June 2016 - WG-UMA - mailman.kantarainitiative.org

Client awareness of scopes in UMA / Breakfast BOF tomorrow (Thu Jun 9) at CIS
by Eve Maler 16 Jun '16

16 Jun '16

Still no WG call tomorrow, but it's been suggested to have a BOF -- so for those of us here at CIS, let's plan to meet at 7:30am over breakfast. We could take the opportunity to discuss an item that's coming up in a few conversations: While scopes in OAuth are universal to their protected resources, scopes in UMA are bound to a particular RO context. Thus, in the flow being proposed where clients make scope requests by clients, are the clients: - Making a simplifying assumption about scopes being attached to generic "protected resource classes" (?) of some kind, where specific ROs are bound to instances of these classes later to get RSIDs? - Aware of RSIDs somehow in order to ask for scopes? - Doing something else entirely? The way APIs are generally designed, the first option seems the most likely/reasonable/privacy-protecting. If that's the case, what other design considerations would there (have to) be for scope sets? E.g., our notes from last week had this list in it: 1. The universe of scopes the RS has registered for the resource set 2. The scopes the client has registered for at the AS (if it has done this at all) 3. What the RO has attached to the policy for the resource set 4. What the RS requests for at the permission endpoint (in order to get a ticket) 5. The scopes the client requests at the token endpoint There would need to be some insertions and questions answered for at least #1, #2, and #5. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 6

Agenda for UMA telecon 2016-06-16
by Eve Maler 15 Jun '16

15 Jun '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-16 *Date and Time* - *Thu Jun 16,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar *Agenda* - (Eve needs to leave a bit early) - Roll call - Approve minutes of UMA telecon 2016-06-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02> - MPD: Still working through the sequence diagram <http://www.websequencediagrams.com/files/render?link=2DdzslbnVj3ShhlrLVV-> - Client awareness of scopes: replay/conclude discussion at CIS breakfast BOF and on the list; any negative impacts in the dev/business owner relationship? - Get-a-token loops - Next steps on spec text - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Capturing Resource Owner's Dynamic Context
by Mohammad Chowdhury 14 Jun '16

14 Jun '16

Dear All, I am new to this group and spare me if I am asking a dumb question. I am wondering, Is there any way in UMA to capture the dynamic context of the resource owner to provide context-aware authorization? I have the following use case, "Alice's mom will get access to online CC camera hosted in Alice's apartment, Only if Alice is out of her apartment " I know XACML is used to capture the context of the Requester (e.g., subject of XACML, in this case Alice's Mom). But I do not know is there any mechanism in XACML to capture the dynamic context (in our case, context is location) of the resource owner (in this case, Alice ) for authorization decision. Can anyone advise me on this ? Any comment will be appreciated. Kind regards, Jabed

6 5

No WG call or legal call this week
by Eve Maler 07 Jun '16

07 Jun '16

The outcome of my request for input on whether to hold a WG call is that we've cancelled the call. I'd already cancelled the legal subgroup call. Talk to y'all next week! Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Does a call this Thursday make sense?
by Eve Maler 05 Jun '16

05 Jun '16

[NOTE: I put this on Slack and Skype just now as well: If you're on Slack too, please respond there instead.] Does a call this Thursday make sense? That's the last day of CIS. I can squeeze it into my schedule before flying out for yet another conference (the very last of this crazy six-week stretch for me). I think we can make progress discussing the "loop" element of the swimlane even if Justin can't make it, but it would be ideal to have him present. Please weigh in *on Slack*, *or Skype if you're not on Slack*, *or in private email if you're not on either*, if you can make it, and I’ll decide by Tuesday. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

Notes from UMA legal telecon 2016-06-03
by Eve Maler 04 Jun '16

04 Jun '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-06-03 - NOTE: No subgroup telecon next week - Privacy@Scale report - Status of outlining/editing of newly planned document deliverables - UMA Legal Primer - UMA Legal Use Cases Attending: Eve, Paul, John W, Mary, Ann, Kathleen, Adrian, Mark *Privacy@Scale and other event reports:* John and Eve both attended on Monday of this week; it was the 2nd annual, and their first. Facebook hosts it. It was in DC this year. John was very vocal. You can find two of the three report deliverables commissioned by Facebook from Ctrl-Shift at this site <http://thedatadriveneconomy.com/>. The third report is coming soon. Eve spoke at FB’s behest on the roundtable process that fed into those reports, and mentioned UMA and Consent Receipts. John points out Omri Ben-Shahar <http://www.law.uchicago.edu/faculty/ben-shahar>’s research (he wrote a book called More Than You Wanted to Know: The Failure of Mandated Disclosure) purporting to show that privacy notices are pointless (he was doing a “point-counterpoint” talk with Lori Cranor). Mark contrasts this (?) with the Project IF <https://projectsbyif.com/> work on “data licenses”, where it seems to matter. On Tue-Wed of this week, Adrian attended the NIST Named Data Networking meeting. This work has significant privacy implications. Relative to UMA, there was a mention of longitudinal health records. But he doesn’t expect movement on this soon. PPR has its annual Health Privacy Summit. Remember: It’s free and streamed. Contact Adrian to get an invite! *New UMA Legal document deliverables:* John did a draft outline of an “UMA Legal Primer”. Eve has her slide deck as a start for something like an “UMA Legal Use Cases” document. What should the real names of these documents mean? “Legal” comes after something like “Business”, “Strategic”, “Real-Life”, etc. The use cases are ideally tackled in a fashion that doesn’t introduce UMA terminology, at least at first. They can introduce UMA terminology as a mapping exercise in a second chapter or something, or even point to the other document. What real-life digital resources should we use for examples in the use cases? Health data is a very real example, but how much should we use this? There’s a sense that we should either spread the examples around, or be cautious/aware about using health examples because of its specialty characteristics. We could introduce RACI mappings once we come out of the “UMA technical” term explanations into the “data *” mappings. Kathleen notes that when we have a 1yo (actually a minor who is legally incompetent but old enough to be aware) Johnny, he is legally incompetent to consent and thus may give assent vs. consent; this maps to “Resource Subject that is not at a Responsible level” or something. IOW, RACI is an imperfect system to map to (as we concluded previously). However, the point is that RACI maps well to “data *”. (John writes this part. :-D ) Further, mapping UMA-technical roles to data-* roles leaves a hole: the AS. It’s not a data-anything. This is the innovation of UMA. The contract roles and relationships is the third plane. We should treat it on its own. The goal of the UMA Model Clauses section would be melding the three dimensions all together. We should take a lightweight approach, point to a couple of illustrative clause samples, and in essence serve as clause documentation. We might need a subsection somewhere in this doc (not as a separate dimension/plane) for the UMA-legal definitions, to support the clause explanations. Eve (John?) will import this into a GDoc for collaborative editing. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Determinism of sets of scopes
by Eve Maler 04 Jun '16

