February 2017 - WG-UMA - mailman.kantarainitiative.org

Apologies
by Eve Maler 28 Feb '17

28 Feb '17

I'm sorry for not making it to the call today, and for the confusion with Colin trying to run the call in my stead (thanks, Colin!). Not feeling well today. I'll try and line up RReg decision-making in email as best I can for Thursday. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

282: Facilitate chatter reduction at the RS
by James Phillpotts 27 Feb '17

27 Feb '17

All, I've added a comment to issue 282 to follow on from discussion after I dropped off the call last week: https://github.com/KantaraInitiative/wg-uma/issues/282 Cheers James

1 0

Core rev 17 is up / agenda for Tuesday's ad hoc call
by Eve Maler 27 Feb '17

27 Feb '17

https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-17.html With this rev, the following major V2.0 issues were closed: 280 <https://github.com/KantaraInitiative/wg-uma/issues/280>, 283 <https://github.com/KantaraInitiative/wg-uma/issues/283> Please review changes on your own and report any issues you find. We'll meet *Tuesday 9-10am Pacific* on the *join.me/findthomas <http://join.me/findthomas>* line (screenshare and audio). This ad hoc telecon is on the UMA online calendar <http://kantarainitiative.org/confluence/display/uma/Calendar>. Major topics for discussion: open RReg issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aissue+label%3AV2.…> . *Remember:* Our current goal is to hold a WG vote by March 9 -- once we're satisfied all V2.0 issues are burned down, on publishing a WG draft as a "LAST CALL" exercise lasting a small handful of weeks. We'll be using this period to invite any interested parties to join our group to participate in finalizing the specs and feeding back any implementation lessons. (Note: This is *not* a "public comment/IPR review" period. That will happen subsequently.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2017-02-23
by Eve Maler 23 Feb '17

23 Feb '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-23 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-02-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-09>: APPROVED. Logistics - Continuing 90-minute meetings for the moment - Interest in ad hoc telecon on Tue Feb 28 9-10am PT? - At the end of this call, can we estimate when V2.0 issue backlog will be done? Looking to get to WG "last call" draft ASAP Our plan of record is to public a "last call" WG draft once we're satisfied that we've taken as many issues off the backlog as we want and dealt with them. It would be a "beta" release, with the option of making more changes (no "IP implications", as there would be for a public comment/IPR review). *AI:* Eve: Set up an ad hoc telecon on Tue Feb 28 9-10am PT with the usual invites, which may have only Justin and herself meeting. [image: (smile)] James *may* be available. UMA V2.0 work Core is up to 16 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-16.html> (updated) and RReg is up to 05 <http://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-05.html> (no change). *Issue #280 <https://github.com/KantaraInitiative/wg-uma/issues/280>:* Should we forbid the OAuth scope property on the AS RPT response explicitly? See the discussion resolution and implement it. AI: George: Write up an email discussing implications of doing refresh tokens when the RPT is short-lived but the authorizations are long-lived (and/or any other refresh token implications that come to mind) by March 2 at the latest. *Need new error registry issue:* What is now Sec 9.4.2 needs to be its own Sec 10-level section because of this section <https://tools.ietf.org/html/rfc6749#section-11.4> in 6749. This section needs some corrections. The invalid_ticket and expired_ticket errors should use invalid_grant instead. The need_info error needs to mention the error_details structure, which is a further extension. We probably should mention that not_authorized is not the same thing as unauthorized_client. *AI:* Eve: Create error registry issue. *New issue <https://github.com/KantaraInitiative/wg-uma/issues/282>#282 <https://github.com/KantaraInitiative/wg-uma/issues/282>: <https://github.com/KantaraInitiative/wg-uma/issues/282>* See commentary. No change for now; James, please take note. *RReg issues:* Do we think the use cases for OAuth and OIDC are viable? The last call period could be a good test period. Let's plan on that. *Timeline:* We *think* we could be done with all of the open issues by March 9, which would include two more 90-minute calls and one or two ad hoc calls. *AI:* Eve: Reach out to the Kantara marketing people with the current timeline and plans to explore the *OAuth* RReg use cases. *AI:* Eve: Extend March 9 meeting to 90 minutes and book ad hoc call for next Tuesday. *Spec instructions for rev 17:* See above and issues. Attendees As of 19 Jan 2017 (post-meeting), quorum is 5 of 8. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem, Sarah) 1. Domenico 2. Sal 3. Maciej 4. Eve 5. Mike 6. Cigdem 7. Sarah Non-voting participants: - Justin - George - JohnW - James - Thomas - Crina - Mark L - Jin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

