April 2016 - WG-UMA - mailman.kantarainitiative.org

Documenting UMA publication workflows
by Eve Maler 18 Jul '16

18 Jul '16

Hi folks-- Hope you are enjoying post-Christmas reentry or more holiday time, or whatever the case may be. Maciej and I are working on publishing the new Recommendations, and due to that, I unearthed the permanent/symbolic link information that I promised to Justin; we thought it would be a good idea to document the processes here -- and in the GitHub readme... It seems to work pretty well for now given that there isn't that much to the entire publishing process for our WG or others, but if you see ways to improve it for the future, let us know. After completing a draft spec revision cycle and getting it approved: 1. Edit the draft-uma-core-vn_n[_n] and draft-oauth-resource-reg-vn_n[_n] sources to change from Status #3 to #4 (see below), leaving the previous date in place. 2. Run the stylesheet over the XML sources to produce .html outputs, review the results as required, sync GitHub, and upload the last drafts by FTP (Eve and Oliver can do this). 3. Save the draft-uma-core-vn_n[_n] and draft-oauth-resource-reg-vn_n[_n] sources off to new files in the repo starting with rec- instead. 4. Change the Status section of the new files from #4 to #5, the date, and any other metadata (some of this has to be done in the stylesheet, which is in the repo). 5. Update the two specs' References links to each other in the Reference section. 6. Run the stylesheet over the XML sources to produce HTML output with .html extensions, review the results as required, sync to GitHub, and FTP the HTML results to the website (Eve and Oliver can do this). 7. Get symbolic links created (see below) from the versioned rec- HTML links to generic links (Oliver can do this). After launching a new draft spec revision cycle: 1. Save the rec-uma-core-vn_n[_n] and rec-oauth-resource-reg-vn_n[_n] sources off to new files in the repo starting with draft- and having the agreed new version numbers instead. 2. Edit the Status section from #5 to #1. 3. Proceed to edit the new drafts, and periodically produce HTML results that can be uploaded through FTP. 4. Get symbolic links created from the versioned draft- HTML links to generic links (Oliver can do this). Here are the stages of the Status section (embed links throughout as appropriate): 1. This document is a draft technical specification produced by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home>. 2. This document is a Kantara Initiative Draft Recommendation approved by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home>. 3. This document is a Draft Recommendation approved by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home> and certified by the Leadership Council to undergo a Kantara All-Member Ballot. 4. This document is a Draft Recommendation approved by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home> and certified by the Leadership Council to undergo a Kantara All-Member Ballot. The Ballot having passed, this document has been superseded by the Recommendation version of the document. 5. This document was developed by the User-Managed Access Work Group <http://kantarainitiative.org/confluence/display/uma/Home> and approved by the Membership of the Kantara Initiative <http://kantarainitiative.org/> as a Recommendation. Here is how the symbolic links work: https://docs.kantarainitiative.org/uma/rec-uma-core-vn_n[_n].html - Permanent link to specific Core Rec https://docs.kantarainitiative.org/uma/rec-oauth-resource-reg-vn_n[_n].html - Permanent link to specific RSR Rec https://docs.kantarainitiative.org/uma/draft-uma-core-vn_n[_n].html - Permanent link to specific Core Rec https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-vn_n[_n].ht… - Permanent link to specific RSR Rec https://docs.kantarainitiative.org/uma/rec-uma-core.html - Symbolic link to latest Core Rec https://docs.kantarainitiative.org/uma/rec-oauth-resource-reg.html - Symbolic link to latest RSR Rec https://docs.kantarainitiative.org/uma/draft-uma-core.html - Symbolic link to latest Core draft https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg.html - Symbolic link to latest RSR draft *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 2

