May 2017 - WG-UMA - mailman.kantarainitiative.org

required claims definition: array of object?
by Mike Schwartz 04 Jun '17

04 Jun '17

Another editorial suggestion... https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-04.html#autho… required_claims "An array containing parameters that describe the required claims, with the following subparameters:" Is parameters the right word there? Would objects be better? Maybe something like: required_claims "An array containing objects that describe the required claims, with the following keys." - Mike

4 3

No WG call on Thursday; Legal call is still on for Friday; offline tasks
by Eve Maler 31 May '17

31 May '17

Enjoy the time off on Thursday. I've updated the swimlane and linked it from the home page, but haven't yet broken it up to reflect the Grant/FedAuthz distinction -- which would probably necessitate breaking it up into two. Anyone interested to contribute to the Release Notes with me? Any additional suggestions for UIG topics? Here are our Wikipedia pages: https://en.wikipedia.org/wiki/User-Managed_Access https://de.wikipedia.org/wiki/User-Managed_Access https://es.wikipedia.org/wiki/User-Managed_Access https://fr.wikipedia.org/wiki/User-Managed_Access https://it.wikipedia.org/wiki/User-Managed_Access Domenico had offered to update the Italian one (thanks!). Other offers?... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 (UPDATED)
by Eve Maler 29 May '17

29 May '17

Note that the close of the comment period is now July 12. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Kantara Initiative <staff(a)kantarainitiative.org> Date: Sun, May 28, 2017 at 3:06 PM Subject: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 (UPDATED) To: announcements(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently approved the UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0. The documents described below now enter a 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Documents: UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Version: 2.0 Document Date: 2017-05-25 Document URLs: UMA 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html> and Federated Authorization for UMA 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> Overview of Documents: *UMA 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for UMA 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-05-25 Review period closes: *2017-07-12* at 11:59 UTC To Comment on the Specification: To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION". Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-07-09, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> Click here to unsubscribe: http://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= keohitgu&unsub=1&unsubconfirm=1

1 0

Glossary?
by Mike Schwartz 28 May '17

28 May '17

Eve, Just an editorial note: In UMA Grant, there is a glossary in section 1.3 (Abstract Flow). It says "Following are key concepts relevant to this specification," but it doesn't jump out at you. I was looking for a glossary in the TOC, and couldn't find it. And then in UMA Federated Authz, there is no glossary. You could perhaps reference the Glossary from Federated Authz to UMA Grant, but some of the definitions maybe needs to be tweaked. For example, I was looking at the definition of permission ticket: "A correlation handle, initially passed to the client by the resource server" That makes sense for UMA grant, but for federated Authz, it probably makes sense to mention the AS. - Mike

