June 2017 - WG-UMA - mailman.kantarainitiative.org

Reminder: We are on for the Legal call tomorrow (Friday)
by Eve Maler 29 Jun '17

29 Jun '17

Tim will be leading the discussion. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Draft minutes of UMA telecon 2017-06-29
by Eve Maler 29 Jun '17

29 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-29 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-05-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25>, UMA telecon 2017-06-15 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-15>: APPROVED. Public Comment period Public Comment/IPR Review period concludes on July 12 – please report any comments you have during this period. Do we have any other comments coming from the "outside" through the officially published channel? Colin reports that no such comments have been received. An email reminder was sent out a few days ago, and more are coming. Eve will start a social media campaign from the UMAWG handle today, through July 12. Please RT etc. CIS trip report Eve, Colin, Maciej, Mike, Justin, and others were there. The "Authorization: Age of UMA" approach communicated the Alice-to-Bob (Tony-to-Pepper) approach really thoroughly and seemed to have the right light touch that late in the conference. Maciej could testify that his wife, who was present, finally understood UMA for the first time after eight years! There were ways it didn't go into as much depth. But "CIS Twitter" did seem to appreciate it as a teaching device. Colin notes that Kantara overall ended up having a "community area" near its booth, with ID.me, Gluu, etc. The pre-conference workshop went well. A very "agile" no-screenscraping pledge effort <https://kantarainitiative.org/psd2statement/> was put together; don't forget to go and sign up! IDpro.org <https://idpro.org/> is spreading its wings. Eve notes the Women in Identity effort and the corresponding #ZZAuth song. [image: (smile)] At CIS, Eve made announcements about interest in interop testing and asked for people to contact her with interest in providing funding and other resources. UMA 2.0 work #332: Justin's article <https://medium.com/@justinsecurity/uma-2-0-437c293c3283> says succinctly: "If the authorization server chooses, the claims represented by the PCT can fulfill the policies set by the resource owner." But the closest we get in actually saying this directly, after building up a story in bits and bites, is in Grant Sec 3.3.4 in a Note where we say "Note: Claims and other information gathered during one authorization process may become out of date in terms of their relevance for future authorization processes. The authorization server is responsible for managing such relevance wherever information associated with a PCT, or other persistently stored information, is used as input to authorization, including policy conditions themselves." Can't we do better, from the beginning definition and throughout? It's not enough to say "optimizing" in the beginning without saying what that means and how it's accomplished. Mike notes that in Sec 3.3.3, "Such persisted claims will be represented by a PCT issued to the client in a subsequent step", the "will" part isn't strictly true if the client doesn't provide the PCT in the request. There are a few challenges: The PCT discussion is spread out, and it's too oblique. Mike notes that the example of redirect_user with a custom URI with a query parameter was helpful, and suggests extending the normative language describing it in Grant Sec 3.3.6 would be good. E.g.: "Providing a value in this response might be appropriate, for example, if the URI needs to be customized per requesting party *with a query parameter*." *AI:* Eve: Add issue; look up the URI/reference/etc language to get this right. Leadership team elections MOTION: Re-elect Eve Maler as WG chair for an annual term, Maciej Machulak as WG vice-chair for an annual term, Domenico Catalano as Graphics and User Experience Editor for an indefinite term, and Maciej Machulak as Implementations Coordinator for an indefinite term. APPROVED by unanimous consent. Meeting schedule and preparing for All-Member Ballot Let's not meet on July 6. Let's try to meet on July 12 and see if we can make quorum to approve our Recommendations, ideally already edited if we get no huge substantive/troubling comments, so they can proceed to the Leadership Council for approval on July 19 (or in an electron ballot) to proceed. Interop testing plans ForgeRock will ship a platform release with UMA2 support in approximately October. Gluu should ready by then too. We should reach out to the KeyCloak guys around then. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Maciej 3. Eve 4. Mike Non-voting participants: - Colin - John W - Thomas - Robert Guests: - David Turner Regrets: - Cigdem - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-06-29
by Eve Maler 27 Jun '17

