August 2017 - WG-UMA - mailman.kantarainitiative.org

Agenda for ad hoc UMA WG telecon 2017-08-06 (tomorrow/Monday!)
by Eve Maler 07 Aug '17

07 Aug '17

We have a special meeting tomorrow (Monday) at: 9am PT/11am CT/noon ET/5pm UK/6pm CET http://join.me/findthomas Issues: https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen%20is%3Aissue… Grant: https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-06.html FedAuthz: http://docs.kantarainitiative.org/uma/ed/oauth-uma-federated-authz-2.0-06.h… Please take a look at the open issues and weigh in before getting on the call, if possible. This will help speed our decisions. In several of them I've tried to list options and add some discussion points. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Special Monday meeting is now on the UMA calendar
by Eve Maler 04 Aug '17

04 Aug '17

I've removed calendar entries for next week's Thursday WG meeting (Aug 10) and also the Friday Legal meeting (Aug 11). *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: Legal telecon tomorrow
by Eve Maler 04 Aug '17

04 Aug '17

http://join.me/findthomas 8am PT/11am ET http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes https://docs.google.com/a/meshfire.com/presentation/d/1I12agEsfaJK3LEiJyROr… *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2017-08-03
by Eve Maler 03 Aug '17

03 Aug '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-07-20 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-07-20>, UMA telecon 2017-07-27 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-07-27>: APPROVE by acclamation. Schedule for upcoming weeks Eve can't make the Aug 10 meeting. Andi is away next week and the third week out. Domenico is out starting Aug 14. If we had an e-ballot running during the last week of August to approve the specs for a new Public Comment period, voting participants on the call could be available online the week of Aug 28 and the week of Sep 4 (that day itself is US Labor Day). AI: Eve: Send invitation for Monday Aug 7 at 9am PT as a substitute for Thursday Aug 10. Eve should be available at our normal times for the following three weeks; we'll see if we can continue to get critical mass then (if not official quorum). UMA 2.0 work #337b <https://github.com/KantaraInitiative/wg-uma/issues/337>: This harks back to Pedro's comments and Justin's responses about the grant's "agnosticism" to clients. The assumption wording in Grant Sec 3.3 now is: "The client has obtained OAuth client credentials from the authorization server, either dynamically through [RFC7591] or [OIDCDynClientReg], or alternatively through a static process, and is prepared to authenticate itself to the token endpoint if appropriate." Instead we could say: "The client has obtained a client ID or a full set of client credentials as appropriate, either statically or dynamically (for example, through [RFC7591] or [OIDCDynClientReg]). This grant works with clients of both confidential and public types." *We have consensus.* #339 <https://github.com/KantaraInitiative/wg-uma/issues/339>: James misinterpreted the wording in FedAuthz Sec 4.1 and so suggested that the RS should get flexibility: object *or* array at its discretion for a single permission in the request, with the AS picking up the slack. The spec would have to clarify/change the wording and probably add an example of the single-object-in-an-array way of doing things. Reactions: - Removing the object option would have been breaking. This isn't. - Typically, adding "two ways of doing things" would be unattractive (except for backwards compatibility reasons; we did that in V1.0.1 and then, in some cases, removed the old deprecated methods in V2.0). - Any insights from OIDC history? Spec design philosophy has been to make the AS do the heavy lifting – we have exactly the same. #341 <https://github.com/KantaraInitiative/wg-uma/issues/341>: Eve's suggestion in the issue thread was that there are two use cases: synchronous and asynchronous. But what does that mean? She meant that by the time the RO responds, it would be impossible to consider their response during the RqP's session. But the discussion from issue #298 <https://github.com/KantaraInitiative/wg-uma/issues/298> is about how it's not a matter of time elapsed, but use cases where the RO's policy says "ask me every time", such that *not* issuing a ticket at all means that the AS would have "amnesia" when the client returns even after a very lengthy period of time. If it returns directly to the AS with the ticket after, say, several days, ticket in tow, even if all the other necessary claims have expired etc., there might then be a record of the RO having said "yes" and claims-gathering could proceed as required. If we decide to change from MUST return a ticket to MAY, then all the client can do when the AS doesn't return a ticket is obviously to start over at the RS. It turns into a terminal type of error from a continuance type of error. Ultimately, a MUST forces it to be one kind of error, while a MAY lets the error function for two different kinds of use cases. So we have two clear options (probably still adding that the AS should document its type of request submissions regardless?): - Option 1: Keep the MUST, which is a terminal error. - Option 2: Change to MAY, which splits into terminal and continuance errors. UMA logo Deferred. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Cigdem Non-voting participants: - Kathleen - Bjorn Regrets: - James *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-08-03
by Eve Maler 02 Aug '17

02 Aug '17

*(Please review new/existing open issues and weigh in before the call!)* http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-07-20 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-07-20>, UMA telecon 2017-07-27 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-07-27> - Schedule for upcoming weeks - *Can't meet Aug 10*; substitute another time? - When are people on vacation? - UMA V2.0 work: - Disposition of Comments <http://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+of…> /GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /Grant swimlane <https://www.websequencediagrams.com/files/render?link=GDUuGPibcbXrR5uWBSQP> /FedAuthz swimlane <https://www.websequencediagrams.com/files/render?link=tGft5o5ErGvUWj4X3o-O> /Release Notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> /UIG <http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui…> /Wikipedia <https://en.wikipedia.org/wiki/User-Managed_Access>/Grant rev 06 <http://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-06.html> /FedAuthz rev 06 <http://docs.kantarainitiative.org/uma/ed/oauth-uma-federated-authz-2.0-06.h…> - We need to work through the open issues, so please weigh in on GitHub if you have opinions - Candidate motion when we're ready: "Approve UMA 2.0 Grant rev *nn* and FedAuthz rev *nn* as amended by the instructions of UMA telecon 2017-xx-xx as Draft Recommendations and forward them to the Kantara Leadership Council to request immediate certification for an All-Member Ballot as Recommendations." - UMA2 logo discussion (defer till we're in All-Member Ballot) - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

For UMA legal. How would the licensing on this resource work?
by John Wunderlich 01 Aug '17

01 Aug '17

Judge: Lawyers may need to justify $1.12M fee request for '3 months work' in sex toy case settlement | Cook County Record Source: http://cookcountyrecord.com/stories/511162880-judge-concerns-over-1-12m-law… (via Mr. Reader) Thanks, John Wunderlich @PrivacyCDN Pleez 4give speling errurs, sent from a mobile device. -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Exemplary real world use case for UMA
by John Wunderlich 01 Aug '17

01 Aug '17

The advocates in the linked article make a good case why the health records of children with congenital health issues that now survive much longer should be kept for life. But this puts burden on the health information custodians with respect to staying in touch with the adult, respecting their consent directives, and respecting regulatory requirements. How much better would be a patient managed/controlled/owned resource server...? https://www.thestar.com/news/queenspark/2017/07/28/medical-records-of-sick-… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 4