November 2015 - WG-UMA - mailman.kantarainitiative.org

URGENT: Opportunity to request 2016 funding, with a proposal for a "legal subgroup" project
by Eve Maler 30 Nov '15

30 Nov '15

Hi folks— In conversation with SteveO and Robin W from ISOC, I learned they would be willing to support the UMA WG with some directed funding to Kantara to the tune of US$10K, to arrive by 31 Dec 2015 and to be spent in 2016. (Thanks, SteveO/Robin/ISOC, for your support!) I thought it would be a good idea to treat this as a matching funds opportunity in addition to a (required) formal writeup of what I have already described to them as a good target for development. The target: A user interface/environment for enabling the convenient creation of a variant UMA-specific set of contract clauses that could be used in real business settings, such as Adrian brought up in a legal subgroup meeting a few weeks ago. As research, I just spent the last hour meeting with Jim Hazard, and we worked out the following draft budget proposal with which we feel pretty comfortable: https://docs.google.com/document/d/1DFFwU_7EmXVtpTb0s7SZVkQ4NFOC6oi4uNInLDq… There is a DEADLINE OF TODAY for getting 2016 budget proposals in. Can I ask people to review this proposal and weigh in on a) the idea of submitting the proposal at all, and b) the text of the proposal if they think the submission is a good idea? To be clear, ISOC has guaranteed its contribution already; we are asking for Kantara funding over and above this in order to ensure we can do a really good job (so perhaps, in a sense, we’re asking Kantara to match ISOC’s funding!). If you have any questions, of course, please let me know. If I don’t hear any strenuous objections by 10pm CET (where I currently am) / 4pm ET / 1pm PT (sorry for the early hour on the west coast), I will send in the proposal. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 4

Reminder: no WG call on Thu and no legal subgroup call on Fri due to the US holiday
by Eve Maler 24 Nov '15

24 Nov '15

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: APAC-friendly UMA sync 2015-11-26 (see note at end)
by Eve Maler 24 Nov '15

24 Nov '15

Thu Nov 26 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: none for this meeting as I’ll be joining by phone (normally http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line)) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-11-25): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. NOTE: I have a dentist’s appointment just prior, and there’s a not-entirely-insignificant chance that I might be a bit delayed. If so, I’ll send a note to the UMA Chat Skype group. If you are not in that group, please send me a note to add you. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

OAuth Identity Federation
by Mike Schwartz 20 Nov '15

20 Nov '15

UMAtarians, I have finally caught up to all of you founders, and I am seeing the benefit of using UMA for federated identity (not just federated authorization). I've created a new project to just sketch out some of my ideas: http://www.gluu.co/oauth-identity I'm trying to gather feedback to see if this idea has any merit or would be worth the effort to undertake... Please send me email directly unless you think it would relevant for the whole list. thx, Mike

1 0

Notes from UMA legal subgroup telecon 2015-11-20
by Eve Maler 20 Nov '15

20 Nov '15

Exciting progress today! Attending: Andrew, Ann, Jon, Adrian, Steve, Jeff, Adrian, Scott Andrew still needs to keep some project details under wraps, but he notes that any provider whatsoever in that project needs to have SLAs etc., and for each of the identity roles, he’s created a list of archetypes for, e.g., IdPs and such. He’s also set out UMA archetypes — this is where the Binding Obs come in. If you have an UMA authorization server defined and built as such, what are its proper functions? He has a notion of this, but he just needs the text. Being a framework, it can handle both an AS that serves multiple ROs, and an AS that serves a single RO. When you downselect the rules you want, that gives shape to your deployment. Is it also interesting to attach the proper functions of the roles in terms of protocol state changes? Andrew is not so sure, for the work he’s doing right now in making a framework. Eve notes that it may simply have relevance only when it gets to “receipt” time, that is, when a particular norm gets executed by a particular role. Andrew’s analysis tool is designed to be able to record that if someone is a signatory to an agreement, then they commit to being in a certain role. So: Click the box to be in a role. He needs the role definition. We can write the latter. Scott asks: Have we talked about standards of care? Adopting a role in the real world comes with standards of care that are affected by statutes and/or contracts. Here’s where the CommonAccord approach could come in, with a flexible normative cross-reference. Andrew is planning to handle this in the base layer. Andrew made a matrix of expectations and commitments. Contracts are just exchanges of promises! Say what you’re going to do, and then doing what you said you were going to do. This is the Invisible Hand model. Offer and acceptance of a contract has a notion of the time of acceptance. This again suggests recording/logging as an important function. (Hence the blockchain mention as a ledger…) In legal parlance, a “prohibition” is a "condition subsequent”. This is a way to effect the “chain-link confidentiality” effect Domenico has drawn our attention to. It’s useful for real estate, but people bristle at it when used for intellectual property. Think of software licensing. But then again, it’s used for NDAs, embargoes, etc. It’s tricky. How different are “power” and “authorization”? This is the central preoccupation of Steve’s adult life. :-) ==== Can we draft statements of UMA role functions with required parts (clauses?) and optional parts (clauses?)? Should the latter include something about consent receipt/audit log entry generation, where appropriate? Andrew says this fits in pretty well with his goals. Obviously we’re not thinking about producing these statements in Word! They’d hopefully be in CommonAccord, and ultimately be available in a cool online tool with dropdowns and such. :-) Who is interested to actively take part in the action item? Eve, Andrew, Steve, Ann… Scott is happy to do intense kibbitzing! Eve and Andrew are meeting in depth later today, and will try and sketch a draft skeleton to help push things forward. Eve will round up those who are/may be interested to work together in the interim. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Follow-up to the UMA Legal call and FutureCommerce hackathon planning
by Adrian Gropper 19 Nov '15

