April 2016 - WG-UMA - mailman.kantarainitiative.org

Documenting UMA publication workflows
by Eve Maler 18 Jul '16

18 Jul '16

Hi folks-- Hope you are enjoying post-Christmas reentry or more holiday time, or whatever the case may be. Maciej and I are working on publishing the new Recommendations, and due to that, I unearthed the permanent/symbolic link information that I promised to Justin; we thought it would be a good idea to document the processes here -- and in the GitHub readme... It seems to work pretty well for now given that there isn't that much to the entire publishing process for our WG or others, but if you see ways to improve it for the future, let us know. After completing a draft spec revision cycle and getting it approved: 1. Edit the draft-uma-core-vn_n[_n] and draft-oauth-resource-reg-vn_n[_n] sources to change from Status #3 to #4 (see below), leaving the previous date in place. 2. Run the stylesheet over the XML sources to produce .html outputs, review the results as required, sync GitHub, and upload the last drafts by FTP (Eve and Oliver can do this). 3. Save the draft-uma-core-vn_n[_n] and draft-oauth-resource-reg-vn_n[_n] sources off to new files in the repo starting with rec- instead. 4. Change the Status section of the new files from #4 to #5, the date, and any other metadata (some of this has to be done in the stylesheet, which is in the repo). 5. Update the two specs' References links to each other in the Reference section. 6. Run the stylesheet over the XML sources to produce HTML output with .html extensions, review the results as required, sync to GitHub, and FTP the HTML results to the website (Eve and Oliver can do this). 7. Get symbolic links created (see below) from the versioned rec- HTML links to generic links (Oliver can do this). After launching a new draft spec revision cycle: 1. Save the rec-uma-core-vn_n[_n] and rec-oauth-resource-reg-vn_n[_n] sources off to new files in the repo starting with draft- and having the agreed new version numbers instead. 2. Edit the Status section from #5 to #1. 3. Proceed to edit the new drafts, and periodically produce HTML results that can be uploaded through FTP. 4. Get symbolic links created from the versioned draft- HTML links to generic links (Oliver can do this). Here are the stages of the Status section (embed links throughout as appropriate): 1. This document is a draft technical specification produced by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home>. 2. This document is a Kantara Initiative Draft Recommendation approved by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home>. 3. This document is a Draft Recommendation approved by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home> and certified by the Leadership Council to undergo a Kantara All-Member Ballot. 4. This document is a Draft Recommendation approved by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home> and certified by the Leadership Council to undergo a Kantara All-Member Ballot. The Ballot having passed, this document has been superseded by the Recommendation version of the document. 5. This document was developed by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home> and approved by the Membership of the Kantara Initiative <http://kantarainitiative.org/> as a Recommendation. Here is how the symbolic links work: https://docs.kantarainitiative.org/uma/rec-uma-core-vn_n[_n].html - Permanent link to specific Core Rec https://docs.kantarainitiative.org/uma/rec-oauth-resource-reg-vn_n[_n].html - Permanent link to specific RSR Rec https://docs.kantarainitiative.org/uma/draft-uma-core-vn_n[_n].html - Permanent link to specific Core Rec https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-vn_n[_n].ht… - Permanent link to specific RSR Rec https://docs.kantarainitiative.org/uma/rec-uma-core.html - Symbolic link to latest Core Rec https://docs.kantarainitiative.org/uma/rec-oauth-resource-reg.html - Symbolic link to latest RSR Rec https://docs.kantarainitiative.org/uma/draft-uma-core.html - Symbolic link to latest Core draft https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg.html - Symbolic link to latest RSR draft *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 2

