September 2019 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2019-09-19
by Eve Maler 03 Oct '19

03 Oct '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-08-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-08-08> , 2019-09-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-05> MOTION: Approved. XYZ use cases UMA-related use cases collected last time: - *AI:* Eve: Alice-to-Alice sharing (RO-to-self) - In Justin's description <https://mailarchive.ietf.org/arch/msg/oauth/v8TdkruCzwH43FMKS598IC2Sheo> of the "multiple parties" use case (which is generally the "UMA use case"), he says "UMA extends this to allowing the Requesting Party to be the one using the client, but it generally doesn’t collapse cleanly into the cases where the RO *is* the party using the client since the claims gathering endpoint and the authorization endpoint aren’t quite the same in concept." - However, this doesn't seem right. What should happen is that RqP (that we happen to know, if we are outside the system, observing, that the policy happens to match Alice-again, is the RO) should be taken not to the authorization endpoint but to the claims interaction endpoint. We confirmed that Gluu's implementation, e.g., does it this way. If there is no policy whatsoever in place, then Alice-the-RqP's client might get, say, request_denied and Alice-the-RO might be given the opportunity to create a policy for the first time that *happens* to match herself. - *AI:* Eve: Reach out to Justin to discuss this use case. - *AI:* Eve: Proactive Alice-to-org sharing (RO-to-client developer, so to speak) - *AI:* Peter: Bob is assured to a certain level that Alice is who she says she is (strong Alice-to-AS binding or "CIBA-like") - Transactional and long-term management of sharing of preferences with service providers Eve had some one-on-one discussion with Justin about the intended design center of XYZ, transactions, and guessing what might be the impact on client ecosystems (e.g. reducing friction or adding friction). The big security impact is intended to be narrowing the scope and moving from bearer to sender-constrained tokens, and doing it in a simpler and consolidated way, hopefully easier for everyone, including clients. As we push the boundaries of what OAuth was intended to do, it makes sense to refactor. The rise of the Janrains and Gigyas back in the day was a response to OAuth complexity. Anything that sits in the middle that says "redirect to us" – a central session management service – is even simpler. What makes it complicated is making the client smart enough to know what profile to enact. Each profile (e.g., FAPI) has different security characteristics. A key part of the complexity is the number of specs and resulting amount of knowledge you need. This sounds a bit like the Active Directory PAC (privileged attribute certificates) structure history. Do we need one gigantic token that covers all the complexity as the solution? The way to punch out of this paper bag is to get really familiar with all the use cases and truly get experience with the solutions. - Semantics for transactional-level permissions (scope and/or resource) - This one looks covered by Justin's writeup. - *AI:* Cigdem: Disconnected RS when a "handle" for the RS can't be gotten right away - XYZ has a strawman for C-to-RS - ACE has a disconnected RS flow and doesn't use a permission ticket – the ACE model also has a "client AS" where the client itself might be offline - Liberty had a model where an offline IdP could give the client a delegatable token that would allow the client (using the PAOS profile – reverse SOAP...) to mint tokens in a disconnected manner – Thomas notes that these would be considered forwardable/proxyable tickets ACE for a time had a use case for an RS could be a proxy that could help reach an AS for a client if either the RS or client had difficulties getting online, but Hannes did a security analysis <http://st.fbk.eu/sites/st.fbk.eu/files/osw2018-ace.pdf> that seemed to cross that option off the list. Our model would seem to make this highly unlikely to be practical if the AS and RS were loosely coupled. If you have an entirely sender-constrained-token model such that the RS is just an SSL tunnel between the client and AS, only then would it be safe for the RS to proxy token issuance messages. But it seems the paper concludes this is just unwise at all. The last set of use cases to be documented aren't UMA conundrums at all but simply use cases UMA actually solves over and above OAuth today: - *AI:* Eve: Existing UMA use cases that are described in our Grant and FedAuthz spec introductions Next time, let's review people's use case write-ups, including Justin's existing ones. Nominations for chair and vice-chair Let's take up the actual ballot next week. Thursday meeting series Thoughts on making this a biweekly series in Q4? Some sentiment "for". Let's decide next week. Attendees As of 16 Jul 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Maciej 4. Eve 5. Cigdem Non-voting participants: - George - Vlad - Thomas - Colin Regrets: - Andi - Mike *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 3

Action items for writing use cases (deadline next Thu, no mtg tomorrow)
by Eve Maler 25 Sep '19