19 Nov '15

The legal call today had a clear focus at the junction of CommonAccord, blockchain, and UMA. The use-case was negotiation of a Non-Disclosure Agreement between two parties using CommonAccord as a structure for the changes that each of the parties would make as they passed the drafts back and forth. Blockchain was introduced as the non-repudiation mechanism to track the intermediate and final version of the NDA contract. UMA was not central to the discussion on the legal call today but was tacked on vaguely as the means to control access to the final contract by unspecified parties. It was not clear to me who the Resource Owner would be in the use-case we discussed. For the FutureCommerce hackathon, I'm hoping to gather a team to hack a personal UMA authorization server. This server, which I'm calling HIE of One http://hieofone.org/ could be linked to the CommonAccord project we discussed today to the extent there was a Resource Owner to associate with the contract being negotiated. At this point, instead of an NDA, the contract being negotiated in HIE of One is a Release of Information policy that establishes what requesting parties and clients can access the protected resource. An NDA is, in some sense, the opposite of a release of information agreement. An NDA is often mutual and therefore does not have a clear resource owner. This may not be a problem for some applications of UMA but it doesn't seem to work well for a personal authorization server linked to a personal resource. I'm hoping we could coordinate some of the FutureCommerce hacks over the coming week. Ideally, the CommonAccord hack and the personal AS hack would complement each other around the same type of contract and we could even try to demo some interaction between them. Please let us know your thoughts and consider joining FutureCommerce http://futurecommerce.civics.com/index.html online Nov 20-22. Anyone specifically interested in working on the personal AS hack should email me and I will invite you to the GitHub project. Adrian <http://patientprivacyrights.org/donate-2/>

