February 2018 - WG-UMA - mailman.kantarainitiative.org

Scope Expressions
by Mike Schwartz 28 Feb '18

28 Feb '18

UMA WG, We are proposing "scope expressions" as a way to enable the RS to express complex scope requirements. The serialization format for scope expressions we've tested is JSONLogic: http://jsonlogic.com --------------------- RESOURCE REGISTRATION --------------------- If the scope_expression claim is present, resource_scopes should be blank--scope expression and resource_scopes are mutually exclusive. For example: { "resource_scopes":[], "description":"Collection of digital photographs", "icon_uri":"http://www.example.com/icons/flower.png", "name":"Photo Album", "type":"http://www.example.com/rsrcs/photoalbum", "scope_expression": { "rule": { "and": [ { "or": [ {"var": 0}, {"var": 1} ] }, {"var": 2} ] }, "data": [ "http://photoz.example.com/dev/actions/all", "http://photoz.example.com/dev/actions/add", "http://photoz.example.com/dev/actions/internalClient" ] } } ------------------- Ticket registration ------------------- The RS registers tickets with all scopes mentioned in "data" (we need all scopes in order to evaluate expression. If scopes are missing--it should fail. For example, if 3 scopes are required in the example above. If only 2 are sent, this would be an error. { "resource_id":"112210f47de98100", "resource_scopes":[ "http://photoz.example.com/dev/actions/all", "http://photoz.example.com/dev/actions/add", "http://photoz.example.com/dev/actions/internalClient" ] } ---------- Evaluation ---------- The UMA AS should iterates over each scope and decide if it has enough claims. If not, it should return the need_info error. The RPT would not return the scope expression, but the granted scopes as normal. { "active":true, "exp":1256953732, "iat":1256912345, "permissions":[ { "resource_id":"112210f47de98100", "resource_scopes":[ "http://photoz.example.com/dev/actions/add", "http://photoz.example.com/dev/actions/internalClient" ], "exp":1256953732 } ] }

1 0

A reminder: looking for extension proposals
by Eve Maler 28 Feb '18

28 Feb '18

This means we should have written extension proposals in front of us to consider. Mike specifically mentioned scope expressions. We also have a number of other extension ideas in GitHub <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>. If you would like to champion any of these ideas in this week's call, please let me know, for planning purposes. Otherwise our agenda is pretty light, just a few quick updates. I'll assess the "agenda load" by noon PT tomorrow and see if it's worth having a call. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Permissions and Obligations Expression Working Group
by Adrian Gropper 27 Feb '18

27 Feb '18

https://www.w3.org/2016/poe/wiki/Main_Page This W3C WG just showed up in my decentralized identity group. It seems to be mostly concerned with published data rather than private but there could be something there we want to consider. -- Adrian

2 1

Legal call is on for tomorrow
by Eve Maler 23 Feb '18

23 Feb '18

- *Fridays,* 8-9am PT - https://global.gotomeeting.com/join/857787301 - http://kantarainitiative.org/confluence/display/uma/Calendar We'll flesh out the list of relationships and artifacts further (something Jim and I were starting to do in email already) and take a look at Jim's candidate template work in CmA. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Apologies - there is no Legal call today
by Eve Maler 23 Feb '18

23 Feb '18

I sent out an agenda and I shouldn't have. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-02-22
by Eve Maler 22 Feb '18

22 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-02-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15>: APPROVED. Charter updating - See the emailed draft <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/lwESnNfKY…> The "Avoid (defining) cryptography" and "Permit digital signatures" design principles are sort of in tension. There's also an interaction with the "Avoid complexity" DP. What do we mean? UMA wants to be agnostic for the reason of adoptability, but there's a security consideration here so that "the fox doesn't run the henhouse". Maybe another way to state the "Permit..." DP is: "Permit (don't preclude) the use of cryptographic techniques that enable strong security and privacy properties". Most of our DPs have guided us pretty well over the years. But this last one seems like an exception, at least as stated. There are a lot of other security use cases we wouldn't want to preclude/would want to enable; Domenico mentions data integrity, for example. OTOH, originally it was meant as a kind of reciprocal to ensure that third parties could use digital signatures and encryption if they want to. Maybe we don't need the reciprocal. *MOTION:* Andi moves: Accept the charter refresh proposal. APPROVED by unanimous consent. *AI:* Eve: Get the approved charter refresh text into the online charter. *AI:* Eve: Edit the Requirements <https://kantarainitiative.org/confluence/display/uma/UMA+Requirements> document to indicate that the new charter has the most current version of our DPs and requirements. WG Legal Adviser role Do we need this role? It has potential benefits in helping us find liaison relationships, goes the theory. A "Legal Editor" role name is more in line with other roles we have on our leadership team. *MOTION:* Andi proposes for Tim Reiniger to serve in the Legal Editor role on the UMA WG Leadership Team for an annual term. APPROVED by unanimous consent. Next meeting Mike proposes that we discuss an extension for scope expressions. Eve asks that he propose a formal extension in order for us to discuss it productively. If anyone has extension ideas they'd like us to discuss, please do the same! Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Tim - Peter - Justin - Mark - Bjorn *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-02-22
by Eve Maler 22 Feb '18

