September 2015 - WG-UMA - mailman.kantarainitiative.org

Handling spec writing process @ GitHub
by Maciej Machulak 02 Sep '15

02 Sep '15

Hi, It was discussed today how the current process of spec editing looks like on GitHub (currently the spec is here: https://github.com/KantaraInitiative/wg-uma) All the changes are done on this repository, some via branches and some directly to the master branch. It was suggested that maybe we could use distributed repos (each editor would have a fork of the repo) and changes to the main repo would be done via pull requests. While I agree that using pull requests is best practice, I think we could do without this for UMA spec editing. The current setup which we have is pretty low overhead and sufficient for our needs (we could probably improve on using branches but that's also not something we have to strictly stick to). However, I'd like to hear the opinion of others. Let me know so that we can act accordingly. Maciej -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

4 8

Associating the Requesting Party/Authorization client with the permission ticket.
by Farazath Ahamed 02 Sep '15

02 Sep '15

Hi, First of all thanks everyone for helping me out in this mailing list answering my questions that helped me a lot in getting through my GSoC. However, I am yet to complete my implementation. Therefore i will keep on pestering you with questions :) Getting to the question, We use the PAT to register permissions using the Permission Registration endpoint of the Protection API, do we have a standard way of associating the client who requests for access from the UMA protected resource server? Thanks -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

3 3

Drafts of Core and RSR specs for your immediate review
by Eve Maler 02 Sep '15

02 Sep '15

I have attached HTML versions of the specs for you review. (I’m not posting them on the site, so that nobody gets the idea they’re finished/vetted.) Many thanks to Maciej for working on a fresh Kantara-specific XSLT transformation! His work isn’t complete, so there are a few formatting/front page things yet to do; don’t worry about those. Everybody please review these formatted specs carefully for ALL the issues you care about, and report any new issues in GitHub <https://github.com/KantaraInitiative/wg-uma/issues> Or feel free to send notes to the list or to me privately if you like, and I can collate them. We will discuss everything this Thursday. I think we should probably take the time to continue our review through to Sep 10 if we feel at all rushed, or want to see complete new renditions. This is because, once we exit the 45-day Public Review period, we can no longer make technical changes without going back to square 1. We should be quite sure we’re happy with these drafts when they go into review. (Luckily, I no longer have a conflict with our Sep 10 meeting.) Here are some items that we already know need editing, discussion, or review: Don’t forget that there is new wording for permission ticket lifecycle management as discussed last week, which needs your review. See Core Sec 3.2.2. Our new wording in response to #161, Protocol assumes one resource owner per URL <https://github.com/KantaraInitiative/wg-uma/issues/161>, says “When a client attempts access to a presumptively protected resource without an RPT,...”. This appears one place in RSR, where I changed “an RPT” to “an access token” and added an [UMA] cross-reference. But in the Core spec, should it say “an access token” generically? Maciej and I discussed some questions he had around the RSR security considerations, in RSR Sec 4. What does a “valid web page” (a phrase that came from OAuth’s version) mean? I also recently added a new issue #185, RSR user_access_policy_uri: security considerations <https://github.com/KantaraInitiative/wg-uma/issues/185>, that may have us tweak that section a little further if we think it has merit. I actually implemented issue #179, Use OIDC specification style of providing a subsection for every type of response <https://github.com/KantaraInitiative/wg-uma/issues/179> and restructured Core so that every request and response has its own subsection — couldn't resist. :-) Of course, this meant major structural changes! Mostly I rearranged existing text, but I did end up having to rewrite section introductions and invent new introductions. And because Section 3 has a flow to it, I redid how the “flow chart” feel of the entire section works. Now the organization is a bit flatter (there is one bug I’d like to fix, which is that Core Sec 3.3-3.5 should actually be subsections in a single Sec 3.3), and each main subsection contains a consistent “how you got here” intro (and no outro). E.g.: “If the client's request at the protected resource has no RPT, or an invalid RPT or insufficient authorization data associated with the RPT as determined through RPT status checking (see Section 3.6), then assuming the resource server chooses to respond to the client,…” Thanks in advance, all, for your review and attention. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 5

All the latest on UMA on Wikipedia, in Italian
by Eve Maler 01 Sep '15

01 Sep '15

http://it.wikipedia.org/wiki/User-Managed_Access Thanks, Domenico! Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: APAC-friendly UMA sync 2015-09-03
by Eve Maler 31 Aug '15

31 Aug '15

Thu Aug 27 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-09-02): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0