3 9

Notes from UMA telecon 2015-11-19
by Eve Maler 19 Nov '15

19 Nov '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-19 Minutes Roll call Quorum was not reached. Approve minutes tbs Upcoming meetings No meetings Thu/Fri next week (US Thanksgiving holiday) No meeting Thu the following week (Thu Dec 3) due to Eve absence (Adrian can run Fri Dec 4 legal subgroup call) No meetings Thu/Fri Christmas Eve/Day No meetings Thu/Fri New Year's Eve/Day Status of V1.0.1 process LC ballot to certify Draft Recommendations has passed Kantara All-Member Ballot process can begin shortly after a few "metadata edits"; complete by end of 2015 Maciej has made the required edits to the specs' metadata to ready them for All-Member Ballot. So now it's up to Oliver and Jane. Incidentally, the XSLT stylesheet now handles everything automatically rather than requiring manual tweaking. This means that other WGs could be using it too! AI: Maciej: Alert Jane Celusak that the stylesheet could be used as a tool by other WGs. Funding requests The main purpose of the UMA Dev WG is really seeding the ecosystem, not interop testing. And the interop test GUI he developed is separable. And Roland hasn't done much development since he started refactoring. Does this mean the job properly devolves to this group? On the other hand, software – especially if we want to ensure that it remains FOSS – does nicely go hand in hand with the Dev group. The UMA group is still working pretty hard on features and such, so spending time overseeing software development may overwhelm us. So maybe software should stick with software, and interop testing is a natural function of encouraging wide ecosystems as long as testing is made very easy. Resource servers are a policy enforcement point, so it's very important to know that they're getting it right. Adrian's new HIE of One project deals with this by saying "Here's a very simple implementation of an authorization server that can be given away (and used by a single individual)." The RO would have to do no setup; it's a "personal data store" kind of use case. Each of the existing open-source authorization servers is optimized for different use cases: API security vs. individuals, individual scale vs. whole consumer populations... AI: Eve: Report back to Jane that this WG won't be spending our budget allotment in 2015, and we're withdrawing the request. (She'll bring up the idea of doing a 2016 funding request through the UMA Dev WG.) IETF 94 news It appears there's now interest in RSR, or something like it, in OAuth now that they're rechartering. Would a general service metadata endpoint be a good idea in addition to registering the stuff that needs to be protected? Could the OTTO work be added to the mix? What are our thoughts on next steps? Mike advocates for moving everything (Core and RSR) to IETF. Eve advocates for being tactical and only working to explore "sedimenting" RSR into IETF right now. George is not in favor of moving Core. Maciej seconds George. Sal too – he notes that this could be a diversion. It's important to move ahead with deployments and use cases and proving the value. Mike's rationale: Adoption is what matters; Core could be very useful to enable a federation standard where UMA is the access token for identity information – then UMA would become a federated identity protocol. Mike feels that if we don't "move both", we shouldn't even "move RSR"! More to come on this subject. (See the Skype chat for more.) AI: All who are able and willing: Track IETF OAuth conversations about OAuth/UMA/API security more closely. Permission registration extension spec Deferred. Previous AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Maciej: Review and correct the Redirecting the Requesting Party to the Client After Claims Gathering section. AI: Maciej: Write up some recommendations for the RPT Refreshing section. AI: Maciej: Try to find Justin's old recommendations for the Permission Ticket Management section. Attendees As of 13 Oct 2015, quorum is 7 of 13. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Sourav, Lisa, Arlene, Mike) Eve Mike Maciej Domenico Sal Non-voting participants: Katie George James Sarah Scott Adrian Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Specs certified by LC for All-Member Ballot
by Maciej Machulak 19 Nov '15

19 Nov '15

Hi all, The UMA specs, certified by LC for All-Member Ballot, are now uploaded and can be accessed at: https://docs.kantarainitiative.org/uma/draft-uma-core-v1_0_1.html https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html As you can see, the status of both specifications changed to the following: "This Draft Recommendation was developed by the User-Managed Access Work Group and has been certified by the Leadership Council to undergo a Kantara All-Member Ballot." We should be discussing these specs on today's call. Kind regards, Maciek -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

1 0

Agenda for UMA telecon 2015-11-19
by Eve Maler 18 Nov '15

18 Nov '15

(Sorry for the delay in sending — lovely windstorm and power outage in Seattle yesterday…) http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-19 Date and Time Thu Nov 19, 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Approve minutes of UMA telecon 2015-09-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24> and UMA telecon 2015-11-05 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05> Status of V1.0.1 process LC ballot to certify Draft Recommendations has passed Kantara All-Member Ballot process can begin shortly after a few "metadata edits”; complete by end of 2015 Funding requests IETF 94 news API management <https://www.ietf.org/proceedings/94/slides/slides-94-oauth-6.pdf> interest related to UMA Permission registration extension spec review and discussion AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

FW: Authentication and Authorization for Research, and Collaboration 2: expressions of interest
by Keith Hazelton 15 Nov '15

15 Nov '15

The major authNZ initiative in EU at the moment, focusing on user-driven innovation. ________________ On 2015-11-15, 03:22, "David Groep" <davidg(a)nikhef.nl> wrote: >Dear FIM4R and parties interested in AAI for collaboration and research: > >As you are likely aware the Authentication and Authorization for Research >and Collaboration project AARC [aarc-project.eu] works towards an >integrated authentication and authorization infrastructure - built on >federated access - to enable users (using their existing credentials) to >seamlessly access e-infrastructures and support increased penetration >of federated access. Supporting actions include training and policies >and best practices harmonization. > >With this communication we would like to inform you about the plans >by the AARC Board and Project Partners to reply to the "User-driven >e-infrastructure innovation" call [1] by the EC, with a focus on >user-driven innovation and pilots on existing e-Infrastructures to >respond to user-community challenges > >You are requested to read the attached document and consider the >next steps detailed therein to help our researchers, educators and >students with an AAI that facilitates inter-federated usage >and sharing of resources. > > With kind regards, > Licia Florio, p.p. David Groep. > >[1] Please see >http://ec.europa.eu/research/participants/portal/desktop/en/opportunities/ >h2020/topics/2120-einfra-22-2016.html > >-- >David Groep > >** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group >** >** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL >**

