Thu Oct 15, 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Public Review status and outstanding comment review New UIG text <> discussing default-deny Interop and IIW planning: report from the UMA Dev group Considering our Independent Submission stance of record Considering charter revisions/cleanup, especially in light of any decisions on the previous item Permission registration extension spec idea How are we doing on other outstanding AIs? AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UMA interfaces diagram
by Eve Maler 13 Oct '15

13 Oct '15

I’ve been working on a diagram that tries to describe how an UMA AS is also an OAuth AS and RS underneath, etc. This has been percolating in my brain for possibly YEARS. Please let me know if it’s useful, and if it could be improved. I often find myself having to point out that an UMA RS "acts in the role of an OAuth client” when it uses a PAT at the UMA AS, but this finally explains the rest of the story… :-) Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 6

Notes from UMA legal subgroup telecon 2015-10-09
by Eve Maler 13 Oct '15

13 Oct '15

Fri Oct 9 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> How have we done on our next steps? Everyone please contribute “mile-wide, inch-deep examples on contract terms examples across all three meta-use cases — at least one of each kind (IT’S NOT TOO LATE! :-) ) Jim H walks through his Common Accord structure and examples to help us capture our examples and understand all of his Attending: Eve, Andrew Hughes, Steve, Adrian, Mark, Tim, Jim, Jon, Dazza, Ann, Scott, Mary Hodder Jim and Adrian have sent out a putative “Simplest Possible UMA Contract <https://docs.google.com/document/d/1IvuencOdrtShE6FCIu9v5eTO3Qjl4i1JnaDnCXC…>” document that structures a healthcare Release of Information form along the lines of an “imagined UMA” that does things that UMA today doesn’t do (as Adrian cautions, don’t get caught up in the technicalities). It uses the CommonAccord <http://new.commonaccord.org/index.php?action=list&file=GHx/KantaraInitiativ…> framework/data model for a mapping to the Restatement of Agency work that Adrian and Eve had attempted previously. Which meta-use case(s), if any, does this text address? It seems like it’s about RS-AS; we talked about it last time. There’s been some discussion about herd immunity, where some parties engage in selfish behavior, and if enough of them do, then other free riders can benefit such that the aggregate risk reduction ends up having selfless aspects (Scott’s “stopping at red lights” example). There can be a “tragedy of the commons” problem if there’s over-engagement in the behavior that doesn’t confer herd immunity. So the desirable behavior that weighs on the side of risk reduction has got to be valuable in and of itself often enough. The incentives have to be high enough. Put another way, as seen as is being sought with certification programs, UMA adoption should be able to drive "network effects”. The idea is that similarity of bankruptcy clause, notice clause, etc. is what gives the aggregate value. It’s “legal interoperability”. Jim’s work lets us slice and dice contracts. We drilled down on the RO-RS portion of the text, which leads to the CommonAccord framework portions that modularly lead to constructed contracts. E.g., RO Alice has this first name and this last name, and live in Dallas. Dallas, of course, is in a particular jurisdiction. Different jurisdictions have wildly different implications. The way the framework works, the “Source" is hosted on GitHub, and Jim’s site pulls it in. It can be “Edit”ed right there. The “Document” view dereferences the pointers in the source. Jim got into doing this through the “smart contracts” path in a blockchain context, though this is not technically an instance of that. Knowing that the latest Safe Harbor news has upset the current ecosystem, it appears there may be an appetite to restate the requirements in a new way. Suddenly some parties may not be well served by the way legal text is handled in the current system. With consent receipts in the picture, does it make sense to have a CommonAccord way to capture agreements and receipts? This may indeed be productive. Effectively, GitHub can be the audit log. And then, of course, the logs have to be mutually available to the parties, nonrepudiable, and tamper-proof. Blockchain technology could come into play here. An escrow agent role can make sense (again, blockchain is relevant here). There’s a larger ecosystem of contracts management and vendor management in which (e.g.) hospitals already have to operate, so whether UMA is used or not, a system like this one could be relevant if it lowers cost and friction. But then if UMA uses it, it becomes more attractive. Thinking of blockchain as a ledger, the ledger is not the actual money. A ledger has a separate value that can be measured and acquired. What sorts of deliverables should we consider producing? Some options… Previously produced: Auditable junctures in the protocol (the UMA “state changes” to which we attached some clauses in Binding Obs) Previously produced: An indivisible set of “axiomatic” clauses we thought deployers of UMA should adopt (the Binding Obs clauses - dependent on #1) Future option: Specific auditable junctures that should have consent receipts attached to them (build on #1?) Future option: CommonAccord-expressed consent receipts Future option: Recommendations about how to literally store and manage these consent receipts in CommonAccord (build on #4?) Future option: Recommendations about specific language that meets our meta-use cases and business models The EU has model clauses. Could we build on those? The “boring approach” is to get agreement on the things that matter the least. It won’t solve our problems, but it starts to build a solution and gets some success. AI: Jim, Eve (and invite Jon and Dazza and Steve): Whip up some model clause thinking for the subgroup next week. Eve to send an invite for a midweek ad hoc to do preparatory work. AI: Adrian, Eve: Document the delta between the UMA-that-is and the UMA-that-is-posited by this new doc. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

3 9

Voluminous email and syncing up
by Eve Maler 12 Oct '15

12 Oct '15

I was just chatting with a non-voting participant who (quelle surprise) is finding it hard to keep up with the email volume and work outputs, and I suggested that joining the fortnightly “APAC-friendly sync meetings” could be a good way to catch up. Even if you’re not in an APAC-ish time zone (admittedly they’re not very Europe-friendly), if you’d like to join these meetings to get a succinct recap of the latest work and weigh in briefly, I’d be happy to put you on the invitations. For non-APACers, they are 4-5pm PT/7-8pm ET on Wed Oct 14, Wed Oct 28, etc. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0