April 2016 - WG-UMA - mailman.kantarainitiative.org

Notes from UMA telecon 2016-04-07
by Eve Maler 07 Apr '16

07 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 MinutesQ2 is conference season – meeting series to get some interruptions General logistics note: We meet next week, but not April 21 or 28. We'll also miss May 12 for EIC, and some random other Thursdays and Fridays; keep an eye on the online calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> and your inboxes if you subscribe. (Let Eve know if you want invitations.) Roll call Quorum was not reached. Approve minutes Deferred. UMA video Mike is motivated to put together a Doodle poll to see who's interested to throw $100 into a pot to jointly sponsor (as the UMA WG) a 1-minute video. "Why UMA" check-in Eve is waiting to hear from Pedro about a Red Hat case study. Wide ecosystem We reviewed the paragraph called "*The role of the AAT*" in the challenge analysis document. George notes that the AAT is supposed to be a tuple of Bob, the client, and the AS, but what is the "Bob" we're talking about here – what identity in particular are we talking about? Is it really true that Bob needs to create an account at the AS? It's not strictly true that an account is needed, in fact. Could it all just be transient? The AAT, at least, needs to live long enough for the client to use it when making RPT endpoint calls etc. Some AS's might have a business model that prefers creating lots of accounts, but others might not. Is "session" a better way to describe the AAT requirement than "account"? Alice says that "the entity that controls this identifier can do this thing with my resources". The canonical scenario's policy condition given in the document is roughly in identifier-based form (unless the email address in question is shared). Is there an identifier vs. authenticator distinction? How philosophical is this? How would any of Bob's claims get persisted across his sessions at a single AS if he wants access to multiple RS's, potentially for resources controlled by multiple RO's? (Note that regardless of these conditions, the persistence would still be tied to a single client; an AAT would be client-specific, being an OAuth access token.) Having an account at the AS doesn't make his claims any more fresh. If you look at different kinds of clients (mobile, IoT, etc.), Ishan suspects that since different AS's left to their own devices would have made different choices about an AAT, clients would prefer different choices themselves. But isn't an AAT tantamount to a session cookie? Yes, but they're not identical. A thermostat itself doesn't maintain a session itself; its gateway proxy does. Ishan notes that since data goes stale, the AS may always want to grab the latest data. It could evaluate a freshness metadata field, of course, but it's going to want to mitigate risk by grabbing the latest. *AI:* Eve: Add a #trust issue about liability for claim staleness. We agreed that the various solution possibilities for #wideeco may not be mutually exclusive, and also that we shouldn't nail down final choices of solutions till we analyze additional relevant use case buckets in our roadmap. We'll ask champions for the various solutions to present in future weeks. The challenge document should now be open for everyone to comment (you probably need to reload it). Here's more information about the IETF ACE group and its documents <https://datatracker.ietf.org/wg/ace/documents/>. See also this older (now-expired) spec <https://tools.ietf.org/html/draft-maler-ace-oauth-uma-00> about ACE for OAuth and UMA. Attendees As of 20 Feb 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah, Ran) 1. Kathleen 2. Robert 3. Eve 4. Mike Non-voting participants: - Andrew - Adrian - George - Ishan *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-04-06
by Eve Maler 06 Apr '16

06 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 Date and Time - *Thu Apr 7,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31> - IIW roundup - UMA video opportunity - Session ideas and plans - "Why UMA" check-in - Content and case study progress - Examining solutions for wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – look at: - UMA-protected UserInfo? (various) - Different patterns of Alice's AS and RS's accepting and providing federated logins? (Adrian) - "Multi-party" proposal? (Justin) (engages with #APIsec and #simplify use case buckets too) - AS requests claims and client does act_as Bob to send them? (Mike, James) - Alice's AS dynamically gets client credentials to Bob's claim sources? (various) - Meta-suggestion: Should trust elevation methods be modularized? (James) - Others? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Opportunity to sponsor an UMA video by @heathervescent at IIW 22
by Eve Maler 05 Apr '16

05 Apr '16

Passing along a message from Heather regarding a really interesting opportunity available to UMAnitarians at the upcoming IIW. If you're interested to take advantage of this opportunity (either a 3-minute or a 1-minute sponsored video), or have questions, please get in touch with Phil/Heather! (If you haven't worked with her before, she does some great stuff. I got to join her for episode 1 of her Future of Wearables podcast series, here <http://www.heathervescent.com/heathervescent/future-of-wearables-podcast.ht…> ...) ==== As part of IIW's mission to educate people about iInternet identity, we've been looking for ways to document the journey IIW participants have been on over the last 11 years. Thanks to the support of a generous sponsor we are going to make a movie! We'll have a professional film crew at IIW in April to interview people who have played a role in advancing the cause of Internet identity. Long-time IIW participant and friend @heathervescent is producing the film for us. The interviews will be made into a short documentary about the story of Internet identity. In addition to the primary Internet Identity documentary film, we're creating a series of 3-minute documentaries on specific Internet Identity technologies. So far we have commitments for U2F Technology, Open ID Connect, and Internet of Things. The film would be promoted along with the main IIW one, and you could use it on your website and for any company/technology evangelism, marketing or promotion. $3500 is ridiculously cheap for this kind of thing - the production crew itself costs more than this but we're able to keep this cost down thanks to adding it onto the IIW film production. There's also a 1 minute "pitch" film for $1500. Contact Phil (phil(a)windley.org) for sponsorship, and Heather ( heathervescent(a)gmail.com) for production details. Thanks, -Heather *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