2 4

Notes from UMA Legal telecon 2017-05-26
by Eve Maler 26 May '17

26 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-05-26 - Reviewing deliverable #2 Attending: Eve, JohnW, Kathleen, Tim, Andrew, Scott D, Mark L Eve shared the experience of presenting to the Cloud, Big Data, and AI legal conference on May 23. She got to try out the elevator pitch for our nascent legal framework and the rest of the work. She'll point to the PDF of her slides when available. The first key element of this deliverable, as discussed previously, is the conceptual orange/blue chart. Communications are required in an electronic protocol context. The Communication/Autonomy nexus includes Consent(Autonomy/Law), Sharing(Autonomy/Commerce), and Protocols(Autonomy/Communication). Scott notes: "Consciousness" as part of this might sound "frilly", but as part of law it's actually not – it's a "meeting of the minds", so it's fundamental to contract formation. There are famous cases every law student learns regarding this concept. John comments, channelling Doc regarding contracts of adhesion: How does this play in? The problem of the human mind and questions of human authority are fundamental. We ultimately have to map UMA to law. Eve: Going by the matrix, this looks like Consent (Law/Autonomy), Access Authorization (Law/Reciprocity), License (Law/Objectivity). Reciprocity supports enforceability of transactions. How do we get to a grant of access rights? UMA's permission tokens are an anchor. The word "delegation" from a legal perspective doesn't make sense, quite. Kathleen observes that DRM is a technology that is literally used to effect access licensing already. Is it possible to get to the point of breaking the law by accessing some digital resource? Who controls the access relationship? Any requirement for consent is a basis for the authority we are looking to ensconce. So the various regulations that strengthen consent requirements, such as PIPEDA, GDPR, PSD2, and others (such as "patient right of access", which is an "economic clout-oriented" strength, as Kathleen points out) strengthen our ability to make these connections. Eve thinks FIPPS is too "soft power", in that it needs to be operationalized through other regulatory structures. (Eve reminds us all to focus on the "hard power" we have, which is to develop the framework and toolkits to influence those actually deploying services. Our "soft power" to influence policymakers to make law and regulation is to be done only through the framework level as interesting written material, and through other means. That's why we don't have a Resource Regulator role formally.) Scott remarks that "consent" is sort of a legacy system that isn't fit for purpose, but is well understood. He also notes that the word "control" is a difficult one; a "co-management regime" over digital resources is a more realistic way of seeing the challenge. Kathleen points out that consumers have the power to fill their profiles with false information; she calls it discombobulation. Eve points to The Economics of Privacy <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2580411>, which provides evidence that savvy consumers can manipulate businesses/organizations, and that greater data sharing can benefit (e.g.) patients. Eve agrees about stepping back *two* steps from "data ownership": from "own", and again from "control", to "management". *Also* from "data" to "(digital) resource" (because sometimes the data is very transient, e.g. provided through a streaming API). Scott adds that a person's relationship to a thing should really be a relationship to another person vis a vis the thing. Eve wonders if we can publish a Talmudic-style commentary version of deliverable #2 (or turn all the deliverables into eventual WG deliverables, or whatever) for benefit of the wider audience we're going for. Scott notes that the UCC Commentary provides a potential model; it's citable. Mark notes that trade associations are trying to figure out how to develop codes of conduct that are GDPR-conforming. Eve points to A Typology of Privacy, and specifically its typology of the objects of the rights to privacy, as great additional commentary that could extend our analysis of Communication; it puts "mediated communication" under the "semi-privacy zone" (which came from Westin's work). John points further to the NIST Privacy Engineering <http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf> work; see page 17. Similar to the security concept of CIA, it proposes "predictability, manageability, and disassociability". Regarding the opportunities to combine forces and possibly have a KI-wide Legal WG that at least encompasses the scope of the current UMA Legal and CIS legal-related work: There's consent receipt lifecycles, User Submitted Terms as ready-made licensing terms, a CR version of the orange/blue matrix?, and possibly more. Eve noted that the current UMA Legal mission is very much like a charter. The French court had said it was a derogation of human rights to give too-broad permission. (And GDPR has now ensconced a requirement to give specific purpose of use!) So Scott had suggested at the legal conference that maybe it could be possible to delegate to a fiduciary layer some broad ability to manage permissions, and then that layer could give more reliability around this. This was the point at which Eve leaned over and whispered, "Like an authorization server?" [image: (smile)] (Or the authorization server operator, to be precise.) The theory Eve has had is that a Resource Owner (Grantor as was) and Authorization Server Operator should be able to negotiate the former delegating to the latter the ability not just to execute to the former's protection policies, but to set policies on their behalf, e.g. setting default policies. This is a real use case that has come up in HEART, and we have even defined one of the profiles to account for this. Tim says this is where the word *agent* comes in, so it should be covered. *Next steps:* Everyone to review the document as sent in email by next week for deliverable #3 purposes. *AI:* Eve: Review deliverable #2 for copy-editing/Kantara approval purposes ASAP. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Andrew Hughes 26 May '17

26 May '17

From: Megan Cannon <megan(a)kantarainitiative.org> Date: Fri, 26 May 2017 04:59:22 +0000 Subject: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently approved the UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0. The documents described below now enter a 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Documents: UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Version: 2.0 Document Date: 2017-05-25 Document URLs: UMA 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html> and Federated Authorization for UMA 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> Overview of Documents: *UMA 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for UMA 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-05-25 Review period closes: 2017-07-09 at 11:59 UTC To Comment on the Specification: To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION". Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-07-09, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo]

2 1

Re: [WG-UMA] Reminder: Legal subgroup call is on for tomorrow (Friday) morning
by Eve Maler 26 May '17