1 0

Draft minutes of UMA Legal telecon 2015-11-13
by Adrian Gropper 13 Nov '15

13 Nov '15

Minutes Jim - GAGH (Global Alliance for Genetics and Health) - With machine readable consent group. Starting with taxonomy for access. Figure out a way of handling the specification of authorization of use of a genome. With Thomas working on a UMA / Common Accord / Blockchain hack. Scot interested in gene information sharing. Adrian also involved via a Mayo Clinic genomic determinism and data management. Steve with blockchain. Ann wants to help. Will be at FutureCommerce Hackathon. Thomas: CommonAccord for GitHub contract version tracking and specialization. The core contribution from Jim allows modularized pieces of the contract. Transacting parties A and B would each have to set up their own GitHub client and each time a party makes a change a hash is sent along with the diff that's sent to the other party and the hash is also put up on a blockchain. UMA comes in for the privacy aspects of the contract. Access control to contract via UMA to avoid having to ship the contract around. Consents expressed in CommonAccord format - points to data item - Organize the machine readable consent to drive UMA policies. CommonAccord + UMA + Blockchain is a general solution. Blockchain is advertising my signature / providing non-repudiation / for the process. Helps with escrow. SHA-1 to find data a la BitTorrent and SHA-256 are combined. May need to also conform to the Digital Signature Act using X509. Stock market analogy - stock certificates, then derivatives. Multi-channel verification of rights. What can we code to explain this? CommonAccord interacting in a GitHub like server + add the hash drop out - then add UMA and later blockchain. Patient consent or material transfer agreements. Jim demos NDA between two parties. Called Nameless. Common Accord + code to build something like a Merkle tree + post hash to blockchain as the minimum viable demo. Separate piece of this - what would be a taxonomy of access - by adding UMA - Dazza suggests the iAuth project for FutureCommerce that takes the hash of a commit in GitHub and its message digest via GitHub API (blocksign) - then make it so one of the commits are linked to OAuth2 / UMA and tied to a scope. Let's continue this discussion on 1 2 or 3 projects on the Slack channel for the next week as prep for http://futurecommerce.civics.com/index.html Please email Dazza or Mark to join the Slack channel (I don't seem to have invite power). Legal call next week will go on as scheduled and FutureCommerce starts an hour after (1PM EST). ----------- Proposed Agenda: - How can we reduce legal and business barriers to real-world UMA adoption? - What does the link between a minimal / personal UMA AS and Agency Law look like on GitHub? - FutureCommerce Hackathon at MIT and online next Friday - starts an hour after the end of our UMA Legal call http://futurecommerce.civics.com/index.html - AOB Roll call Attending Clayton Bonnell - USPS - Postal Inspection Service Steve John Jim Paul Thomas Ann Scot Sal Dazza -- Adrian Gropper MD <http://patientprivacyrights.org/donate-2/>

1 0

Reminder: UMA legal subgroup telecon 2015-11-13
by Adrian Gropper 13 Nov '15

13 Nov '15

- *Fri Nov 6* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar - How can we reduce legal and business barriers to real-world UMA adoption? - What does the link between a minimal / personal UMA AS and Agency Law look like on GitHub? - FutureCommerce Hackathon at MIT and online next Friday - starts an hour after the end of our UMA Legal call http://futurecommerce.civics.com/index.html - AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 2

This will get more people talking about HEART
by Adrian Gropper 11 Nov '15

11 Nov '15

http://geekdoctor.blogspot.com/2015/11/the-path-forward-for-meaningful-use.… Halamka is arguably the chief spokesperson for the health IT industry. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

1 0

Gluu Blog: How to centrally issue OAuth tokens for API access management
by Mike Schwartz 09 Nov '15

09 Nov '15

Umatarians, I wrote a quick blog this afternoon about using UMA for API access management: http://www.gluu.co/central-oauth2-tokens Any comments are welcome if I messed it up or missed anything crucial. - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Notes from UMA legal subgroup telecon 2015-11-06
by Eve Maler 08 Nov '15

