September 2017 - WG-UMA - mailman.kantarainitiative.org

Notes from UMA Legal telecon 2017-09-29
by Eve Maler 29 Sep '17

29 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-09-29 Attending: Eve, Tim, John, Bjorn, Mark Agenda: - What work remains for us to have a complete legal framework? - Getting ready to develop one key set of tools: model clauses / standard contractual clauses (discussed here: http://ec.europa.eu/justice/data-protection/international-transfers/transfe… ) - Could we actually get ours preapproved? - Note controller-to-controller transfer vs. controller-to-processor transfer options, something we’ve discussed in the past Jim pointed out his "Accordified" GDPR text efforts: - DE/FR/NL/EN. (Spanish and Greek also available): http://www.commonaccord.org/index.php?action=list&file=Dx/Acme/09-EU-US-Dat… - E.g., English language version under hypothetical of a UK sub of a US company transfering data to US parent: http://www.commonaccord.org/index.php?action=xEdit&file=Dx/Acme/09-EU-US-Da… - Source: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32010D0087 What's the difference between BCRs (binding corporate rules) and model clauses/SCCs? A set of BCRs is a kind of contract that might have SCCs in it. BCRs are developed in an ~18-month process, and have to be approved in all the various jurisdictions where they apply. BCRs have a lot of upfront cost/time, but save the organization cost/time later. SCCs can also be preapproved, but then each contract overall doesn't have preapproval, so you haven't saved as much cost/time upfront. Is it viable for us as a WG or dot-org to seek preapproval of SCCs we write? Maybe we should ask the Art. 29 Working Party about this. This could be valuable for giving UMA/Kantara visibility at that level. *AI:* Eve: Discuss the proposition of generic preapproval of standardized SCCs with Colin and Andrew. ISO/IEC 29100 <https://www.iso.org/standard/45123.html> is the key privacy framework that defines the terms PII subject, PII controller, PII processor (etc.). (We are using Data Subject etc. in our UMA Definitions Annotated deliverable.) In Consent Receipt, they use PII Subject etc. and recommend parameterizing the language accordingly. We can literally parameterize the language in our SCCs to the extent that we capture our language in CommonAccord. GDPR seems like the most obvious target for our completion of the framework, since it's got the right world attention, deadline, etc. Key questions (which we've asked before): - Can the Data Subject truly serve as their own Data Controller in a permission granting interaction? (Karsten Kinast has said yes before, at least philosophically.) Mark calls this a Master Controller Access Framework. - If yes, does it make sense for our use cases for end-to-end licensing relationships <https://docs.google.com/a/meshfire.com/presentation/d/1I12agEsfaJK3LEiJyROr…> to split out to make the requesting party (and client operator?) become either a) another Data Controller, or b) a Data Processor? Also see the new slide diagram <http://Merging RO-RSO, RO-ASO, and RO-RSO-ASO relationship train tracks> "Merging RO-RSO, RO-ASO, and RO-RSO-ASO relationship train tracks". This shows how our legal framework would work in terms of contract and licensing clause text dependencies. *AI:* Eve: Ask Domenico to take a look at the new diagram. A key theme of our work is to ensconce the twin to GDPR's (never-talked-about, Article 7) "right to withdraw consent at any time" – the right to consent, or not, at any time (vs. simply opting in or not!). The recitals of GDPR are infused with a data subject's rights but oftentimes regulators can't know what's possible in tech until they've seen it with their own eyes. UMA + consent receipts are powerful in this respect. *AI:* Tim: Think about revamping his magnum opus for Eve to "GDoc-ify". *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

We do have a Legal call tomorrow
by Eve Maler 29 Sep '17

29 Sep '17

8am PT, http://join.me/findthomas Topics: - What work remains for us to have a complete legal framework? - Getting ready to develop one key set of tools: model clauses / standard contractual clauses (discussed here: http://ec.europa.eu/justice/data-protection/international-transfers/transfe…) - Could we actually get ours preapproved? - Note controller-to-controller transfer vs. controller-to-processor transfer options, something we’ve discussed in the past Eve Maler (sent from my iPad) | cell +1 425 345 6756