27 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-29 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-05-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25>, UMA telecon 2017-06-15 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-15> - Public Comment/IPR Review period concludes on July 12 – please report any comments you have during this period - CIS trip reports - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor)/Release Notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> /UIG <http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui…> /Wikipedia <https://en.wikipedia.org/wiki/User-Managed_Access> - New editorial issues (trivial, regarding IANA registration matters) #329, #330, #331 – three responses from registrars have come back and four are pending - New editorial issue #332 <https://github.com/KantaraInitiative/wg-uma/issues/332> about whether PCT definitions for AS and client are sufficient for implementation – discuss? - Release notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> are getting fleshed out bit by bit - Leadership team elections - Terms <http://kantarainitiative.org/confluence/display/uma/Leadership+Team> expire June 23 - Nominations - Elections (if quorum) - Upcoming meetings: Need to meet on *July 6*? Definitely meet on *July 13* and *shoot for quorum* - If no issues other than editorial by July 12, could have an edited spec ready for review July 13 - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder of no WG call this week / canceling Legal call this week / Legal Qs to ponder
by Eve Maler 21 Jun '17

21 Jun '17

Let's cancel the Legal call as well this week, as Tim has some other obligations on Friday. (I'll delete the calendar invitation for Friday.) He sends these questions for us to discuss in email, however: *"One point I would like to clarify (in response to questions about whether we are talking about grantors, obligate, bailouts, etc) and s that we have in mind licensors in our proposed UMA model.* *Also, I find it helpful to sort out two categories of consent with UMA: 1) delegations of authority to another person/entity to make access decisions on our behalf and at our direction and 2) granting/assigning access rights and uses for a particular purpose ( i.e. licensing) by another person/entity. It seems that all of the various possible relations between the UMA operators/roles flow from this."* Please share all your thoughts! I'll try to send mine as I'm able, given that CIS is still raging... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Leadership team positions and nominations
by Eve Maler 16 Jun '17

16 Jun '17

Folks-- The current roster is recorded here <http://kantarainitiative.org/confluence/display/uma/Leadership+Team>. It goes like this: 1. Chair: Eve Maler 2. Vice-Chair: Maciej Machulak 3. User Experience Editor: Domenico Catalano 4. UMA-Dev WG liaison: Maciej Machulak Roles #1 and #2 are formal. (Technically, we're supposed to have a Secretary role too, which I myself fill in practical terms but we haven't filled formally.) The terms are one year, renewable. Roles #3 and #4 are informal and discretionary. We have tended to cast role #3 pretty wide, and sometimes call it Graphics/UX Editor. And the UMA-Dev WG isn't active at the moment, so role #4 is currently more like (and used to be called something like) Implementation Coordinator. These terms all happen to expire on June 23. (We could actually make the informal role terms longer than a year if we wish...) Let's discuss the role-squishiness (Secretary and informal-role) situation on June 29. Please feel free to drop me a note nominating yourself or another participant (maybe seek their okay first? :-) ) prior to that date. Note that chairs and vice-chairs have to be voting participants. See this Roles description page <http://kantarainitiative.org/confluence/display/GI/Roles> and the Kantara Operating Procedures <http://kantarainitiative.org/confluence/download/attachments/84279306/Kanta…> for more detail. Thank you! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2017-06-16
by Eve Maler 16 Jun '17