08 Nov '15

Fri Nov 6 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Goal: start building a general "legal stack" for UMA-specific elements Learn more of Andrew H’s use case details Examine the sociotechnical norms for potentially useful concepts AOB Attending: Eve, John, Ann, Adrian, Andrew H, Jim, Jon, Mark, Nat, Sal Andrew has sketched a model for resource set registration services. So far this is very informal, so we won’t be minuting it in detail. What’s a better word/phrase for “community of interest”/CoI? Policymakers? Constituents? He’s trying to capture “reliance” relationships, and obligations/commitments. Adrian has concerns: Can we look at the simplest possible scenario and just map that? On the other hand, providing “legal resources” (akin to “developer resources”) for those who have constraints that require an UMA solution would be very valuable, because this is a real-world situation that we expect to be common. The “Open Identity Trust Framework Model <http://openidentityexchange.org/wp-content/uploads/the-open-identity-trust-…>” white paper may be useful for background on generic trust frameworks. OITF was influenced by the Liberty Alliance work, and Andrew has contributed to TF work heavily over time. Once you have the abstract model, then you can identify your specific “users” and “operators”. So can we make progress on our goal, given Andrew’s input? We could work on outputs for his “C” elements, and a lot of the “B”. Jurisdiction clauses are something everyone needs. And if we pick a business environment (university, or health, or DIACC!), we know of typical clauses they’ll need. UMA-specific stuff may affect, all of the business, legal, and technical sections (portions of the stack). Standardizing these clauses is the benefit we’re aiming to supply. Can we use the sociotechnical norms language <http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/IJCAI-15-TIST.pdf>? Eve suggests that the five norms are so clear, and clarifying, that they would be helpful for distinguishing the piece-parts of UMA flows that reflect different norms and developing model clauses for each of the B, L, and T layers that can focus on one type of norm at a time. John W thinks that there is relevance for consent receipts. Eve muses: Maybe Authorization could be for true consent receipts, and Commitment, Prohibition, Sanction, and Power could be for other types of transaction receipts? Powers could be conveyed to another party (such as durable medical power of attorney), and then there could be a flow chart after that where prohibitions and sanctions and such come into play. Next steps: Adrian is kindly running the next call. He will send out an agenda focusing on agency restatements. After her vacation, Eve will work with John and Andrew (and maybe rope in Tim as well?) on recasting whatever old Binding Obligations are still useful into norms language, and try to bucket them into B/L/T clauses for putative sections of a “stack". Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

8 8

FutureCommerce Hackathon & Symposium Event at MIT
by Adrian Gropper 06 Nov '15

06 Nov '15

Previews and Live Discussion: Monday, November 9th at 2:00pm Eastern via this page: http://futurecommerce.civics.com/index.html#whats-next <http://futurecommerce.civics.com/index.html#whats-next>FutureCommerce Hackathon & Symposium November 20-22, 2015 Online and In-Person Open Event *by* MIT Connection Science @ The Media Lab ------------------------------ The FutureCommerce Hackathon and Symposium is a creative event for team-based generation of innovative commercial products, services, transactions, experiences, relationships and business models. Enroll and/or propose a project at http://futurecommerce.civics.com/index.html --- Shameless plug: I will be proposing a GitHub project to create an open source reference implementation of a _personal_ UMA Authorization Server. The goal is to accelerate adoption of standard APIs for controlled access to the personal information that service providers have about us. The project is called HIE of One. It's not healthcare specific. Attend the Nov 9 preview and/or just connect with me directly if you would like to know more. -- Adrian <http://patientprivacyrights.org/donate-2/> <http://patientprivacyrights.org/donate-2/>

1 0

UMA testing / SecurityLoft / Client calls API
by Mike Schwartz 06 Nov '15

06 Nov '15

UMA-tarians, We've been talking about interop / conformance testing for a long time, and I think we need to get this to the starting line. There are a lot of UMA use cases that we need to prove out. I think we all agree that in order to move forward, we should start small, and in each iteration, cover more cases. This past IIW, I broached the idea of forming a new volunteer organization called "SecurityLoft". I have been inspired by OWASP. To start, SecurityLoft would just be a website, and a cloud server somewhere. I spoke with Kelly Grizzle at Sailpoint about hosting SCIM conformance tests at SecurityLoft. Perhaps SecurityLoft could also host UMA tests. The specific use case I think we should start with is (drum roll please...): Client calls API on Resource Server To get this done, we'll need to make a policy that any client can call to test positive and negative results. To make it easy to start with, I suggest using a policy based on time. In order to get a successful request, the permission ticket must be registered in the first 15 seconds of the minute. Just an idea... I was also thinking perhaps the UMA client could send claims as a json payload. Modest start? Yes! But at least a start that shows something tangible! - Mike

