March 2017 - WG-UMA - mailman.kantarainitiative.org

No Legal call tomorrow, nor next week
by Eve Maler 29 Mar '17

29 Mar '17

I'm afraid I'm not available for the next two Fridays, but in any case, we've frozen deliverable #1 (I've posted a nonrevisable PDF in place of the GDoc/Word version at this point), and Tim is working on deliverable #2 now. Let's simply plan to get together on *Friday, April 14* to see what is next in store for us; I'll guess that by then we will have new material to review. For some, this may be a holiday/day off (technically, it's one for me, but I live to serve :-) ), so please let me know if you can't make it. Thanks! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2017-03-29
by Eve Maler 29 Mar '17

29 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-29 MinutesRoll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2017-03-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-02>: Deferred. UMA V2.0 work Andrew's insight about #296 <https://github.com/KantaraInitiative/wg-uma/issues/296> was that this "profile" was essentially "OAuth". :-) In other words, that's the typical way people use OAuth grants. So would having an inner and outer spec help? The inner would be just the UMA grant, or maybe the grant++: adding the set math, say, and whatever other logic is needed given that this grant includes a requesting party and so on. But it doesn't seem to need the addition of the resource ID concept, for example, because that's "private" between the AS and RS. The outer would include all the protection API elements. Ishan notes Ping has struggled with finding the fit with the whole UMA proposition, so putting RS constraints on what the RO can share would help. Eve notes that, AS-RS tight or loose, the RS's dedicated client (in the realm of enterprise authorization rules -- whether that uses UMA or no) would be able to apply constraints before Alice can "share" some resource. Would consent receipts be the right place to capture Alice's intent in sharing a particular resource, e.g. payment amount, with Bob? Ishan also mentions impacts of/on token binding. We discussed that last week as part of the PoP issue. Definitely worth the full analysis. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Eve Non-voting participants: - Ishan - John W Regrets: - Sal - Justin - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-03-29 (special meeting time; the hour may be cut short)
by Eve Maler 28 Mar '17

28 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-29 Date and Time - Special meeting time *Wednesday, 8-9am PT (may need to end early so please be prompt)* - Screenshare *AND* dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-03-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-09> - Logistics: Okay to schedule a couple of meetings during the week of Apr 10 because we can't hold meetings the week of Apr 3? - UMA V2.0 work: - 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> / GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> (all issues to be kept here for the duration!) / dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - Core is up to 20 <https://docs.kantarainitiative.org/uma/wg/uma-core-2.0-20.html> and RReg is up to 06 <http://docs.kantarainitiative.org/uma/wg/oauth-resource-reg-2.0-07.html> (WG drafts; no change) - See new issues: With our limited time, let's focus on #296 <https://github.com/KantaraInitiative/wg-uma/issues/296>: Out-of-the-box profiling for tight AS-RS coupling - AOB - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2017-03-24
by Eve Maler 24 Mar '17

24 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-03-24 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U…> Attending: Eve, Andrew, Tim, Adrian, Paul *NOTE:* No Legal call next week – and possibly the week after! *AI:* Eve: Look for substitute Legal call as necessary. Tim reports that he's well on his way with deliverable #2. Let's take a "breadth-first" approach to the use cases in deliverable #1 today. Tim asks: What's the general nature of the authorization services being developed today? Are there any? Are they primarily C2G or C2B? Yes, and they are split, with also some B2B. Eve ranks the top three-to-four use cases as healthcare (and healthcare-plus-IoT, with IoT generally being quite broad and horizontal), government/citizen interactions, and financial. Adrian notes that regulation is a powerful motivator for using UMA, and thus the consumer component seems to be critical to adoption. Use case C: And here the FCC decision from October just got reversed again <http://www.nbcnews.com/news/us-news/senate-votes-let-isps-sell-your-data-wi…>! Reasons to think this use case for UMA is valid: UMA would give a standardized interface for ISPs to offer third-party partners for efficient integration (more money on both sides), and wherever regs allow either "legitimate business interests" or "consent" as valid bases to collect and share data it's better to ask for consent because of user trust risks and creeping regulation scope (IT cost and user trust risks of having to ask for consent later). This could be Alice-to-Alice sharing (she shares with some app that she will use) or Alice-to-other sharing (e.g. for marketing purposes, maybe even "targeted" for some goodie offered to her, but maybe not). Worked on use case D. Worked on use case E. We decided to make it just the parent/guardian use case. *AI:* Eve: Try to add a payment use case as a variation on D. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA Legal call tomorrow
by Eve Maler 23 Mar '17

23 Mar '17

Date and Time - *Fridays,* 8-9am PT - Screenshare and audio: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2017-03-24 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U…> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Substitute WG meeting Wed Mar 29: any preference for 8am PT or 9am PT?
by Eve Maler 23 Mar '17

23 Mar '17

"Summertime skew" ends on Sunday, so the Americas and Europe will be back in sync -- meaning 8am PT/9am MT/11am ET will equate to 4pm UK/5pm Eur, and so on. Please let me know, and I'll put one of the two options in the calendar by tomorrow afternoon. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2017-03-23
by Eve Maler 23 Mar '17