2 1

Fwd: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Eve Maler 28 Sep '17

28 Sep '17

FYI. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Megan Cannon <megan(a)kantarainitiative.org> Date: Thu, Sep 28, 2017 at 9:04 AM Subject: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 To: announcements(a)kantarainitiative.org Cc: marketing(a)kantarainitiative.org, staff(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently concluded a round of public review, compiled comments, updated the original drafts, and approved the *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization* and *Federated Authorization for User-Managed Access (UMA) 2.0*. The documents described below now enter a second 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Document 1: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization (revision 08) Document 2: Federated Authorization for User-Managed Access (UMA) 2.0 (revision 08) Version: 2.0 Document Date: 2017-09-04 Document URLs: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html> and Federated Authorization for User-Managed Access (UMA) 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-08.…> To see a summary of comments and changes made related to the first public comment period, see this Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. Overview of Documents: *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for User-Managed Access (UMA) 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-09-28 *Review period closes: 2017-11-12 at 11:59 UTC* *To Comment on the Specification:* To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION" referencing the section or sub-section number, your comment and your proposed text to change. *Intellectual Property Rights Notice: * In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-11-12 at 11:59 UTC, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Cannon Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo] Click here to unsubscribe: https://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= keohitgu&unsub=1&unsubconfirm=1

1 0

Returning RPT from Resource Server
by Pedro Igor Silva 28 Sep '17

28 Sep '17

Hello, I have an use case where resources from a UMA protected resource server don't require issuance of permission tickets. There is no need for RO approval neither claims gathering flow. But just check if a requesting party is allowed or not to access the resource. I was wondering if I could enable a RS to act as a broker in a way that it could exchange the token the client has with a RPT and then return the RPT to the client. Subsequent requests from client will then use the RPT returned by the RS to access protected resources. With this scenario I'm looking for: * Avoid unnecessary round trips between clients and AS in order to obtain a RPT when a permission ticket is not necessary. * Allow RS to push additional claims to AS with runtime/contextual data and evaluate policies based on these claims. Any thoughts ? Regards. Pedro Igor

2 4

Regarding our call series this week and our spec approval timeline
by Eve Maler 27 Sep '17

27 Sep '17

It turns out the UMA2 specs require a second public review period, which we are going to start ASAP with the assistance of staff. This is to give Kantara Members their due chance to examine the technical changes made (summarized at the bottom of our Disposition of Comments document <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…>) and consider any intellectual property rights impact to them. NOTE: I think we're probably all eager to see these specs finalized, and technical comments aren't really the focus of this period (stability = good!). However, if comments do come in, we'll need to decide and document their dispositions. Give this turn of events, I'm going to *cancel tomorrow's WG call*. However, let's *keep the UMA Legal call on Friday*. If you have questions about the finalization process from here on out, let me know. *Eve Maler*Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

need_info: value for redirect_user
by Mike Schwartz 15 Sep '17

15 Sep '17

UMA-tarians, I have a question about the redirect_user value of the need_info error response. Is this supposed to be the base URI, to which the client should add a state and claims_redirect_uri value? - Mike

