March 2016 - WG-UMA - mailman.kantarainitiative.org

Agenda for UMA legal telecon 2016-03-11
by Eve Maler 11 Mar '16

11 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: … [View More]

1 0

[legal] The brute-force method of specifying what a RO wants (when it comes to a RS/RSO)
by Eve Maler 10 Mar '16

10 Mar '16

Mark L and I were IMing a couple of weeks back, discussing some of the things that could constitute "consent instructions" in UMA. I ended up typing out what I thought of as what Alice (y'know, the resource owner or her proxy/guardian/agent :-) wants some RS operator "X" to do on her behalf in "plain English": - Form an agreement with me and my AS operator "Y" to put some set of resources managed by me under the protection of that AS - I might or might not have had a choice about … [View More]

1 0

Summertime skew is coming
by Eve Maler 10 Mar '16

10 Mar '16

There is a roughly two-week period starting -- if my calculations are correct -- next week, when North America and other parts of the world experience what I refer to as "summertime skew" (as in "There ain't no cure for the...") because we all start/end daylight saving time on different dates. This group treats North America as canonical because, well, it's where I live. :-) So please doublecheck the Kantara UMA WG calendar <http://kantarainitiative.org/confluence/display/uma/Calendar>, … [View More]

1 0

Draft minutes of UMA telecon 2016-03-10
by Eve Maler 10 Mar '16

10 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-10 MinutesDiscussion of Kantara's new organizational structure Is this new structure of any concern? It seems not; it's a mark of Kantara's growth and maturity. APAC-friendly meeting series Eve will reach out to those likely most affected if the series is changed to see if those people would mind if she offers ad hoc syncs instead. Roll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2016-02-… [View More]25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-02-25>: APPROVED Updates from recent meetings and events *IAPP Canada:* John W was approached by an IAPP Canada organizer about doing a technical presentation, and he reached out to Andrew Hughes to help put together a panel on UMA, so as to inject more interesting technicality into the proceedings. John and Eve will sync on getting some good UMA slide fodder. 40% of the IAPP is made up of lawyers, so they'll have to go for the right level. We're looking at leveraging this into another opportunity at IAPP/CSA's "Privacy. Security. Risk." event in September. Yesterday's APAC-friendly meeting had a big focus on IAPP Canada preparations. *RSA:* Eve and Josh Alexander presented, and Eve got to spend a few minutes on UMA in the talk. She has been hearing repeatedly that UMA has been coming up in "third-party" conversations she isn't in. [image: (smile)] She has die-cut stickers to give UMAnitarians, and they got snapped up at RSA. She also had interesting side conversations about health, energy, other use cases for UMA (relevant tweet <https://twitter.com/IdentityHutch/status/705827488388100098>). *HIMSS:* Not a lot of UMA-related news. Justin gave an overview to the Argonaut and FHIR project folks, and it came up in conversation a few times. Adrian observes that they don't know of any pilots. François notes that he doesn't know of pilots either. Delegation is the key unique use case, where patients can delegate access. *Btc Expo:* Adrian heard some interesting avenues there. Andi has been hearing blockchain/UMA opportunities. *CIS:* Andi notes that there is a distributed ledger/blockchain track, and a privacy track as well. Everyone please register and book hotel rooms ASAP! (And don't forget to sign up for IIW <http://eventbrite.com/e/internet-identity-workshop-xxii-22-2016a-tickets-19…> .) Why UMA? Eve has asked Domenico (our UX and graphics editor!) to put together some material for our wiki to highlight the "Why?" of UMA for businesses as an important audience. He will share his research on the list. Eve would like to ask everyone to contribute new "collateral" to this area. The impetus was Robert asking Eve for use cases, and our finding that our Case Studies page doesn't suffice. Mike asks that we present Enterprise UMA more prominently as this is an easier sell than privacy. Therefore, Mike should contribute content. What about Pedro's use case? *AI:* Eve: Approach Pedro at Red Hat about their use case. A barrier is lack of libraries, including RS support. In fact, this has just come up on the UMA Dev list, and this is the exact purpose of the UMA Dev WG, right down to putting the emphasis on the RS. Eve also likes how Nat had published an easy Hello, World OIDC client app on his blog to show everyone how small and easy it could be. There are lots of great ways other than (boring?) slideware to document and persuade about UMA: - Pumpkin security theater - John is big on putting together an interactive whiteboard why-and-how presentation - A music video <https://drive.google.com/open?id=0B7aQF7z4Xp_yQVcxLUdiZzlLUVk> (this one is about privacy generally, from RSAC) - Other ideas <http://opencreds.org/> for presentation Issue 239 The main issue in the extension spec <http://htmlpreview.github.io/?https://github.com/KantaraInitiative/wg-uma/b…> is whether it can coexist with the main spec or whether it "stomps on" the main spec. This likely affects the extension spec title, several instances of language, and the configuration data design – it should probably invent a new endpoint that exists alongside the original endpoint. Coexistence would dictate changing our previous consensus about seeing little reason to deploy the "unenhanced" claims-gathering mechanism. Reasons for coexistence would be backwards compatibility with the existing UMA spec(s), and we still could make arguments for someone having a specialized environment that does claims-gathering and doesn't really need the enhancement. Note that the old endpoint would be marked for eventual deprecation and disabling. An important question is whether it's even possible to not support the old endpoint. George argues for it to be possible for an AS not to support the "old" endpoint on security grounds. And in fact, this could be very clean because you just don't support the "claims-gathering method" as offered by regular UMA. And now there's a draft non-normative companion doc <http://kantarainitiative.org/confluence/display/uma/Understanding+the+Sessi…>. Eve's thinking is that all vulnerabilities found in protocols such as this should come with docs like this as a kind of FAQ. *AI:* Eve: Ask the WG about one more ad hoc meeting early next week to see about finalizing decisions on spec text so we can close out the issue next week and publish. Attendees As of 18 Feb 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. François 2. Domenico 3. Andi 4. Robert 5. Maciej 6. Eve 7. Mike Non-voting participants: - Adrian - John W - Justin - Gil - Arlene - George Regrets: - Sarah - Thomas *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl [View Less]