UMA 2.0 Core rev 16 is up
by Eve Maler 23 Feb '17

23 Feb '17

https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-16.html I also added a new section to the UIG: http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui…'sGuide-rreg-timingResourceRegistrationTiming I'm about to close issues 266, 274, 279, 281, and probably some others. Talk to y'all tomorrow... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-02-23 (remember change in dial-in)
by Eve Maler 22 Feb '17

22 Feb '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-23 Date and Time - *Thursdays,* *special meeting times continuing: 8:30-10am PT* - Screenshare *AND* dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-02-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-09> - Logistics: - Continuing 90-minute meetings for the moment - Interest in ad hoc telecon on Tue Feb 28 9-10am PT? - At the end of this call, can we estimate when V2.0 issue backlog will be done? Looking to get to WG "last call" draft ASAP - UMA V2.0 work - 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> / GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> (all issues to be kept here for the duration!) / dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - Core is up to 15 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html> (updated) and RReg is up to 05 <http://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-05.html> (no change) - Rev 16 should be out before the call with implementation of ad hoc 2017-02-21 <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/Ao8mwnNqL…> decisions and related issue closures - Work on open issues - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA ad hoc telecon 2017-02-21 (was Re: Core rev 15 is up / ad hoc meeting tomorrow 8:30-10am PT)
by Eve Maler 21 Feb '17