Notes from UMA legal telecon 2016-04-29
by Eve Maler 29 Apr '16

29 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-29 - Accountability (data controller) vs. responsibility (data processor) in relation to the data subject (this topic came up at our UMA Legal IIW session) - Terminology <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>: the next generation – can we tackle Grantee subtleties next? - What is the right structure for UMA Legal work and review? (this topic came up at our UMA Legal IIW session) Attending: Eve, John W, Adrian, Jon N, Mary, Dazza, Ann RACI charts map the responsible/accountable/consulted/informed split. We discussed at IIW22 how the accountable body, the data controller, would typically outsource to a third party, the data processor, some work. It's optional to outsource. Would could it possibly mean if Alice really runs her own AS (she's the ASO) and her own RS (she's the RSO)? Could the AS be viewed as a DP in any sense? We recognize that conceiving of the DS as a DC is really novel. The IIW microservices conversation is relevant to this because micro-level service conversations that go cross-domain don't yet have a "legal model" of personal data flow. Each RS seems naturally to be a DC. Okay, but what about the case where you have APIs that allow clients to put data back in to the service? E.g., if the API presents a POST-based call that lets a multitude of clients send various kinds of PII-bearing data to the service for safekeeping? A cloud file system is a great example; there are lots of third-party GDrive clients. Maybe there's some split of DC and DP roles among resource servers and clients for any one API, determinable by their contractual trust relationships. We didn't even list *RSO - Client Operator* as one of our trust relationships below, because so it's clearly out of our scope. An important note: Alice's interactions (in whatever technical or legal role) with the AS and RS are actually out of band; there are no UMA messaging arrows there. There's only "contractual" (or role?) and "regulatory" reality. John W is suggesting that we have two diagrams of UC1 (etc.), the current one and a new one that carries an analysis of how the DS, DC, and DP roles might map onto our roles. Jim and Thomas have an opportunity, if they wish, to bring it up at the GLTL MIT event they're attending next week. The exercise would be to map the flows of information represented in the use cases to the delegation of authority and responsibility represented by the model of authority and responsibility in the GDPR. Is the AS even anything in this system? Maybe nothing; it's novel. Jon N believes it doesn't add anything and could make things work. UMA brings something new, and the problem is of consent. The AS, in GDPR terms, must stand in for the DS, and the critical problem is that it may be difficult to make the case for this important role given the regulatory regime that never imagined this role. The AS needs to be the DS's "agent"! How can we achieve this? Let's seriously consider outreach on this score as part of our remit. Watch out for missing meetings in our schedule. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-29
by Eve Maler 28 Apr '16

28 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-29 - Accountability (data controller) vs. responsibility (data processor) in relation to the data subject (this topic came up at our UMA Legal IIW session) - Terminology <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>: the next generation – can we tackle Grantee subtleties next? - What is the right structure for UMA Legal work and review? (this topic came up at our UMA Legal IIW session) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

G2C attribute sharing use cases / OIX workshop event in London on May 5
by Eve Maler 25 Apr '16

25 Apr '16

Though the WG isn't meeting formally for a little while, we do always look for events where we can gather in person when possible, and another potential one has arisen. For those of you interested in attribute sharing use cases and where UMA might come into the picture, particularly in a government-to-citizen context, this is be one of the topics we'll explore at an OIX workshop on May 5th in London (that's just a couple of weeks from now): https://www.eventbrite.co.uk/e/oix-workshop-5th-may-2016-hosted-by-barclays… For some background on the motivations, you can check out this article: http://www.ukauthority.com/UKA-Local-Digital/Entry/5958/local-and-central-g… If you think you'll be there, let me know! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: User-Managed Communications
by Mike Schwartz 21 Apr '16

21 Apr '16

Interesting ideas and comments from Igor Zboran -------- Original Message -------- Subject: User-Managed Communications Date: 2016-04-20 15:02 From: "Igor Zboran" <izboran(a)gmail.com> To: <mike(a)gluu.org> Hello Mike, It has been a while since I was active on the UMA WG. Most recently, I worked as a solutions architect on Privacy Box project for one big customer Orange SK, which is a Slovak mobile network operator. Privacy Box is a secure data storage built on the top of the Identity-Based Privacy [1] trusted model. During my work I was trying to evangelize OAuth2/UMA all the time but without any significant success. It was rather disappointing for me. Gradually, I've realized that there is a marketplace for User-Managed THIS AND THAT built on the top of the OAuth2 protocol. Getting it understood I've started to look at the UMA from a wider perspective. Then the idea of User-Managed Communications (UMC) Platform came up. It is a platform that brings together people, processes, data, and things in an intelligent, manageable and secure manner. You can find the basic info here: https://token7.com [2]. From my point of view, the most valuable UMC Platform feature is the federation support. You can find more info here: https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… [3]. Just imagine it - with UMC Platform anybody can be a 'communications provider' on their own. Not for voice services but for various Internet of Everything services. Feel free to ask me anything if you are interested in UMC Platform. For the time being I prefer written communication because I am not fluent in spoken English. Best regards, Igor Zboran Solutions Architect Links: ------ [1] https://igi64.github.io/ibp.html [2] https://token7.com [3] https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… -- ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Draft minutes of UMA telecon 2016-04-14
by Eve Maler 21 Apr '16

21 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31>: They're approved. Wide ecosystem *Adrian's solution proposal* Alice has to have exactly one AS, and it has to work in a partitioned manner, such that Bob, the AS, and the RS have to work in a situation where they're on the same LAN with no Internet connectivity; this is required for #wideeco. Alice's AS has to be able to handle a client of Bob's if it's a web browser. Why the limited connectivity? Because if Alice decides that her AS wants to be on her phone vs. in the cloud, it may need to survive this lack of connectivity. Sal comments: The widest possible ecosystem would include examples of this, and there is some IoT that has this requirement, but this is not necessarily the best test of solutions for #wideeco. Eve wonders if we should be modularizing our problem space vs. bundling this challenge into #wideeco vs. in #IoT. Kathleen asks if this makes the ecosystem narrow vs. wide. What is the relationship between limited connectivity and the notion that Alice should ideally have exactly one AS? If the AS is "always on", then it would seem to be able to fulfill the needs of the other two components. If it has limited connectivity, then it would have problems whether Alice has one or more than one. Eve's solution proposal Alice's AS dynamically gets client credentials to Bob's claim sources. Lots of people have independently come up with this. In fact, MitreID Connect implements it. It's WebFinger-enabled. There's a constraint on the need to be in a canonical domain. (More notes may be coming from Sal.) Attendees As of 13 Apr 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Kathleen 3. Sal 4. Andi 5. Eve 6. Mike 7. Sarah Non-voting participants: - Scott - Justin - Adrian - Jin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

