September 2017 - WG-UMA - mailman.kantarainitiative.org

Approve Draft Recommendations
by Salvatore D'Agostino 10 Sep '17

10 Sep '17

I vote to approve.

1 0

Notes from UMA Legal telecon 2017-09-08 (no call next week after all)
by Eve Maler 08 Sep '17

08 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-09-08 Attending: Eve, Tim We agreed that deliverable #3 is complete. *AI:* Eve: Let Colin know about deliverable #3. The Uniform Fiduciary Access to Digital Assets Act <http://www.uniformlaws.org/Act.aspx?title=Fiduciary%20Access%20to%20Digital…> is already in effect in most US states and will require other states to take action quick. The Act calls for the use of an "online tool" – "an electronic service provided by a custodian that allows the user, in an agreement distinct from the terms-of-service agreement between the custodian and user, to provide directions for disclosure or nondisclosure of digital assets to a third person". That sounds exactly like an authorization server! Our legal framework and tools can help with providing that. The Uniform Law Commission has commissioners from every state. It seems they promoted the law pretty well, given the thorough coverage. There's' also the increasingly pressing requirements for PSD2 (January 2018) and GDPR (May 2018). There's also the DIACC Trust Framework effort. Kantara can take directed funding for efforts to build specific tools, for example contract clauses (tools) for specific purposes. Would that make sense in the case of "directed" sets of contract language for jurisdiction-specific bodies of law covering specific use cases? Is it time to go to the BL-FIDM list to get attention and review, and see if we can find "customers" for fleshing out the full framework and our first tools in Q4 2017? We think so. *AI:* Tim: Draft message to BL-FIDM. Some goals: Ask for review of existing deliverables (some subset?) and slide artifacts (some subset?) to be determined, ask for use cases (and directed funding if needed to hire any further expertise?) for specific tool development, and ask really interested parties to join WG to develop tools actively in Q4 2017 and beyond. *AI:* Eve: Cancel next week's Legal call. *AI:* Eve: Revitalize our external reviewer list and think about who else to add from IAPP. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Confirming: Yes, we do have a Legal call tomorrow
by Eve Maler 07 Sep '17

07 Sep '17

Friday 8am PT https://kantarainitiative.org/confluence/display/uma/Calendar http://join.me/findthomas Slide deck: https://docs.google.com/a/meshfire.com/presentation/d/1I12agEsfaJK3LEiJyROr… Agenda: Close up deliverable #3! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

FYI re WG calendar invitations
by Eve Maler 07 Sep '17

07 Sep '17

Kantara staff will be making some changes to calendar invitations to make them accessible to the sight impaired, switching calendar links from using www.timeanddate.com to www.thetimenow.com/time-zone-converter.php. I'm not sure exactly when you'll see those coming through, but keep an eye out. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Kantara Mailing lists/ Spam-bot attacks - WG UMA
by Megan Cannon 07 Sep '17

07 Sep '17

Dear UMA WG members, We experienced a spam-bot attack on all our publicly listed mailings lists yesterday. One result of this attack was that some of you were no longer receiving emails from the list for a period of time. Your email addresses have since been unblocked at 3rd party providers and re-subscribed to the list. Also, a reminder that we keep an archive of the emails sent on the list at: https://kantarainitiative.org/pipermail/wg-uma/ ..so you haven't missed anything! On behalf of all staff, I am very sorry for the inconvenience, but we have worked swiftly, intelligently and collaboratively to minimize the impact. Thank you for your understanding and continued support of Kantara. Kind Regards Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 | M: +1.781.258.5523 megan(a)kantarainitiative.org <mailto:megan@kantarainitiative.org> kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA

1 0

UMA 2.0 Vote
by Mike Schwartz 06 Sep '17

06 Sep '17

UMA 2.0 Vote: [X] Yes [ ] No (you are encouraged to provide a rationale explaining why) [ ] Abstain - Mike

1 0

ID.next 28-29 Mar 2018 call for presentations closes on Sep 8
by Eve Maler 06 Sep '17