Notes from UMA legal telecon 2016-04-29
by Eve Maler 29 Apr '16

29 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-29 - Accountability (data controller) vs. responsibility (data processor) in relation to the data subject (this topic came up at our UMA Legal IIW session) - Terminology <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>: the next generation – can we tackle Grantee subtleties next? - What is the right structure for UMA Legal work and review? (this topic came up at our UMA Legal IIW session) Attending: Eve, John W, Adrian, Jon N, Mary, Dazza, Ann RACI charts map the responsible/accountable/consulted/informed split. We discussed at IIW22 how the accountable body, the data controller, would typically outsource to a third party, the data processor, some work. It's optional to outsource. Would could it possibly mean if Alice really runs her own AS (she's the ASO) and her own RS (she's the RSO)? Could the AS be viewed as a DP in any sense? We recognize that conceiving of the DS as a DC is really novel. The IIW microservices conversation is relevant to this because micro-level service conversations that go cross-domain don't yet have a "legal model" of personal data flow. Each RS seems naturally to be a DC. Okay, but what about the case where you have APIs that allow clients to put data back in to the service? E.g., if the API presents a POST-based call that lets a multitude of clients send various kinds of PII-bearing data to the service for safekeeping? A cloud file system is a great example; there are lots of third-party GDrive clients. Maybe there's some split of DC and DP roles among resource servers and clients for any one API, determinable by their contractual trust relationships. We didn't even list *RSO - Client Operator* as one of our trust relationships below, because so it's clearly out of our scope. An important note: Alice's interactions (in whatever technical or legal role) with the AS and RS are actually out of band; there are no UMA messaging arrows there. There's only "contractual" (or role?) and "regulatory" reality. John W is suggesting that we have two diagrams of UC1 (etc.), the current one and a new one that carries an analysis of how the DS, DC, and DP roles might map onto our roles. Jim and Thomas have an opportunity, if they wish, to bring it up at the GLTL MIT event they're attending next week. The exercise would be to map the flows of information represented in the use cases to the delegation of authority and responsibility represented by the model of authority and responsibility in the GDPR. Is the AS even anything in this system? Maybe nothing; it's novel. Jon N believes it doesn't add anything and could make things work. UMA brings something new, and the problem is of consent. The AS, in GDPR terms, must stand in for the DS, and the critical problem is that it may be difficult to make the case for this important role given the regulatory regime that never imagined this role. The AS needs to be the DS's "agent"! How can we achieve this? Let's seriously consider outreach on this score as part of our remit. Watch out for missing meetings in our schedule. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-29
by Eve Maler 28 Apr '16

28 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-29 - Accountability (data controller) vs. responsibility (data processor) in relation to the data subject (this topic came up at our UMA Legal IIW session) - Terminology <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>: the next generation – can we tackle Grantee subtleties next? - What is the right structure for UMA Legal work and review? (this topic came up at our UMA Legal IIW session) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

G2C attribute sharing use cases / OIX workshop event in London on May 5
by Eve Maler 25 Apr '16

25 Apr '16

Though the WG isn't meeting formally for a little while, we do always look for events where we can gather in person when possible, and another potential one has arisen. For those of you interested in attribute sharing use cases and where UMA might come into the picture, particularly in a government-to-citizen context, this is be one of the topics we'll explore at an OIX workshop on May 5th in London (that's just a couple of weeks from now): https://www.eventbrite.co.uk/e/oix-workshop-5th-may-2016-hosted-by-barclays… For some background on the motivations, you can check out this article: http://www.ukauthority.com/UKA-Local-Digital/Entry/5958/local-and-central-g… If you think you'll be there, let me know! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: User-Managed Communications
by Mike Schwartz 21 Apr '16

21 Apr '16

Interesting ideas and comments from Igor Zboran -------- Original Message -------- Subject: User-Managed Communications Date: 2016-04-20 15:02 From: "Igor Zboran" <izboran(a)gmail.com> To: <mike(a)gluu.org> Hello Mike, It has been a while since I was active on the UMA WG. Most recently, I worked as a solutions architect on Privacy Box project for one big customer Orange SK, which is a Slovak mobile network operator. Privacy Box is a secure data storage built on the top of the Identity-Based Privacy [1] trusted model. During my work I was trying to evangelize OAuth2/UMA all the time but without any significant success. It was rather disappointing for me. Gradually, I've realized that there is a marketplace for User-Managed THIS AND THAT built on the top of the OAuth2 protocol. Getting it understood I've started to look at the UMA from a wider perspective. Then the idea of User-Managed Communications (UMC) Platform came up. It is a platform that brings together people, processes, data, and things in an intelligent, manageable and secure manner. You can find the basic info here: https://token7.com [2]. From my point of view, the most valuable UMC Platform feature is the federation support. You can find more info here: https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… [3]. Just imagine it - with UMC Platform anybody can be a 'communications provider' on their own. Not for voice services but for various Internet of Everything services. Feel free to ask me anything if you are interested in UMC Platform. For the time being I prefer written communication because I am not fluent in spoken English. Best regards, Igor Zboran Solutions Architect Links: ------ [1] https://igi64.github.io/ibp.html [2] https://token7.com [3] https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… -- ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Draft minutes of UMA telecon 2016-04-14
by Eve Maler 21 Apr '16