[legal] New thoughts on "Grantee" vs. "Requesting Party"
by Eve Maler 03 Apr '16

03 Apr '16

After doing a bunch of somewhat related work having to do with consent, and working with the word Grantee in the "requesting party" slot, I came to really appreciate it for its brevity, and believe that it could suffice for our model definition purposes. The definition might turn into something like this. Thoughts? A {Person} to whom a {Grantor} may grant access to a digital data resource, and who, if granted access, uses a {Client} to achieve that access. In any one case a {Grantee} may be the same as, or different from, the {Grantor} or {Resource Subject}. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 5

[legal] Please invite your favorite external legal reviewer to our April 15 session
by Eve Maler 01 Apr '16

01 Apr '16

In our call today, we said we'd invite external reviewers to our April 15 session and show them our model text work. Please spread the word. - You can point them to this page: http://tinyurl.com/umalegal - Our dial-in information is here: http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes - Do please let them know that they will be invited guests for this one call only, and if they would like to attend on an ongoing basis, they are encouraged to join as participants; see details on the first link above. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes of UMA legal telecon 2016-04-01
by Eve Maler 01 Apr '16

01 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-01 - Work on RSO - ASO model clauses - Decide external review strategy Attending: Eve, Andrew, Adrian, Kathleen, Thomas, Jim We discussed the candidate model clauses for RSO - ASO. What is a resource set description vs. a scope description vs. a resource vs. a scope etc.? Should we be really specific, the way a technical spec – or legal document – would expect, and define every little term? A resource set description being registered is a set of metadata about an *actual* digital data resource of Alice's that is being put under the AS's protection (in other words, the data itself is not uploaded), and the scope description(s) that are part of that metadata are descriptors of the *potential* extents of access that are possible to be performed over that resource – not *actual* entitlements that some requesting party has "won". One metaphor is that a resource set is a "noun" and a scope is a "verb" (among some set of verbs) that is possible as an action on that noun. Another metaphor is that the scopes are the definition of the contract, or interface, for that resource. In effect, the scopes define the "API" for the resource. Note that since RS gets to choose how to split up its design of resources and scopes, and the design line between them is moveable. subj - verb - object (crude representation of an authorization policy) RO - RSO - RSO (who's authoritative for each piece) ASO (authoritative for executing the whole thing) Adrian's concept of "I split, you choose" means that the RSO gets to be authoritative for that digital data resources and the APIs presented for exposing them. UMA has innovated around enabling the RS outsourcing the function of letting the RO be authoritative for associating the "verb and object" part of a policy with the desired subject, and then letting the AS execute the RO's wishes. This is through a combination of resource set registration and then the rest of the UMA flow. Do we have a chicken/egg problem in terms of the relationships? What if there are two independent relationship streams leading up to the three-way PAT relationship? - Trust relationship 1: Grantor - RSO (no technical artifact) - Trust relationship 2: Grantor - ASO (no technical artifact) - Trust relationship 3: RSO - ASO (technical artifact is OAuth client credentials for the RS) - Trust relationship 4, dependent on the previous three: Grantor - RSO - ASO (technical artifact is a PAT, carrying user consent) (The numbers where there are no preconditions are arbitrary – they're just for easy reference.) There may be cases where the conditions are variable. Eve was concerned about our two-party "atomic" approach previously because a PAT inherently has three entities involved, and it naturally maps to three parties; likewise, an AAT. Her suspicion is that some of our duties may have to "go there" in mentioning three parties, and that this isn't a variable thing: the clauses will have to do that. Adrian asks: Is it valuable for trust relationships 3 and 4 to have different model clauses? In other words, would the RSO and ASO ever want to contract with each other separate from the context of any specific individual? Eve made the case that some sort of blanket protection against liability, in both directions, makes sense regardless of the particular resource owner. Kathleen mentions market forces as pressuring ASOs and RSOs variously on this point. Also, regarding #ROctrl, that's going to have to be fought out in trust relationship #1, not trust relationship #3; the ASO is more likely going to want to say "Listen, I'm going to put stuff in the token, and if you do something else, I wash my hands of you." Regarding external review, Andrew would like to point some DIACC members to our model definitions. *AI:* Everyone: Reach out to external reviewers and offer to hold a live review session on Apr 15 and see who can attend. Eve to send a reminder of what this is all about in email. Let's also plan a live review at IIW, by which time we'll have more model text. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-01
by Eve Maler 01 Apr '16

01 Apr '16

http://kantarainitiative.org/confluence/pages/editpage.action?pageId=773001… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-01 - Work on RSO - ASO model clauses [stay tuned for drafts!] - Decide external review strategy *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0