[legal] No legal subgroup call this Friday after all
by Eve Maler 21 Apr '16

21 Apr '16

Sorry for the almost-late notice, but it seemed appropriate to cancel Friday's call as I won't have a chance to do any model text edits tomorrow because I'll be unavoidably offline all day, and I know Jim H. is really slammed with lots of other things. We do have a fair amount of model text progress to share at IIW (again, let's please meet near the barista early on Day 1 to discuss how to go about this), so let's do that. Thanks, *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-15
by Eve Maler 20 Apr '16

20 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-15 - Grantee and Resource definitions; how to handle role stacking (Grantor can be Resource Subject, RSO can be ASO, etc.) – handle in a generic way? (see this thread <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/%5Bleg…> ) - (Based on input from Scott D.) RSO - ASO model clauses (original proposal <https://kantarainitiative.org/confluence/Newly%20revised%20versions%20of%20…> ): - How to parameterize to enable different legal models for handling the granting of "access"? - How to identify/parameterize to enable exceptions to normal access/non-access? (see decision tree <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> ) - How to handle notification requirements? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Avoiding huge holes in our WG meeting schedule
by Eve Maler 20 Apr '16

20 Apr '16

To smooth out our meeting schedule a bit, I'm hoping we can add a couple of non-Thursday meeting times to make up for missed meetings. Rather than a heavyweight process, I'm going to propose a few particular dates/times that work for me, and ask for private responses back from those people who tend to attend. Week of Apr 18: WG call Apr 21 canceled due to Eve absence (still have a legal call Apr 22) - How about meeting *Wed Apr 20 9am PT*? (usual hour for WG calls, one day earlier) - Topic: Justin's #wideeco (and #IoT and #simplify and...?) solution proposal Week of Apr 25: WG call Apr 28 canceled due to IIW (still have a legal call Apr 29) - No replacement meeting Week of May 2: WG call May 5 canceled due to Eve absence - Legal call May 6 may be canceled as well due to Eve absence - But if not, would *Fri May 6 9am PT* make a good substitute for a WG call? - Likely topic: more #wideeco, likely still Justin's proposal Week of May 9: WG call May 12 canceled due to EIC (legal call May 10 also canceled) - No replacement meeting Rest of May: Back to regular meetings Thanks in advance. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Interested in 20% off IIW tickets?
by Eve Maler 19 Apr '16

19 Apr '16

Kantara is a sponsor, and there are some discounted passes available with this link! https://iiw22.eventbrite.com/?discount=KANTARA_XXII_20 *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Shared Door Challenge - Was: Asking #wideeco "solution champions" to prepare to present their ideas at upcoming WG calls
by Adrian Gropper 14 Apr '16