22 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon UMA telecon 2018-02-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15> - Charter updating - WG Legal Adviser role - AOB MinutesRoll call Quorum was not? reached. Approve minutes Approve minutes of UMA telecon UMA telecon 2018-02-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15>: tbs Charter updating - See the emailed draft <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/lwESnNfKY…> WG Legal Adviser role tbs *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Please review the charter refresh draft
by Eve Maler 21 Feb '18

21 Feb '18

...as attached, for our meeting tomorrow. I added one phrase under the Audience section to enhance the "IoT-nature" of the charter just a tiny bit more; your input welcome. "...designers of digital services, >>including IoT device ecosystems,<<..." Agenda coming shortly. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Spec Locations
by Justin Richer 19 Feb '18

19 Feb '18

I may have missed this decision, but I can’t find the canonical HTML versions of the UMA specifications. If you go to the Kantara page, all of the links point to the PDF versions, which require you to fill out a form to download. This is problematic for me on a number of levels, not the least of which that I need a URL to reference the specification from another specification — in my case, HEART. If we do have canonical HTML versions, what are the URLs? And is it possible to get links to those put up in all the places that I looked for them (the WG homepage, the Kantara recommendations page, etc). If we do not have canonical HTML versions and only have the PDF versions, why not? And why did we make this horrible decision, and how can we reverse it? :) — Justin

4 4

Re: [WG-UMA] [KI-LC] FW: Reminder: LC BALLOT to approve a Group-Approved Draft Report as a Kantara Initiative DRAFT Report
by Eve Maler 17 Feb '18

17 Feb '18

Thank you, Megan! Please let us know when the report is published in the Reports & Recommendations area so we can point to it. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Thu, Feb 15, 2018 at 7:46 PM, Megan Cannon <mcannon(a)virtualmgmt.com> wrote: > Dear Kantara Initiative Work Group Chairs and UMA WG, > > > > I am pleased to report that the Group-Approved Draft Report has been > approved as a Kantara Initiative DRAFT Report with a simple majority of 5 > out of 8 votes. > > > > Congratulations! > > > > All the best, > > Megan > > > > > > *From:* megan(a)kantarainitiative.org [mailto:megan@kantarainitiative.org > <megan(a)kantarainitiative.org>] > *Sent:* Monday, February 12, 2018 10:24 PM > *To:* lc(a)kantarainitiative.org > *Cc:* staff(a)kantarainitiative.org; marketing(a)kantarainitiative.org > *Subject:* Reminder: LC BALLOT to approve a Group-Approved Draft Report > as a Kantara Initiative DRAFT Report > > > > > > Dear Kantara Initiative Work Group Chairs, > > > This email initiates a Leadership Council eBallot to approve a > Group-Approved Draft Report as a Kantara Initiative DRAFT Report. > > > > Motion: To certify the Group-Approved Draft Report “A Proposed Licensing > Model for User-Managed Access v. 1.0 2018-02-01” as meeting the Kantara > Initiative document publication requirements and to approve as a Kantara > Initiative DRAFT Report. > > > > Please follow this link to complete the eBallot > <https://www.surveymonkey.com/r/CT3WM6F>. > > > > Document: A Proposed Licensing Model for User-Managed Access > > Version: 1.0 > > Document Date: 2018-02-01 > > Document Attached > > > > WG wiki page: http://tinyurl.com/umawg > > WG Charter: https://kantarainitiative.org/confluence/display/uma/Charter > > > > Ballot Opens: 2018-02-07 > > Ballot Closes: 2018-02-14 > > > > Voting Rules: A simple majority of Voting members of the LC is required > > > > Ballot Information: Article 8 of the Kantara Initiative Operating > Procedures v2 require the Leadership Council to certify that the WG Draft > Report has met the following document publication requirements: > -- The Draft is within the scope of the WG Charter > > > > Eligible voters as of 2018-02-06: > > eGov > > Federation Interoperability > > Identity Assurance > > Identity Relationship Management > > Open Trust Taxonomy for OAuth2 > > User-Managed Access > > User-Managed Access Dev > > Consent and Information Sharing > > > > > > Megan Cannon | Senior Program Manager | Kantara Initiative > > D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 > <(781)%20258-5523> > > megan(a)kantarainitiative.org > > www.kantarainitiative.org > > 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA > > [image: Kantara-Logo] > > > > > > > > > > _______________________________________________ > LC mailing list > LC(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/lc > >

1 0