16 Jun '17

Thanks to all for a lively call! http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-06-16 - Reviewing pieces of deliverable #3 - All the roles in the use cases - Names and definitions for them - Different ways to connect the legal and technical artifacts and why - The different "solar systems" in the jurisdictional universe Attending: Eve, Andrew, Kathleen, Thomas, John W, Sal, Tim *Assumption:* The resource protected by UMA is personal information. Is it always? We'd had conversations in the past about other use cases, such as that the resource is not PI but rather "confidential information", or "IP", or something else that's not "PI". This subgroup's mission makes clear that it's about "protecting privacy rights", so it suggests that other use cases, such as protecting these other kinds of information (which is useful for both natural and legal persons as resource owners), are out of scope. We should state this somewhere in the final deliverable – not that the framework couldn't reasonably (or even easily?) be extended for these purposes, but we haven't chosen to focus on them at this time. *Data Subject* shortens to DS (vs *Resource Subject* and RS), and then it wouldn't clash with *Resource Server*/RS. *Data Subject* is the canonical name in GDPR, the ISO privacy framework, and pretty much all "privacy talk" around the "trinity" of data subjects, data controllers, and data processors. Let's make it so! If you have a *Client Operator* (say, Google running a *Client*, Google Calendar) and a *Requesting Party Agent* (this is our current term under discussion) – say, Dr. Bob using the Google Calendar *Client* – who is using it under the control of the real *Requesting Party*, a hospital institution – is it abundantly clear that the CO is distinct from the RqPA? Here is how the RSO and the CO each have a legal relationship with the ASO distinct from other/higher-order relationships: - The RS gets OAuth client credentials from the AS, and there is an opportunity (currently nearly always taken) for the ASO to impose an agreement on the RSO before issuing these credentials. - Similarly, the C gets OAuth client credentials from the AS, and there is an opportunity (currently nearly always taken) for the ASO to impose an agreement on the CO before issuing these credentials. When we wrote the old Binding Obligations clauses, we put clauses having to do with the client credentials stage out of scope. However, UMA2 requires <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html#autho…> the client to take certain actions at registration time (meaning, before the requesting party – NOTE: or, requesting party agent) is wielding that client software. This means effectively that the client's interactions at that registration juncture are on the "legal stage" for us, licensing-wise – so we seem to need a new table for client credentials for each, even if we may not need model clauses for one or both. The requesting party agent note is about the fact that Alice the patient might give access to "a doctor's practice" overall to get access to her calendar for scheduling her pre-op appointment. The receptionist ultimately gains access under this policy. The receptionist isn't "the practice", but an agent of the practice doing work for hire. The calendar is being used by the receptionist (*Requesting Party Agent*) but is "operated" by Google the company (the *Client Operator*). The idea is that the CO would be bound by any license formed through the client credentials issuance timeframe, the RqPA would be bound by his/her employment agreement with the "true" RqP, and the "true" RqP would be bound by the end-to-end RPT licensing through the main UMA Legal framework. The Word doc uses "Consent License". Why not "Use License" or just "License"? In order to market the framework as being able to solve a large class of consent challenges, it seems we need not put an adjective on "License" – just talk about our solutions in other ways and parts of our framework documentation. Is it worth talking about "Data Protection Licenses"? Or maybe this is a "licensing framework", and we ultimately produce a "licensing toolkit", and hey, maybe a "licensing API" that can be called! The agreements others produce with it could be whatever kinds of agreements they need to produce! Given that the agreements others produce might be dynamic (while versionable etc.) and dynamically negotiable – while we reduce the friction to making them protective of privacy rights – we don't necessarily want to apply old-fashioned labels too soon. *Resource Owner* vs *Grantor* as a name is still an open question. HL7 uses Grantor in a way that seems to only apply when the person is the offeror (?) of license terms. But in UMA, this person could be either the offeror or accepter of license terms, based the UX. Or is that true? This is an open question. Eve is starting to suspect that, regardless of flow, the RO/G is always the offeror. If Eve's assumption is correct, the next open question Eve and Tim had discussed is: Despite the "chain of agents/legal representatives" that may exist, does the offer of license terms always rest at the Data Subject somehow? E.g.: - *Data Subject* little Johnny (2yo) - ...has an Agent/Legal Representative (she's probably the latter because Johnny's a minor) mom Alice, who sets some policies on Johnny's behalf but also - ...chose an Agent, Authorization Server Operator ShareHub, which sets up some default policies and security protections - Alice shared Johnny's EHR in selective fashion - ...with RqP research organization NYP through CO *autonomous web client* Sync4Science Scraper - ...which gives downstream access to employee researcher RqPA Charlie Alternatively: - Data Subject little Johnny (2yo) - ...has an Agent/Legal Representative mom Alice, who sets some policies on Johnny's behalf but also - ...chose an Agent, Authorization Server Operator ShareHub, which sets up some default policies and security protections - Alice shared Johnny's EHR in selective fashion - ...with researcher RqPA Charlie using *web or mobile C app* Research Viewer - who gives access to the broader research organization because of his employment relationship Is the transfer of "access grants" or of a "right"? And do we stick with "Grantor", do we move back to "Resource Owner", or change entirely to something like "Data Subject Proxy" or "Data Subject Agent"? This person may have relationships with a lot of ASOs, and in some cases it's on their own behalf, and in others it's on behalf of others. There is no UMA artifact that documents on the wire (maybe on the wire in the medical world, in some circumstances?) the relationship between these two roles. See our matrix from the 2016-03–18 telecon <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> for all the relationships and technical artifacts. The way the NZ government solved this was to invent a "headless" account for the offline person, and then have the institution manage the account on the person's behalf. Eve's suggestion for a followup from Tim: Enumerate and recommend answers for all the outstanding questions above. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Draft minutes of UMA telecon 2017-06-15
by Eve Maler 15 Jun '17