14 Apr '16

Here's how a shared door lock would work today: Step 1: Bob approaches the shared door and sees a sign telling him how to access the building directory 2: Bob connects his phone to the local wi-fi access point 3: Bob types the URL of the building directory into his browser - the door lock RS serves up a directory page 4: Bob clicks Alice's link in the RS directory page - is redirected to Alice's AS 5: Alice's AS challenges Bob somehow - it could be that Bob has to enter his cell phone number, or open a WebRTC call with Alice - whatever 6: Alice thinks up an access PIN for Bob - enters Bob's cell phone number and PIN into her AS 7: Alice tells Bob the PIN - however she does that 8: Bob enters the cell phone number and PIN into the AS 9: The RS opens the door Case A (LAN only): The sequence above mirrors what happens today when Bob talks to Alice and is "buzzed-in". The only difference is that Alice must sign-in to her AS to enter a phone number and PIN and Bob must enter the same two things into the AS. This is not a great user experience but it is needed because we took away the proprietary buzzer connecting Alice to the lock. The benefit is that Alice can decide when Bob's PIN must expire. Case B: Add a WAN connection and an IDP that might or might not be trusted. Alice's AS asks Bob for his IDP and name https://onename.com/agropper . Alice's AS either accepts Bob's attributes automatically or it sends a text message to Alice with the link. Alice replies to the text message with yes and an optional expiration date. I'm not sure what the challenge analysis document is. Adrian On Sunday, April 10, 2016, Eve Maler <eve(a)xmlgrrl.com> wrote: > Adrian, so far this looks like a use case (and an interesting IoT use case > at that) -- but not quite a solution description, in that we don't know if > it actually resolves #wideeco problems we've identified. E.g., the > mechanism of providing claims works great in narrow and medium ecosystems > already, but it seems to break down in wide ecosystems for various reasons. > > Can you please start a new thread, and also be sure to describe which > challenges in the challenge analysis document (and/or any other new > challenges not previously discussed) your solution purports to solve? It's > perhaps also worth noting that there are smart door looks and doorbell > products on the market, if not ones with UMA capabilities; can we learn > from what they do now? > > (We'll probably want a new thread per solution area.) > > > > *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl > > > On Sat, Apr 9, 2016 at 2:07 PM, Adrian Gropper <agropper(a)healthurl.com> > wrote: > >> AI for discussion: Different patterns of Alice's AS and RS's accepting >> and providing federated logins? (Adrian) >> >> I would like to champion a #wideeco solution called "A Lock to Alice's >> Shared Door" as follows: >> >> - The RS is an IoT lock on the shared door of a multi-unit condo. >> - The lock has to work even if disconnected from the internet. >> - Alice has her own AS in her own condo. >> - Alice has to be able to unlock the shared door even if disconnected >> from the internet. >> - Alice carries a smartphone that can connect to the RS and AS >> locally and via the internet. >> - Bob is a guest that wants to access the shared door based on >> Alice's AS policies. >> - Bob carries a smartphone that can connect to the RS and AS locally >> and via the internet. >> - The shared door RS and Alice's AS are each built on standard >> commodities that include a typical secure element. >> - e.g.: https://www.arduino.cc/en/Main/ArduinoMKR1000 including >> http://www.atmel.com/products/security-ics/cryptoauthentication/ecc-256.aspx >> - Bob can present claims to Alice's AS: >> 1. by referencing a personal certificate previously stored in the >> AS (e.g.: using PGP, a FIDO key, or equivalent) >> 2. by contacting Alice out-of-band for a one-time credential into >> her AS >> 3. by authenticating to the RS (assuming the RS has been >> configured as an IdP and is trusted by the AS) >> 4. by authenticating to an IdP (assuming the internet is working >> and the IdP is trusted by the AS) >> 5. by authenticating to a blockchain persona like >> https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-browser-b133a83fe… >> this could involve a camera and face recognition as in >> http://www.planetbiometrics.com/article-details/i/4238/desc/google-triallin… >> 6. by following a claims gathering process directed by Alice's AS >> >> I believe these 6 are the only distinct categories and I would hope that >> Alice's AS supports all of them if Alice is willing to take the time to >> configure them. Within each category, there will be various user >> experiences depending on what kind of technology Bob has in his pocket. >> >> Adrian >> >> On Fri, Apr 8, 2016 at 4:40 PM, Eve Maler <eve(a)xmlgrrl.com> wrote: >> >>> I've also done a little bit of suggested reordering of the roadmap >>> <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> >>> priorities to account for the appearance of so many use case buckets in the >>> first bullet in the list, and other realities; please see what you think. >>> Essentially, we can't really consider Justin's proposals for #wideeco >>> without also considering their #simplify impact, and some of their #IoT >>> impact, but some other #IoT analysis will have to wait a bit longer. Also, >>> we don't have any #security work on our docket at the moment, but more >>> could arise at any time, and there's some constant legal-subgroup work >>> being done. Etc. >>> >>> Oh, and I've put the named people who I hope will take on action items >>> directly on the cc list this time, to draw their attention to my request. >>> >>> Happy Friday! :-) >>> >>> >>> >>> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>> >>> >>> On Fri, Apr 8, 2016 at 9:52 AM, Eve Maler <eve(a)xmlgrrl.com> wrote: >>> >>>> Hi all-- The agenda for our call yesterday tried to summarize what I >>>> think is the most up-to-date list of ideas I've heard so far: >>>> >>>> >>>> - Examining solutions for wide ecosystem challenges (Eve's >>>> challenge analysis doc >>>> <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – >>>> look at: >>>> - UMA-protected UserInfo? (various) *[Mike]* >>>> - Different patterns of Alice's AS and RS's accepting and >>>> providing federated logins? (Adrian) >>>> - "Multi-party" proposal? (Justin) (engages with #APIsec and >>>> #simplify use case buckets too) *[also #IoT as discussed on >>>> Thursday]* >>>> - AS requests claims and client does act_as Bob to send them? >>>> (Mike, James) >>>> - Alice's AS dynamically gets client credentials to Bob's claim >>>> sources? (various) *[Eve]* >>>> - Meta-suggestion: Should trust elevation methods be >>>> modularized? (James) >>>> - Others? >>>> >>>> >>>> Can the people identified above please take action items to present at >>>> upcoming calls? If you're not clear on what this is about, or if you can't >>>> do this action, please let me know. Thanks! >>>> >>>> And remember, we've got some upcoming "holes" in our Q2 WG meeting >>>> schedule. I've just deleted some of our Thursday meetings (Fridays haven't >>>> been impacted yet), with possibly a couple more to come. We've got some >>>> exciting work coming up, so let's try to press ahead with offline prep such >>>> as this. >>>> >>>> >>>> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>>> >>>> >>> >> >> >> -- >> >> Adrian Gropper MD >> >> PROTECT YOUR FUTURE - RESTORE Health Privacy! >> HELP us fight for the right to control personal health data. >> DONATE: http://patientprivacyrights.org/donate-2/ >> > >