25 Sep '19

We discussed a set of use cases in last Thursday’s call, and a number of people agreed to put their names next to them. Let’s please target next Thursday, Oct 3, to have them written up. They need be only a paragraph at a minimum. They might turn into XYZ fodder, or possibly a GitHub issue for ourselves. I’m going to cancel tomorrow’s call. The Oct 10 call is already off the books due to my London travel (reach out if you’re in the area!). https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19 UMA-related use cases collected last time: AI: Eve: Alice-to-Alice sharing (RO-to-self) AI: Eve: Proactive Alice-to-org sharing (RO-to-client developer, so to speak) AI: Peter: Bob is assured to a certain level that Alice is who she says she is (strong Alice-to-AS binding or "CIBA-like") Transactional and long-term management of sharing of preferences with service providers [needs an owner, maybe Lisa?] AI: Cigdem: Disconnected RS when a "handle" for the RS can't be gotten right away Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Notes from 2019-09-24 UMA business-legal framework telecon
by Eve Maler 24 Sep '19

24 Sep '19

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-09-24 Attending: Eve, Cigdem, Domenico, Nancy, Tim, Vlad, Sal At the DS-RRA wrangling layer where UMA doesn't have any artifacts, there will typically be a lot of identity and access management taking place. What technical artifacts can we expect to be used there? Typically many proprietary ones, but also potentially some standardized ones, such as federation standards like SAML and OIDC, maybe provisioning standards like SCIM, maybe auditing-friendly standards like consent receipts, etc. We have already mentioned consent receipts in our "devices and artifacts" capture. The topic discussed last time was: Could/How could UMA be used to achieve user control of the initial user relationship with a service provider? The answer in today's world is that UMA was designed with today's imperfect situation in mind, which presumes opt-in cookie consent, opt-in terms and conditions, opt-in OAuth app connections, and opt-in AS-RS connections for UMA, which are all sub-optimal. However, the Lisa/Eve paper proposes an architectural way forward for fixing these broken patterns, which is to use the "Open Banking trick" for intent registration. The trick uses the nexus of the Open Banking APIs and OIDC request objects to allow transaction authorization of payment of a specific amount of money for a single payment, vs. authorization of an OAuth scope for an indefinite period. Theoretically, this "intent registration" ahead of time by a user at a client app (TPP) could be used to allow transactional (one-time) "intent registration" of user-centric terms and conditions, not just payment of money. Flows still to be worked out for each use case of user/service interaction, of course! Cigdem had commented about moving up the Legal Parties discussion in the document and we agree. She will do some "invasive" editing of the doc. Eve can't make Oct 8th or Oct 15th. It sounds like we have critical mass of people to join on the 15th so Eve will ensure someone can open the bridge on that day. In the meantime Cigdem will edit the doc. We haven't discussed Nancy's latest submitted set of use cases, including healthcare and banking. One of Eve's goals is to include as many submitted real-life use cases as possible. We've already got quite a few. She's started a couple of templates for some more in the "mapping" slide deck. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business-legal telecon tomorrow
by Eve Maler 24 Sep '19

24 Sep '19

We meet *8am PT* on Tuesday at https://global.gotomeeting.com/join/857787301 -- see our calendar here <https://kantarainitiative.org/confluence/display/uma/Calendar>. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>, our "business model: mapping graphics" deck is here <https://drive.google.com/open?id=1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BBjBB7xG…>, our full/older Legal Role Definitions deck is here <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>, and our fledgling draft doc is here <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…>. Trying to access these links will send me a notification to share the docs with you with your preferred ID, if I haven't already given you access. Agenda item: - Document the full value and structure of a final WG draft report/spec deliverable. (I think Tim was going to share notes from last week's call that I couldn't join.) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2019-09-19
by Eve Maler 18 Sep '19

18 Sep '19

Here is an informal agenda for tomorrow’s telecon at 6am PT: https://kantarainitiative.org/confluence/display/uma/Calendar https://global.gotomeeting.com/join/857787301 We will work on documenting the UMA-related use cases enumerated in the last meeting. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Our Legal Editor Tim Reiniger in the Information Law Journal
by Eve Maler 17 Sep '19

17 Sep '19

Check out the Autumn 2019 issue of the Information Law Journal: http://www.tshawlaw.com/images/INFORMATION_LAW_JOURNAL_-_volume_10_issue_4.… ...where Tim Reiniger writes, with Stephen Mason, on the important topic of "Human Rights, the United Nations, and Digital Technologies: Configuring Human Rights in Software Code" and makes a connection with several modern technologies you will be familiar with, including User-Managed Access. Please help get the word out! Look for a mention from the @UMAWG Twitter handle. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Re: [WG-UMA] Eve can't make tomorrow's biz-legal call
by Colin Wallis Kantara 16 Sep '19

