February 2019 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecom 2019-02-28
by Eve Maler 28 Feb '19

28 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-28 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-02-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21> MOTION: Andi moves to approve minutes of UMA telecon 2019-02-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21>: APPROVED by unanimous consent. IETF presentation prep - Eve to send around a draft The OAuth WG has biweekly "virtual office hours" and Eve joined the last such meeting this week. She presented a bit about UMA2 by reviewing the Introductions of the two specs. The two OAuth sessions are going to be <https://datatracker.ietf.org/meeting/104/agenda/> on the Monday afternoon and Thursday morning (this could change). We're hoping for a Monday presentation time. Maciej, Pedro, now Neil Madden, and possibly Andi are currently planning to go (this also could change). We discussed and worked on the emailed slide deck draft. Let's plan to review in email and Skype chat. We have no meeting next week (Mar 7) due to RSA, but we have two more chances to meet before IETF 104. Interop testing and Identiverse Andi and Eve will meet, hopefully next Sunday morning, to discuss putting together an Identiverse "showing off the results of UMA interop testing" session. Gluu has shipped its Gateway and we could potentially use that for a "standardized" RS component in order to test AS functionality. There seems to be interest in sufficient quarters. Most implementations don't support interactive claims gathering so we could just test pushed claims for now. High assurance of the RO to the RqP - If time and Peter is available Deferred. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Sal 4. Andi 5. Eve 6. Mike Non-voting participants: - George - Alec - Scott - Nancy - Thomas - Bjorn Regrets: - Cigdem - Tim - Lisa *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

IETF 104 slide draft to look at today
by Eve Maler 28 Feb '19

28 Feb '19

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-02-28
by Eve Maler 27 Feb '19

27 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-28 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-02-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21> - IETF presentation prep - Eve to send around a draft - High assurance of the RO to the RqP - If time and Peter is available - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

To decide by Thursday: Identiverse interop slot?
by Eve Maler 26 Feb '19

26 Feb '19

Andi had kindly held out to us an opportunity to run some kind of interop session at Identiverse this year. The time to decide is upon us. The WG most recently discussed the matter in September; notes, and a link to the old UMA1 wiki area for holding "full matrix" testing results, are here: https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-20 If what we manage by June is similar self-organized testing, we could adapt the wiki to show those results. Or if we get more formal, we could show that. Can we please discuss in this thread and decide by Thursday so that Andi can get on with his agenda scheduling? Thanks! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

New Identos entry on the Implementations page!
by Eve Maler 22 Feb '19

22 Feb '19

Thanks to Alec for updating the page, and congrats! https://kantarainitiative.org/confluence/display/uma/UMA+Implementations#UM… *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

The UMA2 Internet-Drafts have been submitted to IETF
by Eve Maler 22 Feb '19

22 Feb '19

https://mailarchive.ietf.org/arch/msg/oauth/r1mFPzQaXy322wSR3my5i1uCdXQ *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 4

UMA 2019-Feb-21 call
by Alec Laws 21 Feb '19

21 Feb '19

Hi all, my connection let me listen but not speak this morning :) Our view of UMA at IDENTOS is very similar to Adrian. If RSs serve a consistent/standards API (ie a FHIR profile) the client can easily consume a resource from any RS. We are advocating for UMA to healthcare entities in Canada because of the ecosystem & privacy benefits over plain Oauth 2.0/OIDC. Although RS's in Healthcare may not accept any AS (due to compliance/regulation/etc), UMA still allows many AS to define trusted ecosystems, and allow the RO to protect resources with any of them. Another major ecosystem benefit is the Clients loose coupling between the AS or RS (or both).The AS-RS must have a pre-existing relationship in most models(is this true? only after resource registration?) In our implementation the client has a few possible positions: 1. no previous knowledge of a specific AS or RS. Normal UMA. The RqP tells the client about a specific resource/RS. The RS pushes the client to the AS 2. knowledge of a specific RS. Normal UMA. The RS pushes the client to the AS 3. knowledge of a specific AS. This differs from core UMA and aligns closer to the resource indicators(?). The client requests a general resource from the AS, and the RqP binds to a specific RS during claims-gathering. The client must register with an AS for a 'resource type', and the AS must approve the scope. The client has no preference of RS/resource as long as they know the RqP is authorized access. This case also requires the AS to inform the client of the RS (we struggled with this an eventually just added a field to the token response.. bad) Regarding George's comment: "When a client uses an RPT to request a different resource, the AS should reject the RPT" Believe the AS may accept the RPT if it's under the same PAT. In the end, the RS must make the evaluation of the RPT's permissions against the requested resource Cheers, Alec Laws alec(a)identos.ca