3 4

Agenda for UMA telecon 2016-04-14
by Eve Maler 13 Apr '16

13 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14 Date and Time - *Thu Apr 14,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31> - Solution proposals against wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – today's solution proposals include: - Alice's AS dynamically gets client credentials to Bob's claim sources (Eve) - Different patterns of Alice's AS and RS's accepting and providing federated logins (Adrian) - (Adding a new solution proposal to the list for a future meeting: Sourcing Bob's claims from a distributed ledger (champion?)) - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

[legal] Use cases and design patterns for resource owner/Grantor/Resource Subject
by Eve Maler 13 Apr '16

13 Apr '16

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

[legal] Newly revised versions of RSO - ASO model clauses, with questions/commentary
by Eve Maler 12 Apr '16

12 Apr '16

We agreed to start with the RSO - ASO trust relationship because it's most "upstream" and has no dependencies. It also turns out to be one of the most simple, at least in terms of previously brainstormed obligations/clauses. Below, I've taken the original obligations/duties and revised and commented on them given recent conversations. Let's discuss tomorrow. ==== *Condition applying to all:* For the period that the {Resource_Server_Operator} and {Authorization_Server_Operator} have mutually agreed to serve in these respective roles for each other… *Candidate duty A.* “RSO-Register-Accurately-and-Timely” …the RSO gains an obligation to the ASO to register resource set descriptions accurately and timely. Q A1. Do we have to qualify the wording above any further (given that we haven’t reached “Resource Subject/Grantor mention stage” yet) to talk about which resource set descriptions need to be registered? Note that there is no obligation for any RS to give any Grantor a choice about which resources to put under/take out of AS protection etc. It’s actually totally up to the RS. *Candidate duty B.* “RSO-Respect-Permissions” …the RSO gains an obligation to the ASO to respect the permissions that the AS associates with “bearer”-type RPTs when such RPTs are later borne to the RS by Clients. Q B1. This gets to the heart of our #RSctrl issue, as represented by the decision tree in these January meeting notes <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…>. Do we need to rejigger this so that it is a) finer-grained and/or b) per-Resource Subject or on a case-by-case basis vs. per-ASO? Note that this a matter for ASO liability, as much as for Resource Subject concern, so this trust relationship does need to bear some of the weight. Much work to do here! Q B2. The “bearer”-type token profile is mentioned specifically because each token profile comes with its own distribution of policy decision-making responsibility between RS and AS. Does this make sense? *Candidate duty C.* “ASO-Elevate-Trust-Accurately” …the ASO gains an obligation to the RSO to perform trust elevation accurately and represent the results of trust elevation accurately in permissions in “bearer”-type RPTs. Q C1. This is the reciprocal liability duty that the ASO carries regarding the RSO. Does that make sense? ==== What other clauses might make sense to add? ==== The theory is that if we get the RSO - ASO clauses right, then these would all be prerequisite for the next two batches, Grantor - ASO and Grantor - RSO. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 5

$100 to support UMA
by Mike Schwartz 11 Apr '16

11 Apr '16

Please vote "YES" if you can contribute $100 to an UMA video being shot at IIW! http://gluu.co/iiw-uma-video-poll It would be great if we could get 15 people before Eve offers to contribute, because you all know how much she's done for this effort! - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Smart Contracts - Bridging the Gap Between the Real World and Blockchain - Blockchain News
by John Wunderlich 10 Apr '16

10 Apr '16

Saw this on another list, and thought some of you might be interested: http://www.the-blockchain.com/2016/04/06/smart-contracts-bridging-the-gap-b… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Asking #wideeco "solution champions" to prepare to present their ideas at upcoming WG calls
by Eve Maler 10 Apr '16

10 Apr '16

Hi all-- The agenda for our call yesterday tried to summarize what I think is the most up-to-date list of ideas I've heard so far: - Examining solutions for wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – look at: - UMA-protected UserInfo? (various) *[Mike]* - Different patterns of Alice's AS and RS's accepting and providing federated logins? (Adrian) - "Multi-party" proposal? (Justin) (engages with #APIsec and #simplify use case buckets too) *[also #IoT as discussed on Thursday]* - AS requests claims and client does act_as Bob to send them? (Mike, James) - Alice's AS dynamically gets client credentials to Bob's claim sources? (various) *[Eve]* - Meta-suggestion: Should trust elevation methods be modularized? (James) - Others? Can the people identified above please take action items to present at upcoming calls? If you're not clear on what this is about, or if you can't do this action, please let me know. Thanks! And remember, we've got some upcoming "holes" in our Q2 WG meeting schedule. I've just deleted some of our Thursday meetings (Fridays haven't been impacted yet), with possibly a couple more to come. We've got some exciting work coming up, so let's try to press ahead with offline prep such as this. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Notes from UMA legal telecon 2016-04-08
by Eve Maler 10 Apr '16