2 1

Reminder: UMA legal subgroup telecon 2015-11-06
by Eve Maler 05 Nov '15

05 Nov '15

Fri Nov 6 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Goal: start building a general "legal stack" for UMA-specific elements Learn more of Andrew H’s use case details Examine the sociotechnical norms for potentially useful concepts AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Draft minutes of UMA telecon 2015-11-05
by Eve Maler 05 Nov '15

05 Nov '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05 Minutes Roll call Quorum was reached. Next week's calls The WG call and the APAC sync are cancelled. The legal subgroup call will be run (and an agenda sent) by Adrian. Eve will "split the difference" with APAC-friendly calls and schedule one for two weeks from now vs. next week and three weeks from now. Public Review and WG approval for LC certification as Draft Recommendations so that All Member Ballot can begin Joni reports that we got a fair amount media attention, but no comments through the KI channel. We got a couple of pull requests for minor typos (thanks, Sarah!) and Eve reported a few minor editorial issues and subsequently incorporated fixes for all but one. Maciej has generated drafts with all of that incorporated. MOTION: Andi moves and Mike seconds: Approve the UMA Core V1.0.1 and OAuth RSR V1.0.1 specifications dated 5 Nov 2015, as amended with the agreed resolution to issue #229 and appropriate document metadata, for LC certification as Draft Recommendations so that All Member Ballot can begin. APPROVED by unanimous consent. The Status section should say, instead of "...for Public Review", should say "for LC certification as a Draft Recommendation". AI: Maciej: Edit the specs so we can turn them over to the LC to take up their e-ballot. AI: Eve: Edit the Release Notes slightly to indicate the status change of the specs. Independent Submission stance: any news/changes? The discussion to gather more information is still ongoing. Permission registration extension spec review We discussed the configuration data situation. Do we want to have an official UMA configuration data property that contains an array of profiles and extensions supported (by identifying URI)? Or instead – or in addition – does it make sense to have a property for each profile and extension (as this spec proposes) where the name is the identifying URI, and then you could provides all kinds of values, or even arrays etc., for finer-grained configuration of each profile and extension? George proposes something like this: "extensions_support is a JSON map where the key name is the extension URI and the value is a JSON object defined by the extension" This would ideally be something baked into the UMA spec. Does it make sense to do this in "the first extension produced by the UMA WG"? Also, the line between profiles and extensions is kind of thin. The spec, in Core Sec 1.4, explicitly stays out of the business of capturing profile or extension config data (at the end of the section). Should we get into the business? We're thinking maybe not. The mere presence of the key might normally indicate that the AS supports the extension. However, in an ecosystem where there are multiple AS's, and some do support the extension and some don't, a random RS might want all AS's to explicitly declare the situation. So that's where a key of "identifying_URI" and a value of something like a Boolean could be used. If the extension in question wants to have the AS provide a complex set of parameters whenever they do support the extension, it would be ideal to allow the parser to be able to stop the moment it knows that the AS doesn't support the extension, vs. parsing a whole object. (Think token introspection.) For our purposes here, we can keep it simple. Let's change to a Boolean for now. AI: George: Write up a short UIG section capturing the above discussion on profile/extension config data. (Eve will send links and instructions.) For the question about registration failure, George recommends for the AS to return an array of resource set IDs, each with a status, with an overall error. Are we sure we want to return a single ticket for the set of requested permissions? The RS has always had complete discretion about what to register. However, since resource sets may have scopes that are totally distinct from each other, it may be very important – party for interoperability's sake – to explicitly register requested permissions for each resource set. Note that the RS's registration of requested permissions is just about a bundling on behalf of the client. We don't get into authorization questions until the client actually conveys the ticket back to the AS to ask for authorization data at the RPT endpoint. So we're talking syntactic errors at this point. We're agreed that if there's an error in the request, the whole request should fail. We seem to need more discussion about multiple requested permissions vs. one returned ticket; we know there would have to be a lot more infrastructure invented if we returned multiple tickets. AI: Eve: Rev the permission registration extension spec. IIW 21 roundup Sorry there was no time to talk about IIW impressions! Do see the notes here <http://iiw.idcommons.net/IIW_21_Notes> (more still to come). There were lots of amazing discussions about UMA, and also consent receipts, and blockchain. (And don't miss Beyonce as a Service!) Previous AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Andi and Zhanna: Please look at the section on optional and extension properties to see what might need an update to account for V1.0.1. [DONE] AI: Maciej: Review and correct the Redirecting the Requesting Party to the Client After Claims Gathering section. AI: Maciej: Write up some recommendations for the RPT Refreshing section. AI: Maciej: Try to find Justin's old recommendations for the Permission Ticket Management section. Attendees As of 13 Oct 2015, quorum is 7 of 13. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Sourav, Lisa, Arlene, Mike) Eve Andi Arlene Thomas Domenico Mike Maciej Non-voting participants: James Adrian Harvey Nusz - attended IIW 21 last week - IAM and now privacy Sarah Andrew J Katie George John W Jin Guests: Joni Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Agenda for UMA telecon 2015-11-04
by Eve Maler 04 Nov '15

