December 2015 - WG-UMA - mailman.kantarainitiative.org

Reminder: APAC-friendly UMA sync 2015-12-10
by Eve Maler 08 Dec '15

08 Dec '15

- *Thu Dec 10* at APAC-friendly times - Voice: Skype: +99051000000481, room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-12-09): http://kantarainitiative.org/confluence/display/uma/Calendar If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Thoughts on model clauses that describes proper functions of parties serving in UMA roles
by Eve Maler 08 Dec '15

08 Dec '15

The Binding Obligations <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> draft factors out descriptions of such functions first according to the party serving in the role and then according to the party to whom those functions are “owed”. For example, Section 2.4 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor16> contains the “obligations” of the Authorization Server Operator (the party operating the software service that performs the function of the UMA authorization server); Section 2.4.1 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor17> contains an “obligation” to the Authorizing Party (the party corresponding to the UMA resource owner), Section 2.4.2 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor18> contains an “obligation” to the Resource Server Operator (an party operating a software service that performs the function of an UMA resource server), and so on. If you look in Sec 2.4.1, you’ll see text like this: “When the Authorization Server issues a PAT to the Resource Server and as long as the PAT is valid, the Authorization Server Operator gains an obligation to the Authorizing Party to adhere to the Authorizing Party's policies accurately and timely in granting permissions.” For now, we can put aside the “When…, the [party] gains” construction, and save it as an idea for an optional model clause that could come into play if some legal team or individual wants to create an audit log entry/consent receipt requirement. Also note that what is called an “obligation”, I think may want to be a “commitment” or “prohibition” or “sanction” (or one of the other two norms coming from the sociotechnical norm <http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/TIST-13-governance.pdf> work). This would be more precise, and we could define those norm terms up front. Does this give a good direction for how we could “CommonAccordionify” our work?? :-) All this said, I don’t know if the Binding Obs set of “obligations” is the right set, inadequate, overstated, or legally wrongheaded! I’m sort of hoping that if we can make a run at accordionifying it, then the legal minds can really stare at it in familiar contract form and see what they think. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 6

HEART Profiles - HEART AS Key Rotation
by Adrian Gropper 07 Dec '15

07 Dec '15

I section 4.1 of http://openid.bitbucket.org/HEART/openid-heart-oauth2.html, we have : "jwks_uriThe fully qualified URI of the server's public key in JWK Set <http://openid.bitbucket.org/HEART/openid-heart-oauth2.html#RFC7517> [RFC7517] format" One of the reasons for this is to facilitate key rotation by the AS. Do we have or need a profile for how key rotation would be done with the RS? Thanks, Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 2

Email troubles
by Eve Maler 06 Dec '15

06 Dec '15

Folks-- If you sent me any off-list email in the last few weeks and have been waiting (im)patiently for a response or wanted to be sure I kept whatever it was in my archives, I have to ask you to re-send. I've had some kind of server crash and lost a bunch of email, some of which is definitely unrecoverable. Thanks/sorry in advance... Eve (from my iPad)

1 0

Reminder: UMA legal subgroup telecon 2015-12-4
by Adrian Gropper 04 Dec '15

04 Dec '15

- *Fri Dec 4* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar - Limits of delegation: Breach liability "safe harbor", audit, and notice when resource servers accept dynamic registration of a resource-owner specified authorization server. - AOB -- Adrian <http://patientprivacyrights.org/donate-2/>

2 2

Reminder: UMA legal subgroup telecon 2015-12-04
by Eve Maler 04 Dec '15

04 Dec '15

Please see the Meetings and Minutes page or the UMA calendar linked from http://tinyurl.com/umawg to find dial-in information. The basic goal for the rest of December is to flesh out UMA-specific "model clauses" for for the required functions of party roles, some of which would be required (axiomatic?) and some of which might be optional. By hook or by crook, I will send some simple examples as warmups before this meeting -- but won't be attending as I'll be on a plane. Adrian has offered to facilitate. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
by Mike Schwartz 01 Dec '15

01 Dec '15

UMA WG, This draft for proof of possesion is getting pretty far along: https://datatracker.ietf.org/doc/draft-ietf-oauth-proof-of-possession/ Justin did this nice web sequence diagram: http://gluu.co/oauth-pop-websequence My question is... do you think we should recommend proof of possesion tokens for the RPT? - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

3 4