2 1

Draft minutes of UMA telecon 2017-09-14
by Eve Maler 15 Sep '17

15 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-09-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-08-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03> and UMA telecon 2017-08-17 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-17>: Deferred. Discussion of "union of resource-mapped" editorial issue Justin advocates removing the non-normative parenthetical with the *∪ resource* in it*.* We have consensus to do so, as long as this can remain in the realm of a free editorial fix prior to next publication as part of the V2.0 process. What's happening now and next steps - Colin/Andrew and the LC are taking up the question of certification (for either All-Member Ballot or some kind of Public Review of the deltas) - Shortly we'll gear up for GOTV - How shortly depends on getting an answer from Kantara. Eve has prepared a Google Sheets spreadsheet so we can do outreach - In anticipation of passage, what education/outreach activities make sense? what interop activities make sense? - Pre-Recommendation timeframe - Post-Recommendation - IIW timeframe - This is the only timeframe we know for sure: Oct 17-19 <https://www.eventbrite.com/e/internet-identity-workshop-xxv-25-2017b-ticket…>. That's not long from now! Eve can't attend, but has colleagues going (and ForgeRock is one of the sponsors). ForgeRock and Gluu would presumably have products to try out by then. Trying out an interop would depend on some kind of "standard API with resource and scope documentation" like we recommend in the specs. - Mike has been advocating informal interop testing before formal conformance testing with a test harness. Justin describes how that happened: People published endpoints and OIDF kept track of the results with published matrices. It was pretty complicated. - The first step would be identifying an independently implemented AS, RS, and C and try to get them to work with one another. - Who's attending IIW? George; Justin hopes to; Sal hopes to; Eve is a no. - Look at UMA2 logo options at this point? - We looked at the proposals from Domenico and Justin and worked together to come up with a direction that Justin will execute. *AI:* Eve: Reach out to known UMA2 implementers and see what entity role coverage they have. *AI:* Domenico: Send Justin his additional logo drafts as fodder. WG schedule - *Week of Sep 18:* No WG meeting Sep 21, no Legal meeting Sep 22 - *Week of Sep 25:* WG meeting will be held Sep 28, Legal meeting will be held Sep 29 To reiterate: No meetings next week! Other items on the WG docket - Pedro's flow suggestions - Justin remarks that if you're talking to the token endpoint without a ticket, you're just doing OAuth already (presumably with an existing grant, depending on details). He cautions not to accept all suggestions, which is what OAuth1 did. UMA2 is a lot cleaner and it would be a shame to load it up again. This is what the "extension" issue label is about. - Other issues labeled "extension" - Liaison with Consent and Information Sharing WG for some items? Anyone interested in consent receipt-related topics at all? Eve and George (related to the third bullet). *AI:* Eve: Create an issue for the first bullet so Pedro's suggestion doesn't get lost. *AI:* Eve: Discuss liaison activity with CIS WG. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Eve 4. Cigdem Non-voting participants: - James - Justin - George - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Possibility of one small editorial clarification in Grant
by Eve Maler 15 Sep '17

15 Sep '17

Cigdem was suggesting a way to clarify a key set math formula in Grant Sec 3.3.4 during our rev 07 review, and I was struggling to figure out a way to format it the way she was suggesting, so in rev 08 I had just left it in place without changing it. But we figured out a rhetorical vs. formatting change that might clarify things a bit more: to change from this... *“{∪ resource {RequestedScopes\CandidateGrantedScopes}={}”* to this: *"{∪_of_resource {RequestedScopes\CandidateGrantedScopes}={}"* The intent is to say that you take the *union* over all the resource-mapped sets of the diff between *RequestedScopes* and *CandidateGrantedScopes*, and if *that's* empty, then you've got a slam-dunk case of issuing the RPT. The snippet *"∪ resource"* may be sufficient to convey that, but we thought *"∪_of_resource"* could be better. (Or maybe someone has some other improvement that's even better.) If we have quorum in our call today, we could do a new motion just like the e-ballot to rev to 09 with that update, assuming we think it's necessary. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2017-09-14
by Eve Maler 13 Sep '17

13 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-09-14 (please see page for details) Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-08-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03> and UMA telecon 2017-08-17 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-17> - What's happening now and next steps - WG schedule - Other items on the WG docket - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

E-ballot: Whether to approve the UMA2 specs as Draft Recommendations and forward them to the LC
by Eve Maler 10 Sep '17

10 Sep '17

(You will find revisions 08 of the specifications in the email archives for now. We'll try to get them up in the usual place soon.) This electronic ballot is designed to conform to Kantara's Operating Procedures 2.0 <https://kantarainitiative.org/confluence/download/attachments/84279306/Kant…> (see Section 7.2). *Resolution 2017-09-05-A:* Having disposed of all Public Comment/IPR Review period comments, approve UMA 2.0 Grant rev 08 <https://08620661282160442115.googlegroups.com/attach/c51693320287d/oauth-um…> and FedAuthz rev 08 <https://08620661282160442115.googlegroups.com/attach/c51693320287d/oauth-um…> as Draft Recommendations and forward them, with reference to the UMA 2.0 Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…>, to the Kantara Leadership Council to request their certification and determination of their next step towards finalization as Recommendations. WG voting participants (the current roster is here <https://kantarainitiative.org/confluence/display/uma/Participant+Roster>; eligible voters are Domenico, Sal, Andi, Maciej, Eve, Mike, and Cigdem), *please respond in this thread* with one of the following: [ ] Yes [ ] No *(you are encouraged to provide a rationale explaining why)* [ ] Abstain For the ballot to be valid, a majority of eligible voters must return a vote (including "Abstain"). For the ballot to pass, the "Yes" votes must exceed the "No" votes. This ballot closes at *10:59:59pm Pacific Daylight Time on Tuesday 5 Sep 2017*, or earlier at the Chair's discretion if all eligible voters have voted before that time. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

5 7