16 Sep '19

Programs Manager Ruth will open the call for y'all. Thanks Colin On Mon, Sep 16, 2019 at 11:02 PM David J. Thelander < dthelander(a)gravelshea.com> wrote: > That makes good sense Colin. Cheers, D. > > > > > > <http://www.gravelshea.com> > *David J. Thelander* | *Special Counsel* > *Gravel and Shea* > > 76 St. Paul Street, 7th Floor | P. O. Box 369 | Burlington, VT 05401 > T: 802-658-0220 | F: 802-658-1456| M: 415-608-7418 > dthelander(a)gravelshea.com | www.gravelshea.com > Biography > <https://www.gravelshea.com/our-team/special-counsel/David-Thelander> | Download > vCard > <https://www.gravelshea.com/wp-content/uploads/David-Thelander-vCard.vcf> | > @davidthelander > > Click here to check out our “Blockchain Technology” blog > <http://vtblockchainlawblog.com> > The information contained in this transmission may contain privileged and > confidential information. It is intended only for the use of the person(s) > named above. If you are not the intended recipient, you are hereby notified > that any review, dissemination, distribution or duplication of this > communication is strictly prohibited. If you are not the intended > recipient, please contact the sender by reply e-mail and destroy all copies > of the original message. > > > On Sep 16, 2019, at 2:58 PM, Colin Wallis Kantara < > colin(a)kantarainitiative.org> wrote: > > Thanks Tim and David > > It would be preferable to keep the same cadence on the dial in details to > save potential confusion. > > I hope to be able confirm Staff to open the call by time you awaken in the > morning. > > Kind regards > Colin > > > On Mon, Sep 16, 2019 at 10:22 PM David J. Thelander < > dthelander(a)gravelshea.com> wrote: > >> I can make it and can ask my EA to circulate a dial in if that helps. >> >> Sent from my iPhone >> >> >> >> >> <https://www.gravelshea.com/wp-content/uploads/GS-Logo-for-Signature-Block.j…> >> <http://www.gravelshea.com> David J. Thelander | Special Counsel >> Gravel and Shea >> >> 76 St. Paul Street, 7th Floor | P. O. Box 369 | Burlington, VT 05401 >> T: 802-658-0220 | F: 802-658-1456| M: 415-608-7418 >> dthelander(a)gravelshea.com | www.gravelshea.com >> Biography >> <https://www.gravelshea.com/our-team/special-counsel/David-Thelander> | Download >> vCard >> <https://www.gravelshea.com/wp-content/uploads/David-Thelander-vCard.vcf> | >> @davidthelander >> Click here to check out our “Blockchain Technology” blog >> <http://vtblockchainlawblog.com> >> The information contained in this transmission may contain privileged and >> confidential information. It is intended only for the use of the person(s) >> named above. If you are not the intended recipient, you are hereby notified >> that any review, dissemination, distribution or duplication of this >> communication is strictly prohibited. If you are not the intended >> recipient, please contact the sender by reply e-mail and destroy all copies >> of the original message. >> >> >> On Sep 16, 2019, at 2:06 PM, Tim Reiniger <tsreiniger(a)gmail.com> wrote: >> >> I’ll be happy to help with the meeting if Colin finds someone to start >> it! Tim >> >> Sent from my iPhone >> >> On Sep 16, 2019, at 4:00 PM, Colin Wallis Kantara < >> colin(a)kantarainitiative.org> wrote: >> >> Thanks for the heads-up Eve. >> No chance for me to open it on this occasion. >> Sorry folks, but I have a Board Officers meeting right across that time. >> I can ask another Staff member to open it if folks want to proceed with >> the call. >> Cheers >> Colin >> >> >> On Mon, Sep 16, 2019 at 5:29 PM Eve Maler <eve(a)xmlgrrl.com> wrote: >> >>> Apologies. Would others want to carry on during the slot, or should I >>> cancel? Current status is here: >>> >>> >>> https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… >>> >>> I had an action as follows: "Start a skeleton draft doc for next time." >>> (With detail: "Let's start drafting collaboratively. A GDoc is a great way >>> to start, following the (Kantara-inflected) RFC style.") Others offered to >>> help edit collaboratively. >>> >>> We already had a skeleton draft doc following more of a Report style >>> here >>> <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> and >>> it had some old title stuff in it ("business model" language), so I have >>> converted it over in minor fashion. Most of the (placeholder) content is >>> still there, but the skeleton is ready to receive text along the lines that >>> we've been documenting (voluminously) in our notes, slides, etc. Andi, Tim, >>> and Domenico were already added to this doc and I just added Nancy and >>> Cigdem. Others please let me know if you need access! >>> >>> >>> *Eve Maler *Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: >>> @xmlgrrl >>> >>> _______________________________________________ >>> WG-UMA mailing list >>> WG-UMA(a)kantarainitiative.org >>> https://kantarainitiative.org/mailman/listinfo/wg-uma >>> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> https://kantarainitiative.org/mailman/listinfo/wg-uma >> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> https://kantarainitiative.org/mailman/listinfo/wg-uma >> >> >