15 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-15 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-05-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25>: Deferred. Logistics - Public Comment/IPR Review period concludes on July 12 – please report any comments you have during this period - No meeting on June 22 due to Cloud Identity Summit - Who's going to CIS? Should we have a BOF? What sessions should we be aware of? Check out this nice article <https://www.kuppingercole.com/blog/reinwarth/beyond-simplistic-achieving-co…> from KuppingerCole. CIS: Justin, Eve, Mike, Colin, Sal, Mark L. Don't miss the UMA2 session on Thursday afternoon. Justin is speaking on Shadow IT on Monday, and gray lists on Thursday. There's a Kantara workshop on Monday morning, where there will be a lot of updates, and a Kantara booth (table). IRM has an updated principles paper. Eve is speaking on HEART on Thursday. Sal, Mark, and Eve are on a privacy panel Tuesday afternoon. Sarah is speaking on VoT (vectors of trust) just before the UMA talk (this is opposite the HEART talk). Mike is speaking in the Practical OIDC track on good client software Wednesday morning. Eve and others are performing in a band on the Wednesday night after the keynote. #ZZAuth, baby. Let's all promote each other's talks as the week proceeds! UMA V2.0 work - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor)/Release Notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes>/ UIG <http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui…> /Wikipedia <https://en.wikipedia.org/wiki/User-Managed_Access> - It seems no discussion is needed on new issues #326, #327, #328 – all are editorial and none seem to have controversy (speak up if you disagree) - Issue #257: Discuss new proposal for how to write the release notes (from Eve) - Issue #287: Time to submit our IANA registry requests formally? - Issue #300: Update our IETF Internet-Drafts (or create new ones) at Recommendation status? Release notes approach: Eve's attempted approach seems reasonable enough. The categories are: Spec Reorg, Terminology Changes, AS Discovery, AS/C and RS/C Communications (basically UMA grant), AS/RS Communications (basically fed authorization), and General. An UMA2 implementation approach might involve a fresh start in any case, though Eve's feeling is that it's just due diligence to publish proper release notes, to catch small corner cases or any small bits of code reuse that got things wrong from before. Justin notes that the MPD implementation is sort of "95% there", it's just that he'd need a sponsor, or engineers thrown at it to do pull requests. This was a branch on MITREid Connect (the previous version, V1.2). It was never brought into an official release stream. Sal might reach out about that. *AI:* Eve: Send off emails to the relevant official IANA Registry email addresses regarding making the registration requests. I-Ds: Do we even need to create something like this anymore? Does anyone point people to the I-D versions anymore? Justin gives this example <https://github.com/jricher/OpenID-Connect-Java-Spring-Server>. We probably should have put links to the wiki home page into those pointer I-Ds in the first place, but oh well. Consensus not to bother. The thread with Pedro Are there any actions needed based on the various topics in that thread? - You don't do the implicit grant with UMA; you do the UMA grant itself. It allows any client type you want, unless you want to further constrain client types in some profile of the UMA grant that you write yourself. The UMA grant does have special protections within it that make it more secure – in some respects – than, say, the authorization code grant, because (e.g.) the permission ticket is obtained through an API call. - This sounds a bit related to Eve's discussion with some researchers asking why the permission ticket exists and questioning its security and usability benefits. - Also see Chapter 1 of Justin's book, available for free! - Developing a test harness and doing an UMA (assuming UMA2?) conformance program: Kantara is looking for directed funds to make this happen! Our last estimate was $60K. Maybe it could use some volunteer effort as well to defray expenses. - A while back, Gluu had done some work on figuring out a sample API to protect. - Maybe informal interop testing is what's needed before formal testing. Then again, note that the informal OIDC testing was messy and hard to manage. "Neatness" of testing would count for a lot. Leadership team elections - Terms <http://kantarainitiative.org/confluence/display/uma/Leadership+Team> expire June 23 so we should vote on positions and new annual terms by either today or June 29 All are encouraged to stand for any position they wish. *AI:* Eve: Send note to the group about positions and nominations (self- or other). Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Eve 4. Cigdem Non-voting participants: - Justin - Scott F - Colin L - Thomas Regrets: - James - John W *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Reminder: UMA Legal telecon is on for tomorrow
by Eve Maler 15 Jun '17

