February 2019 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecom 2019-02-28
by Eve Maler 28 Feb '19

28 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-28 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-02-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21> MOTION: Andi moves to approve minutes of UMA telecon 2019-02-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21>: APPROVED by unanimous consent. IETF presentation prep - Eve to send around a draft The OAuth WG has biweekly "virtual office hours" and Eve joined the last such meeting this week. She presented a bit about UMA2 by reviewing the Introductions of the two specs. The two OAuth sessions are going to be <https://datatracker.ietf.org/meeting/104/agenda/> on the Monday afternoon and Thursday morning (this could change). We're hoping for a Monday presentation time. Maciej, Pedro, now Neil Madden, and possibly Andi are currently planning to go (this also could change). We discussed and worked on the emailed slide deck draft. Let's plan to review in email and Skype chat. We have no meeting next week (Mar 7) due to RSA, but we have two more chances to meet before IETF 104. Interop testing and Identiverse Andi and Eve will meet, hopefully next Sunday morning, to discuss putting together an Identiverse "showing off the results of UMA interop testing" session. Gluu has shipped its Gateway and we could potentially use that for a "standardized" RS component in order to test AS functionality. There seems to be interest in sufficient quarters. Most implementations don't support interactive claims gathering so we could just test pushed claims for now. High assurance of the RO to the RqP - If time and Peter is available Deferred. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Sal 4. Andi 5. Eve 6. Mike Non-voting participants: - George - Alec - Scott - Nancy - Thomas - Bjorn Regrets: - Cigdem - Tim - Lisa *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

IETF 104 slide draft to look at today
by Eve Maler 28 Feb '19

28 Feb '19

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-02-28
by Eve Maler 27 Feb '19

27 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-28 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-02-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21> - IETF presentation prep - Eve to send around a draft - High assurance of the RO to the RqP - If time and Peter is available - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

To decide by Thursday: Identiverse interop slot?
by Eve Maler 26 Feb '19

26 Feb '19

Andi had kindly held out to us an opportunity to run some kind of interop session at Identiverse this year. The time to decide is upon us. The WG most recently discussed the matter in September; notes, and a link to the old UMA1 wiki area for holding "full matrix" testing results, are here: https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-20 If what we manage by June is similar self-organized testing, we could adapt the wiki to show those results. Or if we get more formal, we could show that. Can we please discuss in this thread and decide by Thursday so that Andi can get on with his agenda scheduling? Thanks! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

New Identos entry on the Implementations page!
by Eve Maler 22 Feb '19

22 Feb '19

Thanks to Alec for updating the page, and congrats! https://kantarainitiative.org/confluence/display/uma/UMA+Implementations#UM… *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

The UMA2 Internet-Drafts have been submitted to IETF
by Eve Maler 22 Feb '19

22 Feb '19

https://mailarchive.ietf.org/arch/msg/oauth/r1mFPzQaXy322wSR3my5i1uCdXQ *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 4

UMA 2019-Feb-21 call
by Alec Laws 21 Feb '19

21 Feb '19

Hi all, my connection let me listen but not speak this morning :) Our view of UMA at IDENTOS is very similar to Adrian. If RSs serve a consistent/standards API (ie a FHIR profile) the client can easily consume a resource from any RS. We are advocating for UMA to healthcare entities in Canada because of the ecosystem & privacy benefits over plain Oauth 2.0/OIDC. Although RS's in Healthcare may not accept any AS (due to compliance/regulation/etc), UMA still allows many AS to define trusted ecosystems, and allow the RO to protect resources with any of them. Another major ecosystem benefit is the Clients loose coupling between the AS or RS (or both).The AS-RS must have a pre-existing relationship in most models(is this true? only after resource registration?) In our implementation the client has a few possible positions: 1. no previous knowledge of a specific AS or RS. Normal UMA. The RqP tells the client about a specific resource/RS. The RS pushes the client to the AS 2. knowledge of a specific RS. Normal UMA. The RS pushes the client to the AS 3. knowledge of a specific AS. This differs from core UMA and aligns closer to the resource indicators(?). The client requests a general resource from the AS, and the RqP binds to a specific RS during claims-gathering. The client must register with an AS for a 'resource type', and the AS must approve the scope. The client has no preference of RS/resource as long as they know the RqP is authorized access. This case also requires the AS to inform the client of the RS (we struggled with this an eventually just added a field to the token response.. bad) Regarding George's comment: "When a client uses an RPT to request a different resource, the AS should reject the RPT" Believe the AS may accept the RPT if it's under the same PAT. In the end, the RS must make the evaluation of the RPT's permissions against the requested resource Cheers, Alec Laws alec(a)identos.ca