06 Sep '17

http://www.idnext.eu/en/events/annual-idnext-2018/request-for-presentations/ Anyone interested to submit UMA-related topics? Time is growing short... Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Revs 08 are available; IMPORTANT: please read carefully now, for e-ballot on Wednesday
by Eve Maler 06 Sep '17

06 Sep '17

I'm still having trouble uploading (I've asked Oliver to help with that already), so the drafts are attached to this email. As already requested, all of you, PLEASE take an hour ASAP to read through these specs to ensure they look okay. Key updates: - Resolutions to newish issue #354 <https://github.com/KantaraInitiative/wg-uma/issues/354>, sub-issue 1 and 2, including a new but pretty minor OPTIONAL FedAuthz error code in FebAuthz Sec 3.2 -- thanks to James and Cigdem for their important contributions here! - Grant Sec 3.3.4 on authorization assessment -- I caught a super-confusing point in the wording here, and Cigdem unravelled more of the same in the worked example and all over -- please read through, you won't be sorry. :) The example turned out to be critical to put in, and I think our #337f commenter will be very glad of our efforts. Voting participants will need to weigh in starting Wednesday with your e-ballot vote (voting participants: Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem). By the way, right now we DO have a meeting scheduled on Thursday, but I report for jury duty tomorrow morning, so we'll see what happens... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 3

Canceling our telecon this Thursday / other calendar updates
by Eve Maler 05 Sep '17

05 Sep '17

It is highly unlikely I will be available for this Thursday's call, as I have jury duty. Our main task this week (assuming you've all completed your review of revs 07/08 -- haven't seen any comments other than from Cigdem and James, and the discussion from Pedro -- and are considering the IP email I sent earlier today) is to have our WG's voting participants respond to the forthcoming emailed e-ballot. So I will *remove this Thursday's meeting from the calendar*. Let's meet next Thursday, Sep 14, to check in on e-ballot results and any word from the LC on their intent for the rest of the specs' timeline. We can also discuss get-out-the-vote planning and the upcoming IIW. Looking further out, I do also need to *cancel our Thursday, Sep 21 telecon* because I'll be heading to the airport. So I'll remove that meeting from the calendar too. As for Legal telecons, here's how the calendar looks: - This Friday, Sep 8: yes - Friday, Sep 15: yes - *Friday, Sep 22: NO (will remove from calendar)* *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

In consideration of a potential second IPR review period
by Eve Maler 05 Sep '17

05 Sep '17

The Leadership Council has discussed whether a second IPR review period might be required for the changes made to the UMA2 specifications since our first Public Comment/IPR Review period began on May 25th. Colin has asked me to: - Highlight our Work Group's IPR policy to all of you (it is "Option Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non discriminatory (RAND) <https://kantarainitiative.org/confluence/download/attachments/2293776/Kanta…>" (HTML version <https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=41025…>), as can be seen on our wiki home page) - Ask you all to let me/Kantara know, if possible, if you intend to opt out to RAND prior to the Leadership Council taking up its certification process (it would do this starting in approximately the next 7 days, once our week-long e-ballot, starting tomorrow, closes) This will help the LC in its deliberations as it determines what sort of additional Public Review period might be needed. To help you in your own deliberations, I have taken extra care to document the nature of the *technical* changes in the Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. Here's a summary: 1. #337c,d: Added claims_redirect_uris OpenID Connect Dynamic Client Registration metadata field: design tracks OAuth redirect_uris metadata field 2. #340: Reintroduced UMA1 not_authorized error code and renamed it to request_denied 3. #341: Added interval parameter to request_submitted; design tracks OAuth Device Flow interval parameter 4. #354-1: Added optional invalid_request error code to resource registration endpoint; design tracks OAuth and OAuth bearer token error codes 5. #354-2: Reintroduced UMA1 requirement for PAT as bearer token to be supported (Note that the technical changes fall into two categories: Reintroducing UMA1 design elements (items 2 and 5) and tracking existing OAuth design elements (items 1, 3, and 4) -- the latter aligning with one of our key roadmap design priorities, btw.) If you have any questions, please let me know. Please conclude your review today, as I'll send out the e-ballot tomorrow first thing!) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0