21 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31>: They're approved. Wide ecosystem *Adrian's solution proposal* Alice has to have exactly one AS, and it has to work in a partitioned manner, such that Bob, the AS, and the RS have to work in a situation where they're on the same LAN with no Internet connectivity; this is required for #wideeco. Alice's AS has to be able to handle a client of Bob's if it's a web browser. Why the limited connectivity? Because if Alice decides that her AS wants to be on her phone vs. in the cloud, it may need to survive this lack of connectivity. Sal comments: The widest possible ecosystem would include examples of this, and there is some IoT that has this requirement, but this is not necessarily the best test of solutions for #wideeco. Eve wonders if we should be modularizing our problem space vs. bundling this challenge into #wideeco vs. in #IoT. Kathleen asks if this makes the ecosystem narrow vs. wide. What is the relationship between limited connectivity and the notion that Alice should ideally have exactly one AS? If the AS is "always on", then it would seem to be able to fulfill the needs of the other two components. If it has limited connectivity, then it would have problems whether Alice has one or more than one. Eve's solution proposal Alice's AS dynamically gets client credentials to Bob's claim sources. Lots of people have independently come up with this. In fact, MitreID Connect implements it. It's WebFinger-enabled. There's a constraint on the need to be in a canonical domain. (More notes may be coming from Sal.) Attendees As of 13 Apr 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Kathleen 3. Sal 4. Andi 5. Eve 6. Mike 7. Sarah Non-voting participants: - Scott - Justin - Adrian - Jin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

[legal] No legal subgroup call this Friday after all
by Eve Maler 21 Apr '16

21 Apr '16

Sorry for the almost-late notice, but it seemed appropriate to cancel Friday's call as I won't have a chance to do any model text edits tomorrow because I'll be unavoidably offline all day, and I know Jim H. is really slammed with lots of other things. We do have a fair amount of model text progress to share at IIW (again, let's please meet near the barista early on Day 1 to discuss how to go about this), so let's do that. Thanks, *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-15
by Eve Maler 20 Apr '16

20 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-15 - Grantee and Resource definitions; how to handle role stacking (Grantor can be Resource Subject, RSO can be ASO, etc.) – handle in a generic way? (see this thread <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/%5Bleg…> ) - (Based on input from Scott D.) RSO - ASO model clauses (original proposal <https://kantarainitiative.org/confluence/Newly%20revised%20versions%20of%20…> ): - How to parameterize to enable different legal models for handling the granting of "access"? - How to identify/parameterize to enable exceptions to normal access/non-access? (see decision tree <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> ) - How to handle notification requirements? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Avoiding huge holes in our WG meeting schedule
by Eve Maler 20 Apr '16

20 Apr '16

To smooth out our meeting schedule a bit, I'm hoping we can add a couple of non-Thursday meeting times to make up for missed meetings. Rather than a heavyweight process, I'm going to propose a few particular dates/times that work for me, and ask for private responses back from those people who tend to attend. Week of Apr 18: WG call Apr 21 canceled due to Eve absence (still have a legal call Apr 22) - How about meeting *Wed Apr 20 9am PT*? (usual hour for WG calls, one day earlier) - Topic: Justin's #wideeco (and #IoT and #simplify and...?) solution proposal Week of Apr 25: WG call Apr 28 canceled due to IIW (still have a legal call Apr 29) - No replacement meeting Week of May 2: WG call May 5 canceled due to Eve absence - Legal call May 6 may be canceled as well due to Eve absence - But if not, would *Fri May 6 9am PT* make a good substitute for a WG call? - Likely topic: more #wideeco, likely still Justin's proposal Week of May 9: WG call May 12 canceled due to EIC (legal call May 10 also canceled) - No replacement meeting Rest of May: Back to regular meetings Thanks in advance. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Interested in 20% off IIW tickets?
by Eve Maler 19 Apr '16

19 Apr '16

Kantara is a sponsor, and there are some discounted passes available with this link! https://iiw22.eventbrite.com/?discount=KANTARA_XXII_20 *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1