04 Nov '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05> Date and Time Thu Nov 5, 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Public Review closure and approving Draft Recommendations for progression to LC for approval to start the KI All Member Ballot process Independent Submission stance: any news/changes? Permission registration extension spec review How are we doing on other outstanding AIs? AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Fwd: [OAUTH-WG] Announcing new Identity Events Discussion List (id-event)
by Justin Richer 03 Nov '15

03 Nov '15

Apologies for cross-posting to multiple lists. A new mailing list is spinning up to discuss a potential abstraction that could include the “auditable transaction receipt” and “consent receipt” concepts in its milieu. This would be covering the technical aspects of the receipt construct, as well as potentially the delivery and notification aspects of these kinds of objects. If you’re interested in that conversation, please join the list. — Justin > Begin forwarded message: > > From: Phil Hunt <phil.hunt(a)oracle.com> > Subject: [OAUTH-WG] Announcing new Identity Events Discussion List (id-event) > Date: November 3, 2015 at 3:13:33 PM GMT+9 > To: SCIM WG <scim(a)ietf.org>, "<oauth(a)ietf.org>" <oauth(a)ietf.org> > Cc: <id-event(a)ietf.org> > > At IETF94, a number of us got together to discuss the emerging event work that is emerging in the Identity space: > > * OIDF RISC > * OIDC Logout > * SCIM Notify Events > * OAuth Token Revocations > * Consent Events > > The Id-Event discussion list is intended to begin discussion around developing new IDs (and potentially form a WG) for the purpose of defining a JWT message format for Identity Events and to define a possible approach for distribution. > > The list was formed after several participants noticed common event requirements that have emerged from SCIM provisioning, OIDC (eg. Logout), RISC Events (e.g. account suspension, reset, take-over), as well as OAuth2 (e.g. token revocations), and consent notification (e.g. consent from a distributes OAuth/UMA system). > > At this time, the process and route to standardization for identity events has not been determined. I expect that to be one of the discussions we will have on the list. > > The web page for the mailing list is: > > https://www.ietf.org/mailman/listinfo/id-event <https://www.ietf.org/mailman/listinfo/id-event> > > Regards, > > Phil > > @independentid > www.independentid.com <http://www.independentid.com/>phil.hunt(a)oracle.com <mailto:phil.hunt@oracle.com> > _______________________________________________ > OAuth mailing list > OAuth(a)ietf.org > https://www.ietf.org/mailman/listinfo/oauth