2 1

Draft minutes of UMA telecon 2019-02-21
by Eve Maler 21 Feb '19

21 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-01-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-17> , 2019-02-07 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-07> APPROVED by acclamation. IETF contribution status and presentation prep - Commonalities/touchpoints between drafts (e.g. oauth-distributed, resource-indicators...)? - Ideas based on newer community concepts (sender-constrained...)? - Grant model concept (discussed here <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> )? The contributions have been made. Some implementers have been indicating enthusiasm about supporting in-person. Maciej and Eve are looking into in-person involvement. Historical topics we should touch on: - The history/background of UMA1 (submitted to IETF and expired) - Dynamic client registration (submitted and influenced OAuth/OIDC) - The "design principle" of sedimenting content into OAuth (slideware exists for this, possibly in 2015) - EIC award (like the OAuth one) - Potentially privacy-protective capabilities of UMA (along with the business model layer) Other useful things to share, in order to contrast with other current work: swimlane flows that illustrate how it solves: - Alice-to-Bob consented sharing (which otherwise OAuth doesn't do) – many are on the cusp of solving it in a nonstandardized way - Alice-to-Alice sharing with centralized management of resources (which otherwise OAuth doesn't do) – point to discussion <http://blog.petrieflom.law.harvard.edu/2019/02/19/oncs-proposed-rule-is-a-b…> of laws/regs/rules for the "multiple portals problem" and its relevance to contexts of "open APIs" - Proactive, reactive, and silent Alice (data subject)-to-whoever and enterprise (non-human)-to-whoever sharing in a (relatively) compact single grant Will oauth-distributed <https://datatracker.ietf.org/doc/draft-ietf-oauth-distributed/?include_text…> get taken forward? Dick has left Amazon and the use cases for this spec came from there. The draft has an AS discovery element and there was some list discussion about possibly leveraging UMA's existing mechanism. We could make a brief mention and point out how we do it. (Eve's presentation on UMA to the OAuth WG some months ago included this.) Cigdem also points out that AS discovery is supported in the ACE framework as well in IETF (ACE Core). It seems that AS discovery is popping up in several places. There are a few implementations. What about the divergence in concepts between UMA resources that get registered and resource-indicators <https://datatracker.ietf.org/doc/draft-ietf-oauth-resource-indicators/?incl…>? Our RPT is pretty specific in what it contains, while this other draft just audience-binds tokens and forces downscoping and lets the AS do the mapping. Also, since UMA is client-to-RS-first and gets a permission ticket, this makes the purposes different as well; UMA is more capable in limiting the audience already. *AI:* George: Help with the resource-indicators section of the preso. We should also include the implementation status. Meeting logistics We will meet next week (*Thu Feb 28*). No meeting the following week (*Thu Mar 7*) due to the RSA conference. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Maciej 4. Eve 5. Cigdem Non-voting participants: - Alec - Colin - George - Lisa (new - welcome!) - Scott - Thomas - Nancy - Bjorn - Adrian Regrets: - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: [Soups-announce] SOUPS Paper Registration Deadline TOMORROW (February 21)
by Eve Maler 20 Feb '19