04 Jun '16

John W asked in Skype whether deterministic sets, as we were just talking about in the call today, would allow for overrides of a policy for purposes of data localization or regulation etc. My response was that it's an AS that represents the results of the RO's policy in a token, and it's an RS that might override those results once the client brings that token over to the RS (the "Adrian clause"). Thus, I wondered if the RS's actual granted access should be considered a sixth set of a scopes that we should track, describe, etc. in the spec. It would probably be useful in the UMA Legal work, at a minimum! I also noted that the RS might need to do overrides in an out-of-band-of-UMA situation. As we've discussed in the past, such a situation might include court order or a "break glass" situation. This would mean that this set of scopes could be interestingly disjoint from the original five sets. Thoughts? (BTW, I've sent out Slack invitations, as we'd promised, to everyone who currently gets Google Calendar invitations to our WG meetings, plus whoever else asked for an invitation. If you'd like to get an invitation in addition, drop me a private note.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 4

Agenda for UMA legal telecon 2016-06-03
by Eve Maler 03 Jun '16

03 Jun '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-06-03 - NOTE: No subgroup telecon next week - Privacy@Scale report - Status of outlining/editing of newly planned document deliverables - UMA Legal Primer - UMA Legal Use Cases *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2016-06-02
by Eve Maler 02 Jun '16

02 Jun '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2016-05-26 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-05-26>: APPROVED. MPD Discussion about the arrow "request token with permission ticket" and asking for scopes: The RS would/might still have registered a permission with scopes that it judged to be necessary, so the RS and the client would both have an "opinion" about what the extent of access should be. There are two inputs here into what the ultimate granted access should be. Justin suggests it should be completely deterministic how the five relevant sets are combined: 1. The universe of scopes the RS has registered for the resource set 2. The scopes the client has registered for at the AS (if it has done this at all) 3. What the RO has attached to the policy for the resource set 4. What the RS requests for at the permission endpoint (in order to get a ticket) 5. The scopes the client requests at the token endpoint OAuth's ability for a client to ask for multiple scopes up front makes it less chatty than something that uses a strict least-privilege approach. His early trials with UMA showed that people generally gave out more privileges than that anyway. If TTL strategies and RO (and RS) preferences would prefer to see bundles of scopes handed out anyway, and if some clients can only handle some types of scopes, then does it especially make sense to have the client indicate what scopes it can handle? Justin's ultimate rationale for having clients request the scopes they want is that they are software programmed to use an API, and so they are the proper entity to request what they want. Can we do away with the permission ticket and simply use the bearer token response? Apparently not, because a permission ticket still is needed to preserve UMA loose coupling and RO context in the doing. However, giving the RS a decision/judgment call to make about the client's extent of access is actually a hard problem, and seemingly not worth it. Given that the design of an API, and particularly the resource set vs. scopes dividing line, is up to the discretion of a designer (that is, it's not a clean object vs. verb philosophical line), letting the client ask for what it wants could be philosophically cleanest. An asynchronous grant flow has interesting benefits to the RO in terms of letting them be free to "edit"/uncheck scopes free from the collusion of the RS and client, vs. synchronous grant flows, so there's less concern over a client just "getting its way". Justin's set math implementation can be viewed here <https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/blob/m…>. (The license is Apache2.) We think the notion of scopes as "registerable" by clients in the OAuth world is directly usable in our new concept of UMA set math. We just need to work out a flow chart of how a client's registered scopes interact, in a specific case, with policies. This is our next step, and then to turn it into spec text. So step #4 could be entirely uninteresting and deterministic, say, identifying the resource set ID (or possibly multiple resource set IDs? that would be a judgment call). "Scope design" as a discipline becomes a new thing now, as the RO has a new interactive experience with it, and as RS's convey their semantic intent to an AS at a separate organization (through RSR) for display. OAuth previously has not had this. Even standardized APIs with standardized OAuth scopes haven't had this. Swimlane edits needed: - The "request token with permission ticket" arrow should mention the issue number regarding "client should be able to request scopes" (165) Attendees As of 15 Apr 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Nagesh, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Kathleen 3. Sal 4. Maciej 5. Eve 6. Robert 7. Mike 8. Sarah Non-voting participants: - Justin - Colin - Adrian - James - John W - Arlene - Ishan - Jin - George *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0