2 1

Re: [WG-UMA] Eve can't make tomorrow's biz-legal call
by Colin Wallis Kantara 16 Sep '19

16 Sep '19

Thanks Tim and David It would be preferable to keep the same cadence on the dial in details to save potential confusion. I hope to be able confirm Staff to open the call by time you awaken in the morning. Kind regards Colin On Mon, Sep 16, 2019 at 10:22 PM David J. Thelander < dthelander(a)gravelshea.com> wrote: > I can make it and can ask my EA to circulate a dial in if that helps. > > Sent from my iPhone > > > > > <https://www.gravelshea.com/wp-content/uploads/GS-Logo-for-Signature-Block.j…> > <http://www.gravelshea.com> David J. Thelander | Special Counsel > Gravel and Shea > > 76 St. Paul Street, 7th Floor | P. O. Box 369 | Burlington, VT 05401 > T: 802-658-0220 | F: 802-658-1456| M: 415-608-7418 > dthelander(a)gravelshea.com | www.gravelshea.com > Biography > <https://www.gravelshea.com/our-team/special-counsel/David-Thelander> | Download > vCard > <https://www.gravelshea.com/wp-content/uploads/David-Thelander-vCard.vcf> | > @davidthelander > Click here to check out our “Blockchain Technology” blog > <http://vtblockchainlawblog.com> > The information contained in this transmission may contain privileged and > confidential information. It is intended only for the use of the person(s) > named above. If you are not the intended recipient, you are hereby notified > that any review, dissemination, distribution or duplication of this > communication is strictly prohibited. If you are not the intended > recipient, please contact the sender by reply e-mail and destroy all copies > of the original message. > > > On Sep 16, 2019, at 2:06 PM, Tim Reiniger <tsreiniger(a)gmail.com> wrote: > > I’ll be happy to help with the meeting if Colin finds someone to start it! > Tim > > Sent from my iPhone > > On Sep 16, 2019, at 4:00 PM, Colin Wallis Kantara < > colin(a)kantarainitiative.org> wrote: > > Thanks for the heads-up Eve. > No chance for me to open it on this occasion. > Sorry folks, but I have a Board Officers meeting right across that time. > I can ask another Staff member to open it if folks want to proceed with > the call. > Cheers > Colin > > > On Mon, Sep 16, 2019 at 5:29 PM Eve Maler <eve(a)xmlgrrl.com> wrote: > >> Apologies. Would others want to carry on during the slot, or should I >> cancel? Current status is here: >> >> >> https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… >> >> I had an action as follows: "Start a skeleton draft doc for next time." >> (With detail: "Let's start drafting collaboratively. A GDoc is a great way >> to start, following the (Kantara-inflected) RFC style.") Others offered to >> help edit collaboratively. >> >> We already had a skeleton draft doc following more of a Report style here >> <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> and >> it had some old title stuff in it ("business model" language), so I have >> converted it over in minor fashion. Most of the (placeholder) content is >> still there, but the skeleton is ready to receive text along the lines that >> we've been documenting (voluminously) in our notes, slides, etc. Andi, Tim, >> and Domenico were already added to this doc and I just added Nancy and >> Cigdem. Others please let me know if you need access! >> >> >> *Eve Maler *Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: >> @xmlgrrl >> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> https://kantarainitiative.org/mailman/listinfo/wg-uma >> > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma > >

1 0

Eve can't make tomorrow's biz-legal call
by Eve Maler 16 Sep '19

16 Sep '19

Apologies. Would others want to carry on during the slot, or should I cancel? Current status is here: https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… I had an action as follows: "Start a skeleton draft doc for next time." (With detail: "Let's start drafting collaboratively. A GDoc is a great way to start, following the (Kantara-inflected) RFC style.") Others offered to help edit collaboratively. We already had a skeleton draft doc following more of a Report style here <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> and it had some old title stuff in it ("business model" language), so I have converted it over in minor fashion. Most of the (placeholder) content is still there, but the skeleton is ready to receive text along the lines that we've been documenting (voluminously) in our notes, slides, etc. Andi, Tim, and Domenico were already added to this doc and I just added Nancy and Cigdem. Others please let me know if you need access! *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 2

Let's cancel our WG call tomorrow
by Eve Maler 11 Sep '19

11 Sep '19

Thomas and I will shortly (over the weekend) be brushing up those 2.0.1 items we spoke about last week, and I've got an unrelated deadline looming, so it seems to make sense to postpone our next WG Thursday call till Sep 19. Thanks. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0