1 0

Notes from UMA legal subgroup telecon 2015-10-30
by Eve Maler 02 Nov '15

02 Nov '15

Fri Oct 30 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Report from IIW Eve will post John Wunderlich’s Consent Receipt demo video before the meeting There was a lot more relevant discussion too Input from Andrew Hughes — is he ready yet? Walk through Binding Obs to look for fodder What can we draw from all of this to shape our next outputs? AOB Attending: Eve, Jon, Adrian, Ann, Steve, Thomas, Andrew H, Joni, Mark Blockchains These were big at IIW 21! Take a look at the notes page <http://iiw.idcommons.net/IIW_21_Notes> generally, compared to six months ago, when there was one session. A blockchain is a distributed ledger. Our our call today, Thomas, Adrian, and Steve “speak blockchain” pretty well. Thomas noted that MIT Media Labs has a full-time digital currency initiative to combat some of the key (perceived or real) vulnerabilities. One particular session <http://iiw.idcommons.net/BlockChain_&_UMA_%E2%80%93_Two_Great_Tastes%E2%80%…> focused on blockchain wrt UMA. The session participants came up with four ideas for potential synergies. The most attractive was using a blockchain for receipts. The newer implementations give the features you’d need for this with colored coins <https://en.bitcoin.it/wiki/Colored_Coins>. The costs are latency (hour->day) and monetary costs ($.01 per transaction). In the case of using this technology for contracts, the incentives may be perverse regarding revocation: You typically want each party to protect their private key with their lives. But for contracts, one party may want to go to the judge and say “Sorry, I lost my key, so in fact I can’t prove and you can’t prove I took part in these transactions!” That sounds pretty bad. Then you’re back to key escrow. How much does that solve vs. “centralized” mechanisms? The data is still stored in a decentralized fashion. BLT It’s not just a sandwich anymore. There’s a bourbon, lemon, and tonic cocktail! PTP This is the Pumpkin Theater Protocol. Sarah had a consent receipts session act out the UMA protocol with receipts added, protecting a little autumn pumpkin as the resource. Consent Receipts vs. Auditable Transaction Receipts Consent Receipts in UMA is the session <http://iiw.idcommons.net/Consent_Receipts_in_UMA> where Sarah came up with the PTP. We liked the idea of defining a little spec for what Adrian calls a “notice endpoint”. UMA could choose to add this optionally to the protection and authorization APIs, for resource owners and requesting parties, at the authorization server if it wants to. This could make the AS one hub of receipt storage. Andrew notes it could be called the “shoebox endpoint”! :-) Adrian suspects that this could do away with the notion of “informed consent” completely. Wow. This is similar to an article <http://www.nejm.org/doi/full/10.1056/NEJMp1512205?query=TOC> he’s seen making the case that deidentification no longer puts you into a Safe Harbor by avoiding authorization and accountability. API.ConsentReceipts.org This API <http://api.consentreceipt.org/> from the CISWG illustrates how they are going about defining the “minimum viable consent receipt” spec. We showed how it produces (supposedly) human-readable receipts; the JSON output seemed not to be working for the moment but Eve saw it in John Wunderlich’s demo this week (for which she will hopefully be posting video soon). It appears that UX for the policy generator at CR.org is a new substitute for “markdown editing” (or whatever it is) presented in CommonAccord, and the “legal stack” that you can get out of CommonAccord as a template generator could be managed, versioned, and then hashed as a representation of what your contract is. When you put something onto the blockchain, the way the storage works, you only have a tiny amount of space into the scripting area. In the case of ColoredChains.org, they put the distributed hash table key into BitTorrent. You might have a much larger document with megabytes of data that you want to claim and provide a verifiable token for. The blockchain gives you the verifiability you need. A “colored coin” is just the hash piece. BitTorrent uses SHA-1, which isn’t considered secure anymore. So you use SHA-256, use three address slots, and use the second two for a SHA-256 hash broken into two pieces. HIE of One Dazza is running Future of Commerce on Nov 20-22, and Adrian will be launching HIE of One here, which is meant to be the “simplest practical UMA use case”. HIE of One’s project goal is to "provide a standards-based platform for durable relationship between customers and vendors. Our approach lowers the barrier to adoption by the vendors by (i) not introducing a new party to their base customer relationship, (ii) allowing the vendor the option to authenticate any requesting party, just like they do already, and (iii) offering an accessible reference implementation for both the vendor and any requesting party client to test against. The benefit of this approach to both the customer and the vendor is trust, in that valuable behavioral data does not leak to intermediary brokers. We will use UMA 1.0.1 as the core standard and suggest changes for UMA 2.0 as gaps are identified. OpenID Connect, CommonAccord, and MVCR will be referenced as appropriate.” Binding Obligations review Eve reviewed very briefly how the Binding Obs spec <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> is supposed to work. Andrew is working on doing the same approach for other identity-related protocols. Next steps If Andrew can provide us with his requirements by next time, it appears we’ll be very well positioned to start filling in at least some UMA-specific and non-UMA-specific clauses and deciding what technical approach to use and what “legal stacks” to define. One question: Are we interested to use the “sociotechnical systems” language? Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

7 11

Reminder: V1.0.1 45-day public review ends tomorrow (and some follow-on odds and ends)
by Eve Maler 01 Nov '15

01 Nov '15

As you should be well aware by now, WG members have special responsibilities when it comes to public review, IPR, how to report comments, etc. Details are here: http://kantarainitiative.org/pipermail/lc/2015-September/002762.html In preparation for next week’s meeting (VOTERS PLEASE ATTEND so we can make quorum), I’ve begun cleaning up minor editorial issues in the specs. See the seven commits made on Oct 28: https://github.com/KantaraInitiative/wg-uma/commits/master If you’ve been hanging onto additional clearly editorial issues (typos and such), please do report those ASAP, any way you like (even emailing me is fine). I’ve been considering issue #229 as an editorial clarification issue, since the truth of RPT-to-ticket relationship just is what it is. If I don’t hear from anyone else by public review close time, I’ll change the wording to “any RPT”: https://github.com/KantaraInitiative/wg-uma/issues/229 Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0