10 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-08 - Our budget request was accepted! Let's work out a timeline - Work on RSO - ASO model clauses more – can we get to "beta" quality today? - How are invitations to our April 15 meeting going? Attending: Eve, Andrew, Ann, Adrian, Mark, Kathleen Budget request accepted The Kantara board has asked us for a cash flow timeline. Eve's estimate was that we could develop our requirements by early Q3, say no later than July, and identify a contractor by early-mid Q3, and ideally conclude the project by the end of Q3 (Sep). This gives us a forcing function to have a credible set of beta model text to work with by Q2. We seem to be able to accept this, even though there are some question marks. AI: Eve: Reach out to our community of "legal eagle" participants to wake up active participation once again. Realistic first beta review timelines Is it realistic to invite anyone to our Apr 15 call? Are we ready with text? There are two parts to this: Can external parties attend, and do we have enough text/materials? Adrian proposes that Kathleen is on the critical path here. Kathleen just wants to run a FHIR pilot based on our clauses! And doesn't see Andrew's use case as incompatible. What's most practical? Kathleen suggests that getting to the point of real clauses is really the most practical. Let's work hard to continue putting our model clauses together, and reassess just before the IIW timeframe as well as think about a June forum for external review. Model definition and clause work The FHIR connectathon is in May. She would like to "XMLize" the clauses for that target. What actual language is being executed here (since XML is just the "punctuation", if you will), if FHIR has a place in the code for a Grantor etc.? It sounds like they are using UMA authorization servers to consume standardized policy expressions in XML (if not necessarily XACML) format, and this would map to the Grantor's wishes for sharing. This could come down to a particular set of trust relationships, and the question of whether it splits into "active" policies vs. things like consent receipts. Our Grantor - RqP (Grantee?) trust relationship already mentions consent receipts, and we've already discussed how CRs need to be part of a workflow that shows the Grantor what it is they're consenting to (or proactively sharing/delegating or whatever, i.e. setting a policy/sharing preference), so we could already be in the ballpark here. FHIR is using its audit logging framework for this workflow. Adrian had made a generic "NPE Release of Information Form 1" sample form <https://docs.google.com/forms/d/1A43_OrXPIe26IaE4AVBgaRR7wXacWIGXX36X1D1LHB…> a few months ago, and Kathleen observes that with a few additions this could be something like what FHIR needs. Adrian is intending this to be used by the RS/RSO for setting up phase 1 (that is perhaps a rathole for our purposes for today's agenda; Eve suggests that Adrian and Kathleen discuss offline as appropriate). Eve shared a slide deck <http://kantarainitiative.org/confluence/download/attachments/17760302/UMA%2…> that runs through various design patterns for splitting the technical resource subject and legal Grantee roles. This deck now has some explanation on the first slide about how the technical UMA flow can stay the same, while the trust relationships and legal/contractual backing might vary significantly. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

UMA Video at IIW in April?
by William Lowe 08 Apr '16

08 Apr '16

Hi UMA WG, A professional film crew will be at the the upcoming Internet Identity Workshop (http://www.internetidentityworkshop.com/) in April to film an IIW related video. They have extended the offer to shoot other "special interest" videos while they are there. There have been discussions about getting an UMA-centric video created. It would likely consist of interviews with UMAnitarians discussing the challenges UMA is helping solve, background on the problem, etc. It could be a nice marketing asset to have... The total cost to create the video would be $1,500. Mike Schwartz (mike(a)gluu.org) and I thought it might be something that UMA enthusiasts would want to crowdfund. We put together a poll to see who is interested in chipping in $100 to get the video created: http://www.gluu.co/iiw-uma-video-poll We (Gluu) provided the first answer of "yes" :) Google Forms doesn't allow me to see who has responded to the poll and how they responded, so if you are interested in contributing please fill in the second question on the form with your name, company (if applicable), and email address. If you are not interested in seeing a video created just leave that field blank. Let us know if you have any questions. And thanks in advance for your participation in the poll! Will -- ------------ William Lowe Gluu, Inc. 925.389.7426 http://gluu.org http://linkedin.com/in/whaven

1 0

Agenda for UMA legal telecon 2016-04-08 (would love to have good representation on the call tomorrow!)
by Eve Maler 08 Apr '16

08 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 2016-04-08 - Our budget request was accepted! Let's work out a timeline - Work on RSO - ASO model clauses more – can we get to "beta" quality today? - How are invitations to our April 15 meeting going? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2016-04-07
by Eve Maler 07 Apr '16