26 May '17

Thanks, Tim! Note: I may be a tiny bit late starting today's call. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756) > On May 26, 2017, at 3:19 AM, Tim Reiniger <tim(a)futurelaw.net> wrote: > > Here is the paper for today’s call. > > Tim > > From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Eve Maler > Sent: Thursday, May 25, 2017 9:37 PM > To: wg-uma(a)kantarainitiative.org > Subject: [WG-UMA] Reminder: Legal subgroup call is on for tomorrow (Friday) morning > > Tim and I met earlier this week, and he will have a revision of deliverable #2 and news about the direction of deliverable #3 for us. Our legal framework is starting to shape up! > > I can also share news of a talk I gave at a legal conference yesterday, and we can discuss the prospect of a Kantara-wide Legal WG, if time. > > Eve Maler (sent from my iPad) | cell +1 425 345 6756 > <UMA Legal Model Deliverable 2 Paper.docx>

1 0

Reminder: Legal subgroup call is on for tomorrow (Friday) morning
by Eve Maler 25 May '17

25 May '17

Tim and I met earlier this week, and he will have a revision of deliverable #2 and news about the direction of deliverable #3 for us. Our legal framework is starting to shape up! I can also share news of a talk I gave at a legal conference yesterday, and we can discuss the prospect of a Kantara-wide Legal WG, if time. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Draft minutes of UMA telecon 2017-05-25
by Eve Maler 25 May '17

25 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-05-18 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18>: APPROVED. Logistics - Final Draft Specification to be remanded to Kantara staff TODAY UMA V2.0 work We discussed FedAuthz Sec 3.2 in the scratch draft and changed editorial text to ensure that the UMA errors for the resource registration endpoint are clarified to be MAYs while the HTTP errors are MUSTs. (Take out of hanging list.) By contrast, we confirmed our understanding that Sec 4.3 – "the authorization server responds with an HTTP 400 (Bad Request) status code and includes one of the following error codes" – stays declarative and thus is definitely still implicitly a MUST in the fashion of our issue #312 decision. Issue #313 <https://github.com/KantaraInitiative/wg-uma/issues/320>: We needed more explanation from Justin. He meant that the phrase "human-readable" needs better definition. The method suggested is to do what RFC IETF 7591 Sec 2 <http://The value of this field MAY be internationalized, as described in Section 2.2.> does, which is say "The value of this field MAY be internationalized, as described in (7591) Section 2.2." Since that section already says it's OPTIONAL for the AS to do anything with it, and all other details are already covered, that's all we need to do; we can remove the paragraph. Issue #315 <https://github.com/KantaraInitiative/wg-uma/issues/315>: Reverse the wording so that REQUIRED is first. Issue #316 <https://github.com/KantaraInitiative/wg-uma/issues/317>: A big problem is the example of a hash of the session cookie, which is a really unusual way of doing things. Justin can do a pull request by 2pm ET. Issue #317 <https://github.com/KantaraInitiative/wg-uma/issues/317>: The two logical response options, = and <, shouldn't say MUST; for consistency they should just say "the authorization server responds...". (Yes, Justin did mean non-null!) Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: Regarding 3.3.6: invalid_scope should also cover cases where the client asked for a scope it's not registered for: In Sec 3.3.4, mention that if the client requests a scope that it didn't pre-register for, it's not an error (at the RPT request stage) because, during the authorization assessment process, the RequestedScopes might include scopes requested on the client's behalf by the RS. However, it is not included as a requested scope. Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: s/other entity other/any entity other/ Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: PoP: Let's keep as is. Other: - Catch curly quotes. - Catch out-of-date references. - Update publication dates. - Choose the correct Status of This Document. - Close issues! Logistics Eve and Justin will get the spec drafts ready in the next hour for Kantara staff to publish. Other artifact work: Let's work on those things casually next week and in the interim. Items include: - UIG (Eve) - Wikipedia page (Domenico will work on Italian one; Eve will reach out to others who have edited other pages in the past) - Release notes - FAQ (Eve has one to add) - Case Studies page - Swimlane (Eve) - Implementation page (Maciej) - ... Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Kathleen *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-05-25
by Eve Maler 24 May '17

24 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-05-18 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18> - Logistics/timing: - Final Draft Specification to be remanded to Kantara staff TODAY - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor) - Eve has implemented all decisions where possible and is expecting final Justin comment by this morning - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0