21 Feb '17

https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html Attending: Eve, Cigdem, George, James, Justin, Robert, Sarah, Domenico, Crina, Sal Crina Cimpian is from Philips. She continues François’s former work. They’re using UMA in Philips Healthcare. Thanks to all for a great call! We’ll be able to close quite a few issues and get <20 open ones, and have a Core rev 16 to look at, by Thursday. Most of the real live-wire issues will be about RReg by then. *Lots and lots of work, fairly invasive I'm afraid, almost all in service of what I hope are the final set math changes. No doubt we'll find some tweaks still to make, but let's the big decisions have been made. This takes into account the last ad hoc, the last **telecon* <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-09>*, and the **GDoc* <https://docs.google.com/document/d/1jZ1Hua2jM5x4lcpN9URaAv9nGuP_d0hX54a_H5V…>* we were working in.* *Please pay special attention to the following sections, related to set math:* - *The **TOC* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#rfc.toc>* (for overall cleaner flow)* - *1.3.2 Resource and Scope Interpretation* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#resource-sco…> - *3.4 Resource Server Requests Permissions on Client's Behalf With Authorization Server* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#register-per…> - *3.6.5 Authorization Assessment and Results Determination* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#authorizatio…>* (note revised title)* - *3.6.6 Authorization Server Response to Client on Authorization Success* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#give-rpt>* (note the following "PCT" section was folded in)* *Also enhanced/tidied up:* - *1.4 Protocol Flow Summary* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#flow-summary…>* / **2.2 Configuration Document and Discovery Endpoint* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#config-doc-d…>* (former now discusses and points to latter, and latter has expanded title; we actually have one more endpoint than we usually talk about)* - *3.2 Resource Server Registers Resources for Protection* <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#register-res…>* (added a note about RReg timing since this comes up a lot)* *For tomorrow, it will really really help if people review the new text ahead of time, and if possible can even send comments in email. I want to work from the **GitHub issues* <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>* and pick off as many of them as we can (I don't know of any outstanding issues that aren't in GitHub, so please submit any you know of). Specifically, I plan to close some easy issues; anyone keeping an eye on issues they care about will be responsible for reopening/yelling...* *Sec 3.4:* Has a typo: s/nn/an/ *Sec 3.6.1:* Instead of “If the client wants to manage a single RPT for this combination of requesting party, authorization server, resource server, and putative resource owner, it MAY include the RPT here. (Note: Since a resource's location might not publicly reveal its resource owner, a client might not be aware of the specific resource owner associated with an RPT.)” say this: “Note: It is out of scope of this specification for a protected resource’s location to inform the client about the identity of its resource owner.” *Sec 3.6.5:* Say what it’s an example of: “The following example illustrates authorization assessment where partial results are obtained:” What happens if the client whiffs it and includes a previous RPT that is wrong for this AS or something? The AS could refuse to upgrade and just proceed with issuing the new RPT. Should we say anything at all about “reasons to *decide*”? We just need to make what is now ambiguous into a MAY. First, rearrange all of the results section paras to accommodate the following: “The authorization server MAY choose to implement RPT upgrading. It is RECOMMENDED for the authorization server to document its practices regarding RPT upgrades and to act consistently with respect to RPT upgrades so as to enable clients to manage tokens efficiently.” Then lay out the three cases, by adding “If the authorization server has implemented RPT upgrading… blah blah blah” *Sec 3.6.6:* Keep the first example. We have rough consensus on closing the set math issue (#266). From here on out, it’s reviewing new text for rhetorical improvement, and testing through implementation of the latest changes. ==== *Sec 1.4:* Mention that the endpoint is referenced in Step 6. ==== *Sec 3.2:* For the “Note: No specific timing of initial registration is mandated, but a typical choice is just before a resource owner needs to set policy conditions at the authorization server.”, should this go in the UIG instead? Should we call out to the UIG at this point? Yes. ==== *Issue #281:* https://github.com/KantaraInitiative/wg-uma/issues/281 See resolution and implement. ==== *Issue #275:* https://github.com/KantaraInitiative/wg-uma/issues/275 See resolution and implement. ==== *Sec 9.4.1:* Need to change the second listing of rpt to pct, and add upgraded. ==== *Sec 3.6.7 and Sec 4 and Sec 9.4*: Our new grant defines its own new error codes. Are these UMA errors, or OAuth errors? The latter, and also, invalid_scope is one that OAuth already has, so we need to define the special way in which it’s used rather than saying it’s new. And Sec 4 needs to be refactored. AI: Justin: Please help Eve structure Sec 9.4.1 correctly. Let’s actually add a Sec 9.4.2 discussing the error responses. ==== *Issue #273:* https://github.com/KantaraInitiative/wg-uma/issues/274 Let’s just keep the (ugly) URN. The “ticket” is in there because the ticket-passing pattern is a defining feature. ==== *Issue #273:* https://github.com/KantaraInitiative/wg-uma/issues/279 See resolution and implement. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Mon, Feb 20, 2017 at 11:44 AM, Eve Maler <eve(a)xmlgrrl.com> wrote: > https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html > > For tomorrow's meeting, we will use join.me/findthomas for screenshare > and voice. I just remembered to doublecheck with Thomas that this would be > okay, so if I send a panicked message at the last minute, you'll know why. > :-) > > Lots and lots of work, fairly invasive I'm afraid, almost all in service > of what I hope are the final set math changes. No doubt we'll find some > tweaks still to make, but let's the big decisions have been made. This > takes into account the last ad hoc, the last telecon > <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-09>, > and the GDoc > <https://docs.google.com/document/d/1jZ1Hua2jM5x4lcpN9URaAv9nGuP_d0hX54a_H5V…> > we were working in. > > Please pay special attention to the following sections, related to set > math: > > - The TOC > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#rfc.toc> > (for overall cleaner flow) > - 1.3.2 Resource and Scope Interpretation > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#resource-sco…> > - 3.4 Resource Server Requests Permissions on Client's Behalf With > Authorization Server > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#register-per…> > - 3.6.5 Authorization Assessment and Results Determination > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#authorizatio…> (note > revised title) > - 3.6.6 Authorization Server Response to Client on Authorization > Success > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#give-rpt> (note > the following "PCT" section was folded in) > > Also enhanced/tidied up: > > - 1.4 Protocol Flow Summary > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#flow-summary…> > / 2.2 Configuration Document and Discovery Endpoint > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#config-doc-d…> (former > now discusses and points to latter, and latter has expanded title; we > actually have one more endpoint than we usually talk about) > - 3.2 Resource Server Registers Resources for Protection > <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#register-res…> (added > a note about RReg timing since this comes up a lot) > > For tomorrow, it will really really help if people review the new text > ahead of time, and if possible can even send comments in email. I want to > work from the GitHub issues > <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> > and pick off as many of them as we can (I don't know of any outstanding > issues that aren't in GitHub, so please submit any you know of). > Specifically, I plan to close some easy issues; anyone keeping an eye on > issues they care about will be responsible for reopening/yelling... > > > *Eve Maler*Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | > Twitter: @xmlgrrl > >