15 Jun '17

We're bearing down on answering key questions about the legal framework, including: - All the roles in the use cases - Names and definitions for them - Different ways to connect the legal and technical artifacts and why - The different "solar systems" in the jurisdictional universe *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-06-15
by Eve Maler 14 Jun '17

14 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-15 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-05-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25> - Logistics: - Public Comment/IPR Review period concludes on July 12 – please report any comments you have during this period - No meeting on June 22 due to Cloud Identity Summit - Who's going to CIS? Should we have a BOF? What sessions should we be aware of? - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor)/Release Notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> /UIG <http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui…> /Wikipedia <https://en.wikipedia.org/wiki/User-Managed_Access> - It seems no discussion is needed on new issues #326, #327, #328 – all are editorial and none seem to have controversy (speak up if you disagree) - Issue #257: Discuss new proposal for how to write the release notes (from Eve) - Issue #287: Time to submit our IANA registry requests formally? - Issue #300: Update our IETF Internet-Drafts (or create new ones) at Recommendation status? - Leadership team elections - Terms <http://kantarainitiative.org/confluence/display/uma/Leadership+Team> expire June 23 so we should vote on positions and new annual terms by either today or June 29 - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

For Legal eagles: links to older UMA binding obs/model clause work
by Eve Maler 14 Jun '17

14 Jun '17

In Friday's call <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> we discussed existing work that might "fill in" sample license text. Here is what we did to date (keeping in mind that the terminology might not survive our current process, but that we pretty much need to decide all that by the time we exit deliverable #3): - The Binding Obligations <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> spec (officially obsolete). You can actually search throughout to look for PAT, RPT, and (this was written in UMA1 times) AAT mentions. The AAT is a pretty good substitute for the PCT for now. - Our CommonAccord draft model text <http://source.commonaccord.org/index.php?action=doc&file=G/Kantara-UMA-Text…>. Again, it mentions the tokens specifically, and was prepared in the UMA1 era -- but it post-dates the Binding Obs. Our intent has been to prepare "model clauses" (or whatever you want to call them) using the CommonAccord parameterized prose/code system as one of our legal toolkits. Probably our main legal toolkit, with others that might look like checklists and such. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3