20 Feb '19

Back in the day we'd seen some submissions from UMAnitarians. Anyone considering submissions this time around? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message --------- From: SOUPS Publicity <soupspublicity(a)gmail.com> Date: Wed, Feb 20, 2019 at 1:12 PM Subject: [Soups-announce] SOUPS Paper Registration Deadline TOMORROW (February 21) To: <Soups-announce(a)mailman.srv.cs.cmu.edu> [image: SOUPS.png] The paper registration deadline for the Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019) <https://www.usenix.org/conference/soups2019> is *tomorrow (Thursday, February 21)*! Although the paper submission deadline is a week away, registration of your paper <https://www.usenix.org/conference/soups2019/call-for-papers> by tomorrow's deadline is *mandatory*. See the Call for Papers <https://www.usenix.org/conference/soups2019/call-for-papers> for submission guidelines, requirements, and other paper deadlines. *Other Upcoming Submission Deadlines for SOUPS 2019:* - Workshop, Tutorial, and Hackathon Proposals <https://www.usenix.org/conference/soups2019/call-for-workshops>: Monday, March 11, 2019 - Poster Submissions <https://www.usenix.org/conference/soups2019/call-for-posters>: Friday, May 24, 2019 - Lightning Talk Proposals <https://www.usenix.org/conference/soups2019/call-for-lightning-talks> (Early Deadline): Friday, May 24, 2019 SOUPS 2019 <https://www.usenix.org/conference/soups2019> will take place August 11-13, 2019 in Santa Clara, CA, USA and is co-located with USENIX Security '19 <https://www.usenix.org/conference/usenixsecurity19>. ___________________________ This email address is not regularly monitored. For contact information and additional details for SOUPS 2019, please visit the conference website: https://www.usenix.org/conference/soups2019 _______________________________________________ Soups-announce mailing list Soups-announce(a)mailman.srv.cs.cmu.edu https://mailman.srv.cs.cmu.edu/mailman/listinfo/soups-announce

1 0

Agenda for UMA telecon 2019-02-21
by Eve Maler 20 Feb '19

20 Feb '19

NOTE: No UMA business model work is scheduled for tomorrow. We've got some pressing topics leading up to IETF 104 to discuss. Apologies! https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-21 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-01-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-17> , 2019-02-07 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-07> - IETF contribution status and presentation prep - Commonalities/touchpoints between drafts (e.g. oauth-distributed, resource-indicators...)? - Ideas based on newer community concepts (sender-constrained...)? - Grant model concept (discussed here <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> )? - High assurance of the RO to the RqP - If time and Peter is available - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Deadline is today for OAuth Security Workshop proposals
by Eve Maler 18 Feb '19

18 Feb '19

https://sec.uni-stuttgart.de/events/osw2019 Is anyone thinking of attending? There is interest in getting an UMA tutorial there. At this point, while I’m still a “possible” on Prague, I’m very likely not making it to Stuttgart. I strongly encourage you to submit a proposal now if you’ve been thinking about it; we can help with content. Please ping me if you have questions. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Canceling this week's UMA call
by Eve Maler 13 Feb '19

13 Feb '19

I'm bearing down on getting the specs submitted today -- thanks to Thomas for the assistance. Stay tuned for links to that. Due to a heavy meeting schedule, I think it's best if I cancel tomorrow's call. (Perhaps I can use a bit of scavenged time to work on an early IETF presentation draft.) Sorry for the late notice. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-02-07
by Eve Maler 07 Feb '19