07 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 MinutesQ2 is conference season – meeting series to get some interruptions General logistics note: We meet next week, but not April 21 or 28. We'll also miss May 12 for EIC, and some random other Thursdays and Fridays; keep an eye on the online calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> and your inboxes if you subscribe. (Let Eve know if you want invitations.) Roll call Quorum was not reached. Approve minutes Deferred. UMA video Mike is motivated to put together a Doodle poll to see who's interested to throw $100 into a pot to jointly sponsor (as the UMA WG) a 1-minute video. "Why UMA" check-in Eve is waiting to hear from Pedro about a Red Hat case study. Wide ecosystem We reviewed the paragraph called "*The role of the AAT*" in the challenge analysis document. George notes that the AAT is supposed to be a tuple of Bob, the client, and the AS, but what is the "Bob" we're talking about here – what identity in particular are we talking about? Is it really true that Bob needs to create an account at the AS? It's not strictly true that an account is needed, in fact. Could it all just be transient? The AAT, at least, needs to live long enough for the client to use it when making RPT endpoint calls etc. Some AS's might have a business model that prefers creating lots of accounts, but others might not. Is "session" a better way to describe the AAT requirement than "account"? Alice says that "the entity that controls this identifier can do this thing with my resources". The canonical scenario's policy condition given in the document is roughly in identifier-based form (unless the email address in question is shared). Is there an identifier vs. authenticator distinction? How philosophical is this? How would any of Bob's claims get persisted across his sessions at a single AS if he wants access to multiple RS's, potentially for resources controlled by multiple RO's? (Note that regardless of these conditions, the persistence would still be tied to a single client; an AAT would be client-specific, being an OAuth access token.) Having an account at the AS doesn't make his claims any more fresh. If you look at different kinds of clients (mobile, IoT, etc.), Ishan suspects that since different AS's left to their own devices would have made different choices about an AAT, clients would prefer different choices themselves. But isn't an AAT tantamount to a session cookie? Yes, but they're not identical. A thermostat itself doesn't maintain a session itself; its gateway proxy does. Ishan notes that since data goes stale, the AS may always want to grab the latest data. It could evaluate a freshness metadata field, of course, but it's going to want to mitigate risk by grabbing the latest. *AI:* Eve: Add a #trust issue about liability for claim staleness. We agreed that the various solution possibilities for #wideeco may not be mutually exclusive, and also that we shouldn't nail down final choices of solutions till we analyze additional relevant use case buckets in our roadmap. We'll ask champions for the various solutions to present in future weeks. The challenge document should now be open for everyone to comment (you probably need to reload it). Here's more information about the IETF ACE group and its documents <https://datatracker.ietf.org/wg/ace/documents/>. See also this older (now-expired) spec <https://tools.ietf.org/html/draft-maler-ace-oauth-uma-00> about ACE for OAuth and UMA. Attendees As of 20 Feb 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah, Ran) 1. Kathleen 2. Robert 3. Eve 4. Mike Non-voting participants: - Andrew - Adrian - George - Ishan *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-04-06
by Eve Maler 06 Apr '16

06 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 Date and Time - *Thu Apr 7,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31> - IIW roundup - UMA video opportunity - Session ideas and plans - "Why UMA" check-in - Content and case study progress - Examining solutions for wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – look at: - UMA-protected UserInfo? (various) - Different patterns of Alice's AS and RS's accepting and providing federated logins? (Adrian) - "Multi-party" proposal? (Justin) (engages with #APIsec and #simplify use case buckets too) - AS requests claims and client does act_as Bob to send them? (Mike, James) - Alice's AS dynamically gets client credentials to Bob's claim sources? (various) - Meta-suggestion: Should trust elevation methods be modularized? (James) - Others? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Opportunity to sponsor an UMA video by @heathervescent at IIW 22
by Eve Maler 05 Apr '16

05 Apr '16

Passing along a message from Heather regarding a really interesting opportunity available to UMAnitarians at the upcoming IIW. If you're interested to take advantage of this opportunity (either a 3-minute or a 1-minute sponsored video), or have questions, please get in touch with Phil/Heather! (If you haven't worked with her before, she does some great stuff. I got to join her for episode 1 of her Future of Wearables podcast series, here <http://www.heathervescent.com/heathervescent/future-of-wearables-podcast.ht…> ...) ==== As part of IIW's mission to educate people about iInternet identity, we've been looking for ways to document the journey IIW participants have been on over the last 11 years. Thanks to the support of a generous sponsor we are going to make a movie! We'll have a professional film crew at IIW in April to interview people who have played a role in advancing the cause of Internet identity. Long-time IIW participant and friend @heathervescent is producing the film for us. The interviews will be made into a short documentary about the story of Internet identity. In addition to the primary Internet Identity documentary film, we're creating a series of 3-minute documentaries on specific Internet Identity technologies. So far we have commitments for U2F Technology, Open ID Connect, and Internet of Things. The film would be promoted along with the main IIW one, and you could use it on your website and for any company/technology evangelism, marketing or promotion. $3500 is ridiculously cheap for this kind of thing - the production crew itself costs more than this but we're able to keep this cost down thanks to adding it onto the IIW film production. There's also a 1 minute "pitch" film for $1500. Contact Phil (phil(a)windley.org) for sponsorship, and Heather ( heathervescent(a)gmail.com) for production details. Thanks, -Heather *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