23 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-23 MinutesRoll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2017-03-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-02>: Deferred. Logistics Can we move to a Wednesday time next week? Let's try. *AI:* Eve: Cancel next Tuesday's meeting (Mar 30) and propose a Wednesday (Mar 29) meeting time if possible. UMA V2.0 work Issue #292 <https://github.com/KantaraInitiative/wg-uma/issues/292>: Eve was concerned about potential scope collisions. But George points out that collisions would be bad in the context of a whole set of resources that a client would be dealing with, and Justin notes that in UMA, scopes are per resource anyway, and scopes can actually differ per resource. Consensus: No need to add a new "type" field for scope description documents. *AI:* Domenico: Create UMA2 version of the more detailed "UMA oval". Issue #294 <https://github.com/KantaraInitiative/wg-uma/issues/294>: This would be of interest to some folks. Prabath has mentioned RFC 7800 to Eve. Justin notes that it solves only a small part of the puzzle, and that the OAuth PoP architecture <https://datatracker.ietf.org/doc/draft-ietf-oauth-pop-architecture/> draft et al. aren't finalized yet and the WG seems to have no appetite to finish them and that token binding solves All The Problems. George agrees token binding is useful, but it's not very deployable; it just provides correlatability of the same SSL session. Mutual TLS with token binding approaches being equivalent. When you go beyond a two-party system, which OAuth and especially UMA are, then it gets wildly complicated. Justin recommends his book, chapter 15 especially, specifically page 296. [image: (smile)] He points to Hans Z.'s recent Token Binding writeup <https://hanszandbelt.wordpress.com/2017/03/23/token-binding-for-the-apache-…> . Right now, in UMA2, we have excised every mention of Bearer from Core. So in fact it might be possible for RPTs to make *automatic* use of PoP tokens. Can we find out? Could token binding be used with refresh tokens (presumably this still applies) and even PCTs? How can we find out? Is it worth stating the result of our investigations in the spec or in the UIG? PoP is done by the RS. Justin has implemented a way for the AS to hand the RS the JWK it needs to validate the JWT, but there's no official spec (among the plethora of PoP specs) for handing over this particular piece of metadata. So as far as people have gotten is to say, basically, "Use whatever means you have available to get this info – local or introspect etc." Not being a "P*P" architecture, the RS still "reserves the right to refuse service". The client is the one proving possession. (This is not SAML HoK, where it would be Bob proving possession.) Justin recommends his diagram on pages 385-386!) *AI:* Issue on rescinding access positively/downscoping: Eve to add. DONE. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Mike 3. Eve Non-voting participants: - Justin - Dean - George - Crina - Scott F - Jin Regrets: - John W - Sal *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-03-23 (last week of "summertime skew")
by Eve Maler 22 Mar '17

22 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-23 Date and Time - Thursdays, 9-10am PT (back to regular time slot, still in "summertime skew" this week) - Screenshare *AND* dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-03-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-09> - Logistics - UMA V2.0 work: - 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> / GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> (all issues to be kept here for the duration!) / dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - Core is up to 20 <https://docs.kantarainitiative.org/uma/wg/uma-core-2.0-20.html> and RReg is up to 06 <http://docs.kantarainitiative.org/uma/wg/oauth-resource-reg-2.0-07.html> (WG drafts) - See new issues - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2017-03-17
by Eve Maler 19 Mar '17

19 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-03-17 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U…> Attending: Eve, Tim, Colin L, Adrian, John W, Ann Sal provided info on an event being held Mar 23 on Information Law <https://www.eventbrite.ie/e/information-law-2017-first-annual-conference-ti…>. We also discussed Jim H's Wise Contracts paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2925871>and Jane Winn's comments in another context (BSC). This is relevant to Tim's intended matrix regarding allocation of economic value. Adrian sent a link <https://link.springer.com/article/10.1007%2Fs12553-017-0179-1#Sec10> to the Google DeepMind problem with trust, through extreme lack of transparency and communication with overseers. Eve's "golden rule" is to tell business owners that they should treat personal information as a joint asset. John W tells them the business owns the record while the individual controls the information. Note that OAuth's use of "resource owner", and thus UMA's effectively means control of access (to some extent/scope of access). Adrian "is alone in using" the definition of ownership where you can delete it. We've stayed away from "owning" terms so far for all these reasons, except at the technical level. Tim is listening for device connectivity, issues of content, and issues of context. For example, how to prove the connection of a device to a responsible mind? Eve points to a particular OAuth grant flow called OAuth Device Flow <https://tools.ietf.org/html/draft-ietf-oauth-device-flow> that helps to bind a device to a person and their account, which could help in an UMA context. Should we include a connected car use case? Here's an example <https://www.youtube.com/watch?v=8UFMJo9P_Fo&feature=youtu.be> we could potentially use. Regarding the distinction about the legal bases for collecting and using data (and also for presenting interfaces and granting access beyond just "collecting and using data", keeping in mind that UMA can protect any API – think "resource controller" vs. just "data controller"), is this exactly the bright line that lets us say that this lets the resource server be a "resource owner" for those resources that it doesn't give Alice the rights to control access to? This may be tautological because UMA has a notion of enterprise ROs anyway. Bridging terminology thoughts: - From resource server to resource server operator to resource controller to data controller???? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 3

GDPR lawful processing graphic
by John Wunderlich 17 Mar '17

17 Mar '17

John Wunderlich, BA, MBA IAPP Fellow of Information Privacy CISA, CIPM, CIPP/C, PbD Ambassador @PrivacyCDN <https://twitter.com/PrivacyCDN> & Privacist -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0