1 0

Core rev 15 is up / ad hoc meeting tomorrow 8:30-10am PT
by Eve Maler 20 Feb '17

20 Feb '17

https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html For tomorrow's meeting, we will use join.me/findthomas for screenshare and voice. I just remembered to doublecheck with Thomas that this would be okay, so if I send a panicked message at the last minute, you'll know why. :-) Lots and lots of work, fairly invasive I'm afraid, almost all in service of what I hope are the final set math changes. No doubt we'll find some tweaks still to make, but let's the big decisions have been made. This takes into account the last ad hoc, the last telecon <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-02-09>, and the GDoc <https://docs.google.com/document/d/1jZ1Hua2jM5x4lcpN9URaAv9nGuP_d0hX54a_H5V…> we were working in. Please pay special attention to the following sections, related to set math: - The TOC <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#rfc.toc> (for overall cleaner flow) - 1.3.2 Resource and Scope Interpretation <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#resource-sco…> - 3.4 Resource Server Requests Permissions on Client's Behalf With Authorization Server <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#register-per…> - 3.6.5 Authorization Assessment and Results Determination <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#authorizatio…> (note revised title) - 3.6.6 Authorization Server Response to Client on Authorization Success <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#give-rpt> (note the following "PCT" section was folded in) Also enhanced/tidied up: - 1.4 Protocol Flow Summary <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#flow-summary…> / 2.2 Configuration Document and Discovery Endpoint <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#config-doc-d…> (former now discusses and points to latter, and latter has expanded title; we actually have one more endpoint than we usually talk about) - 3.2 Resource Server Registers Resources for Protection <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-15.html#register-res…> (added a note about RReg timing since this comes up a lot) For tomorrow, it will really really help if people review the new text ahead of time, and if possible can even send comments in email. I want to work from the GitHub issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> and pick off as many of them as we can (I don't know of any outstanding issues that aren't in GitHub, so please submit any you know of). Specifically, I plan to close some easy issues; anyone keeping an eye on issues they care about will be responsible for reopening/yelling... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Issue #275: The need_info response doesn't say that the ticket is REQUIRED
by Eve Maler 11 Feb '17

11 Feb '17

This one needs discussion, and I'd rather avoid telecon time on it if possible, so let's please discuss it here: https://github.com/KantaraInitiative/wg-uma/issues/275 There are three problems. - The structural problem is that the error_details structure is always optional, but that's where ticket lives. This could be fixed by moving ticket just outside of error_details. - The spec text problem is that it's underspecified when ticket is supposed to appear. It MUST appear when the AS responds with need_info, and it MUST NOT appear otherwise. - The example problem is that we've got a need_info example that doesn't show a ticket in it. That's easily fixed once we're certain how to fix the other two. Any disagreement/discussion on any of this? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Issue #279: Ticket parameter from the AS on redirecting the RqP back to the client
by Eve Maler 11 Feb '17

11 Feb '17

I thought I'd draw your attention to this new-ish issue: https://github.com/KantaraInitiative/wg-uma/issues/279 We say the ticket parameter is OPTIONAL, but, rather, I think it should be REQUIRED on some responses and it MUST be absent on others. Can I get a sanity check on this? If it's an easy one, I can take care of it in rev 15. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0