[legal] New thoughts on "Grantee" vs. "Requesting Party"
by Eve Maler 03 Apr '16

03 Apr '16

After doing a bunch of somewhat related work having to do with consent, and working with the word Grantee in the "requesting party" slot, I came to really appreciate it for its brevity, and believe that it could suffice for our model definition purposes. The definition might turn into something like this. Thoughts? A {Person} to whom a {Grantor} may grant access to a digital data resource, and who, if granted access, uses a {Client} to achieve that access. In any one case a {Grantee} may be the same as, or different from, the {Grantor} or {Resource Subject}. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 5

[legal] Please invite your favorite external legal reviewer to our April 15 session
by Eve Maler 01 Apr '16

01 Apr '16

In our call today, we said we'd invite external reviewers to our April 15 session and show them our model text work. Please spread the word. - You can point them to this page: http://tinyurl.com/umalegal - Our dial-in information is here: http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes - Do please let them know that they will be invited guests for this one call only, and if they would like to attend on an ongoing basis, they are encouraged to join as participants; see details on the first link above. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes of UMA legal telecon 2016-04-01
by Eve Maler 01 Apr '16

01 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-01 - Work on RSO - ASO model clauses - Decide external review strategy Attending: Eve, Andrew, Adrian, Kathleen, Thomas, Jim We discussed the candidate model clauses for RSO - ASO. What is a resource set description vs. a scope description vs. a resource vs. a scope etc.? Should we be really specific, the way a technical spec – or legal document – would expect, and define every little term? A resource set description being registered is a set of metadata about an *actual* digital data resource of Alice's that is being put under the AS's protection (in other words, the data itself is not uploaded), and the scope description(s) that are part of that metadata are descriptors of the *potential* extents of access that are possible to be performed over that resource – not *actual* entitlements that some requesting party has "won". One metaphor is that a resource set is a "noun" and a scope is a "verb" (among some set of verbs) that is possible as an action on that noun. Another metaphor is that the scopes are the definition of the contract, or interface, for that resource. In effect, the scopes define the "API" for the resource. Note that since RS gets to choose how to split up its design of resources and scopes, and the design line between them is moveable. subj - verb - object (crude representation of an authorization policy) RO - RSO - RSO (who's authoritative for each piece) ASO (authoritative for executing the whole thing) Adrian's concept of "I split, you choose" means that the RSO gets to be authoritative for that digital data resources and the APIs presented for exposing them. UMA has innovated around enabling the RS outsourcing the function of letting the RO be authoritative for associating the "verb and object" part of a policy with the desired subject, and then letting the AS execute the RO's wishes. This is through a combination of resource set registration and then the rest of the UMA flow. Do we have a chicken/egg problem in terms of the relationships? What if there are two independent relationship streams leading up to the three-way PAT relationship? - Trust relationship 1: Grantor - RSO (no technical artifact) - Trust relationship 2: Grantor - ASO (no technical artifact) - Trust relationship 3: RSO - ASO (technical artifact is OAuth client credentials for the RS) - Trust relationship 4, dependent on the previous three: Grantor - RSO - ASO (technical artifact is a PAT, carrying user consent) (The numbers where there are no preconditions are arbitrary – they're just for easy reference.) There may be cases where the conditions are variable. Eve was concerned about our two-party "atomic" approach previously because a PAT inherently has three entities involved, and it naturally maps to three parties; likewise, an AAT. Her suspicion is that some of our duties may have to "go there" in mentioning three parties, and that this isn't a variable thing: the clauses will have to do that. Adrian asks: Is it valuable for trust relationships 3 and 4 to have different model clauses? In other words, would the RSO and ASO ever want to contract with each other separate from the context of any specific individual? Eve made the case that some sort of blanket protection against liability, in both directions, makes sense regardless of the particular resource owner. Kathleen mentions market forces as pressuring ASOs and RSOs variously on this point. Also, regarding #ROctrl, that's going to have to be fought out in trust relationship #1, not trust relationship #3; the ASO is more likely going to want to say "Listen, I'm going to put stuff in the token, and if you do something else, I wash my hands of you." Regarding external review, Andrew would like to point some DIACC members to our model definitions. *AI:* Everyone: Reach out to external reviewers and offer to hold a live review session on Apr 15 and see who can attend. Eve to send a reminder of what this is all about in email. Let's also plan a live review at IIW, by which time we'll have more model text. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-01
by Eve Maler 01 Apr '16

01 Apr '16

http://kantarainitiative.org/confluence/pages/editpage.action?pageId=773001… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-01 - Work on RSO - ASO model clauses [stay tuned for drafts!] - Decide external review strategy *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0