2 1

Draft minutes of UMA telecon 2019-02-21
by Eve Maler 21 Feb '19

21 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-01-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-17> , 2019-02-07 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-07> APPROVED by acclamation. IETF contribution status and presentation prep - Commonalities/touchpoints between drafts (e.g. oauth-distributed, resource-indicators...)? - Ideas based on newer community concepts (sender-constrained...)? - Grant model concept (discussed here <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> )? The contributions have been made. Some implementers have been indicating enthusiasm about supporting in-person. Maciej and Eve are looking into in-person involvement. Historical topics we should touch on: - The history/background of UMA1 (submitted to IETF and expired) - Dynamic client registration (submitted and influenced OAuth/OIDC) - The "design principle" of sedimenting content into OAuth (slideware exists for this, possibly in 2015) - EIC award (like the OAuth one) - Potentially privacy-protective capabilities of UMA (along with the business model layer) Other useful things to share, in order to contrast with other current work: swimlane flows that illustrate how it solves: - Alice-to-Bob consented sharing (which otherwise OAuth doesn't do) – many are on the cusp of solving it in a nonstandardized way - Alice-to-Alice sharing with centralized management of resources (which otherwise OAuth doesn't do) – point to discussion <http://blog.petrieflom.law.harvard.edu/2019/02/19/oncs-proposed-rule-is-a-b…> of laws/regs/rules for the "multiple portals problem" and its relevance to contexts of "open APIs" - Proactive, reactive, and silent Alice (data subject)-to-whoever and enterprise (non-human)-to-whoever sharing in a (relatively) compact single grant Will oauth-distributed <https://datatracker.ietf.org/doc/draft-ietf-oauth-distributed/?include_text…> get taken forward? Dick has left Amazon and the use cases for this spec came from there. The draft has an AS discovery element and there was some list discussion about possibly leveraging UMA's existing mechanism. We could make a brief mention and point out how we do it. (Eve's presentation on UMA to the OAuth WG some months ago included this.) Cigdem also points out that AS discovery is supported in the ACE framework as well in IETF (ACE Core). It seems that AS discovery is popping up in several places. There are a few implementations. What about the divergence in concepts between UMA resources that get registered and resource-indicators <https://datatracker.ietf.org/doc/draft-ietf-oauth-resource-indicators/?incl…>? Our RPT is pretty specific in what it contains, while this other draft just audience-binds tokens and forces downscoping and lets the AS do the mapping. Also, since UMA is client-to-RS-first and gets a permission ticket, this makes the purposes different as well; UMA is more capable in limiting the audience already. *AI:* George: Help with the resource-indicators section of the preso. We should also include the implementation status. Meeting logistics We will meet next week (*Thu Feb 28*). No meeting the following week (*Thu Mar 7*) due to the RSA conference. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Maciej 4. Eve 5. Cigdem Non-voting participants: - Alec - Colin - George - Lisa (new - welcome!) - Scott - Thomas - Nancy - Bjorn - Adrian Regrets: - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: [Soups-announce] SOUPS Paper Registration Deadline TOMORROW (February 21)
by Eve Maler 20 Feb '19

20 Feb '19

Back in the day we'd seen some submissions from UMAnitarians. Anyone considering submissions this time around? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message --------- From: SOUPS Publicity <soupspublicity(a)gmail.com> Date: Wed, Feb 20, 2019 at 1:12 PM Subject: [Soups-announce] SOUPS Paper Registration Deadline TOMORROW (February 21) To: <Soups-announce(a)mailman.srv.cs.cmu.edu> [image: SOUPS.png] The paper registration deadline for the Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019) <https://www.usenix.org/conference/soups2019> is *tomorrow (Thursday, February 21)*! Although the paper submission deadline is a week away, registration of your paper <https://www.usenix.org/conference/soups2019/call-for-papers> by tomorrow's deadline is *mandatory*. See the Call for Papers <https://www.usenix.org/conference/soups2019/call-for-papers> for submission guidelines, requirements, and other paper deadlines. *Other Upcoming Submission Deadlines for SOUPS 2019:* - Workshop, Tutorial, and Hackathon Proposals <https://www.usenix.org/conference/soups2019/call-for-workshops>: Monday, March 11, 2019 - Poster Submissions <https://www.usenix.org/conference/soups2019/call-for-posters>: Friday, May 24, 2019 - Lightning Talk Proposals <https://www.usenix.org/conference/soups2019/call-for-lightning-talks> (Early Deadline): Friday, May 24, 2019 SOUPS 2019 <https://www.usenix.org/conference/soups2019> will take place August 11-13, 2019 in Santa Clara, CA, USA and is co-located with USENIX Security '19 <https://www.usenix.org/conference/usenixsecurity19>. ___________________________ This email address is not regularly monitored. For contact information and additional details for SOUPS 2019, please visit the conference website: https://www.usenix.org/conference/soups2019 _______________________________________________ Soups-announce mailing list Soups-announce(a)mailman.srv.cs.cmu.edu https://mailman.srv.cs.cmu.edu/mailman/listinfo/soups-announce

1 0

Agenda for UMA telecon 2019-02-21
by Eve Maler 20 Feb '19

20 Feb '19

NOTE: No UMA business model work is scheduled for tomorrow. We've got some pressing topics leading up to IETF 104 to discuss. Apologies! https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-01-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-17> , 2019-02-07 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-07> - IETF contribution status and presentation prep - Commonalities/touchpoints between drafts (e.g. oauth-distributed, resource-indicators...)? - Ideas based on newer community concepts (sender-constrained...)? - Grant model concept (discussed here <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> )? - High assurance of the RO to the RqP - If time and Peter is available - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0