1 0

Why UMA for Business
by Domenico Catalano 10 Mar '16

10 Mar '16

Hi all, I've researched a little bit about "Why Business needs UMA”. In attach a draft presentation, where I've gathered some ideas extracted and elaborated from the following resources: Customer Data: designing for transparency and trust <https://hbr.org/2015/05/customer-data-designing-for-transparency-and-trust> Social Physics and the data driven society <http://sites.nationalacademies.org/cs/groups/pgasite/documents/webpage/pga_…> New deal on Data <http://civics.com/… [View More]

2 1

Reviewing our issue #239 materials and considering a new mitigation idea
by Eve Maler 09 Mar '16

09 Mar '16

Maciej has prepared a new version of the extension spec, and it's now on GitHub <http://htmlpreview.github.io/?https://github.com/KantaraInitiative/wg-uma/b…>. And thanks to input from Sarah, I've put together a companion non-normative document on the UMA wiki <http://kantarainitiative.org/confluence/display/uma/Understanding+the+Sessi…> . In writing the final part of the companion document, I started thinking about a potential new mitigation idea when it came to describing why … [View More]strong authentication *after* claims-gathering wouldn't work: I suddenly wasn't sure that strong auth doesn't work in all circumstances. *N.B.:* With this inquiry, note that my goal isn't to delay getting the word out about this whole thing! It's simply to consider any mitigation that might be reasonable, and discard it expeditiously if it doesn't fit. So I'm hoping we can examine it in our call and: a) reject it as unsuitable, b) reject it as technically suitable but failing some other criterion, or c) accept it as an alternate or additional mitigation. So here goes. Given the following: - The cycle of trust elevation (need_info) is repeatable, according to AS needs. (Which gives an interestingly flexible mechanism.) - Only trust elevation that uses the requesting party claims endpoint is susceptible to session fixation. ...I started wondering whether it *might* be viable to suggest the following as a mitigation: - The policy conditions include both some claim(s) being supplied and, *afterward*, Bob being able to authenticate, to some level of strength, as Bob. (That is, there is a certain authentication_context and identity required, whether explicitly in an error_details hint, or implicitly. Currently we only have an in-band way to indicate authentication hints, not the required identity.) Notice that a precondition for the attack is that Eve and Bob each have their own AATs, even though their clients have identical client IDs; this gives a hook for transaction context differentiation. The theory is that, if Eve were to initiate the session, phish Bob to gather his credentials, and then take over again after he's done, Eve would fail the second policy condition because she can't authenticate as Bob -- unless she also stole his credentials, and that's a different attack entirely. And if Bob started the session legitimately, then of course Eve missed her chance to phish him and he can pass the strong-auth trust elevation test himself. Recall that elevating trust through authentication_context is basically like refreshing/strengthening the AAT. If anyone wants to squeeze identity out of an AAT, it's best to use OIDC vs. plain OAuth for it. My investigations showed that using an AAT for trust elevation is not unknown -- in fact, it's known to both Gluu and ForgeRock, in cases where you expect the AS to serve as the IdP for the requesting party as well as the resource owner. I suspect there may be privacy considerations to doing this in other topologies that should be carefully examined -- such as, could a requesting party's "AAT identity" compromise him somehow if it is used as part of trust elevation in addition to "claims-based RqP identity" at the AS? I thought this was incontrovertibly true once, but I haven't been able to re-prove it to myself... That's probably enough/too much food for thought for now, from me. I know others will want to jump into the thread before the meeting with more. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl [View Less]

1 0

Agenda for UMA telecon 2016-03-10
by Eve Maler 09 Mar '16

09 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-10 Date and Time - *Thu Mar 10,* 9-10am PT (*N.B.:* North America will change to Daylight Savings Time next week; this week is normal but *NEXT WEEK WILL BE ABNORMAL*) - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the … [View More]

1 0

Reminder: APAC-friendly sync 2016-03-10
by Eve Maler 09 Mar '16

09 Mar '16

- *Thu Mar 10* at APAC-friendly times - Voice: Skype: +99051000000481, room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - See the UMA calendar for additional dial-in and timing details (e.g., the call time = *Wed Mar 9 4pm PT*): http://kantarainitiative.org/confluence/display/uma/Calendar If you wish to be … [View More]

1 0

Fwd: [KI-LC] Real (and Open) Consent Workshop Announcement
by Eve Maler 06 Mar '16

06 Mar '16

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Mark Lizar - OCG <m.lizar(a)openconsentgroup.com> Date: Fri, Mar 4, 2016 at 12:59 PM Subject: [KI-LC] Real (and Open) Consent Workshop Announcement To: Kantara Leadership Council Kantara <lc(a)kantarainitiative.org> Hi LC, FYI - Please pass on. *** Dear Colleagues, I am very happy to announce the the next workshop in our year long series of events on Consent … [View More]

1 0

Reminder: No WG or legal meeting this week
by Eve Maler 02 Mar '16

02 Mar '16

Too many people traveling. Hope everyone is having a fun and productive time! Good seeing a few of you at the Non-Profits on the Loose party last night! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0