07 Feb '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-07 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-01-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-17> Deferred. UMA business model If we link from a technical artifact, such as the PAT, to a "machine-readable device" such as a license, one big question is whether there is a "MUST understand" semantic required around the thing at the end of the link. Maybe insisting on machine readability is going too far because most implementers may not be ready for that. On the other hand, having that kind of language prepared could be an accelerator. To conclude for today: We can't ask report readers/implementers to be REQUIRED to understand what's at the end of the link without first writing that machine-readable stuff – but we might want to do that work and still not REQUIRE it to be interpreted. Also, if we do this work, it would probably be considered a spec vs. a simple report. So we need clarity on which thing we're building/documenting. For example, we can use the PAT as the first key artifact that would carry a link to a relevant device; would that device be machine-readable? Adrian notes that Justin R. has recently joined the W3C VC group. *AI:* David: Follow up with Eve (and Colin?) on the PIPC progress. IETF contribution plans - Review and approve new UMA2 Internet-Drafts intended for contribution (Thomas to produce prior to call) - Plan topics and presenters for a OAuth WG presentation: - Sender-constrained RPTs? - Comments on oauth-distributed draft? Eve spoke to Hannes a couple of weeks back, and has since exchanged email with Hannes and Rifaat. She has asked for 30 minutes of presentation time for a start; we'll work out exactly how much time as they get more requests in. Peter is looking at attending Prague in person. Eve may be able to atend. We'll figure out who may be in a position to present based on in-person vs. remote attendance. Eve is going to start a rough-draft presentation we can collaboratively work on. In the umagrant I-D, Figure 1 has broken line ends. We could rewrite it so that the diagram isn't so long, and just number the steps. In addition, we could at least expand the text lines to stretch to the full 80 characters where possible, to shorten the length of the diagram. Or even maximally, we could refactor how the same information is presented, in diagram or even diagram-plus-new-text form. For starters, let's at least fix the glitch. The umafederation I-D doesn't seem to be affected. *MOTION:* Cigdem moves, Sal seconds: Approve contributing the umagrant and umafederation I-Ds, with the umagrant Figure 1 lines fixed, to the IETF. *APPROVED* by unanimous consent. High assurance of the RO to the RqP Deferred. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Sal 4. Eve 5. Cigdem Non-voting participants: - Nancy - Prabath - Thomas - Scott - George - Adrian - David - Bjorn - Colin Guests: - VP Herisse (colleague of Nancy) Regrets: - Andi - Mike *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: [OAUTH-WG] 4th OAuth Security Workshop - Registration now open!
by Eve Maler 07 Feb '19

07 Feb '19

This is the security workshop I mentioned on today's call. You can see that they reserve a block of time for tutorials. If someone is thinking of going and may want to do an UMA tutorial, please speak up. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message --------- From: Daniel Fett <danielf+oauth(a)yes.com> Date: Thu, Feb 7, 2019 at 10:03 AM Subject: [OAUTH-WG] 4th OAuth Security Workshop - Registration now open! To: oauth(a)ietf.org <oauth(a)ietf.org> All, The registration for the 4th OAuth Security Workshop (March 20-22, Stuttgart) is now open. As usual, the workshop will feature interesting talks and discussions around OAuth, OpenID Connect, and related standards and technologies. This time, we also aim to offer tutorials on the morning of the first day and an unconference-style second day. Please register at https://sec.uni-stuttgart.de/events/osw2019 - early bird pricing is available until March 5. Please also consider submitting a proposal for a session (talk/discussion/...) or tutorial until February 18 (see link above). -Daniel _______________________________________________ OAuth mailing list OAuth(a)ietf.org https://www.ietf.org/mailman/listinfo/oauth

1 0

Candidate I-Ds of UMA specs
by Eve Maler 07 Feb '19

07 Feb '19

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-02-07
by Eve Maler 06 Feb '19

06 Feb '19

Cc'ing a couple of folks to draw attention to the "IETF contribution plans" agenda item. https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-07 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-01-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-17> - UMA business model (we will have "quorum" for it in first half-hour) - IETF contribution plans - Review and approve new UMA2 Internet-Drafts intended for contribution (Thomas to produce prior to call) - Plan topics and presenters for a OAuth WG presentation: - Sender-constrained RPTs? - Comments on oauth-distributed draft? - High assurance of the RO to the RqP (discuss if Peter is available) - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0