- WG-UMA - mailman.kantarainitiative.org

Limitation of [ Legal ] Liability
by Adrian Gropper 13 Dec '15

13 Dec '15

I'm trying to understand the essence of an UMA Legal framework by picking a very simple but real-life use case and premise. Premise: The resource server operator (RSO) installs UMA because it limits their liability due to clients interactions. In other words, they are transferring some risk to an authorization server operator (ASO), otherwise they would just implement OAuth. For simplicity, presume: - a single resource: https://uma.rso.com/adrian/weight/readonly - terms of use: the data is only to be accessed by anyone, including rso, via the resource above - clients will present a valid SSL certificate and a token verifiable at the authorization server - this contract between RS and RO expires after one year or upon notice by either party Under these circumstances, the RSO has transferred most of the liability for interacting with a particular client to the ASO. This, I believe is the UMA Legal MVP. In a real-world use-case, the RSO may not be allowed to duck this much liability. For example, the RSO might be required by law to notify the RO that a particular Client / RqP is on an industry watchlist. In this case, the Client / RqP is providing attributes to both the AS and the RS. The RSO bears somewhat greater liability unless it can warn the RO via UMA the same way it might warn the RO via OAuth. Can the ASO bear the responsibility of warning the RO or must the RS warn the RO directly? As far as I can tell, this is the essence of UMA legal. Everything else is just an elaboration on one of the four bullet points above. This, incidentally, is the use-case I'm discussing with the US Office for Civil Rights. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

4 6

Notes from UMA legal subgroup telecon 2015-12-11
by Eve Maler 11 Dec '15

11 Dec '15

*Attending:* Steve, Andrew H, Ann, Adrian, Jim, Eve, Mark, Dazza *Agenda:* - Interest in a bit longer session this and/or next week? - Review of the list of draft deliverables to be produced - Review of Jim's candidate text and structures - Status of our budget proposal - How to take our work forward? - AOB *Proposed shape of draft deliverables:* - Model clauses for the various UMA role functions, both at a granular level and in the context of some templated agreements (think up-front "terms of service" in many cases) - Supported by all the necessary term definitions - As a sub-use case of this, templated "consent receipts" for a variety of cases when the party expecting some other party to function in an UMA role is themselves in an UMA Authorizing Party or UMA Requesting Party role - For example, instances where the Authorizing Party has created a policy for delating a right of access to a Requesting Party (there are others...) *Some technical considerations:* - A round-trip CmA format<->JSON mapping - A lightweight mechanism for technical integrity, so that the web location where an entire agreement gets saved off to contains within its URL a hash of the agreement itself *Notes:* *Logistics:* Andrew H can't stay long this week or next. Jim can stay 30min longer next week. Let's target that for next week. Mark and Adrian send regrets for next week. *Draft deliverables:* Andrew asks: Would "terms of service" include human-role demands on service-role functions? This would be VRMish thinking. Yes. It's ultimately all-way. This is important in the work he's doing. Adrian points to the PrivacyLens <http://www.privacylens.org> work that displays what part of the service you would lose if you turn off consent as a good idea. Mark discusses the "notice requirement" as part of the workflow of notice-consent. Andrew (Jim?) notes that redlining standard model clause text through CmA could be one way of showing what wouldn't apply if the user doesn't agree. Eve would like to put this topic aside because it's orthogonal, even if a good idea. *Technical considerations:* We have a lot of choices (depending on budget futures) for what sorts of comfortable LX (lawyer experience) we want to give for editing model clauses and agreements. What CmA's interface is doing right now is just a simply coded Markdown+HTML editing environment. Does it want to be a Markdown environment? A Word-to-Markdown environment? An HTML form environment? We could also be creating official JSON and even XML mappings. There's a question about whether we're supposed to also provide the actual UX for human ROs and RqPs. Eve is doubtful about our work being able to satisfy all the millions of needed presentations of the text for notice-consent workflows. Think web apps, mobile apps, IoT devices... But isn't this integrity problem -- that is, how to ensure that the text has been sourced from the approved place -- covered by the hash technique (used by Consent Receipts, we think)? We seem to have consensus that providing an LX solution (or multiple ones, as we determine later) is sufficient, as long as its technical layer includes a textual integrity solution so that broader UX solutions can leverage it in their notice-consent workflows. We started to look at "Test0 <http://www.commonaccord.org/index.php?action=edit&file=/GHx/KantaraInitiati…>", which has a few sample model clauses, and all the UMA definitions, embedded in an "access federation" agreement for all parties to which could be added all the larger (e.g. identity federation) agreement clauses and definitions. An older version that has all of the older binding obligations is "UMA/2013/2 <http://www.commonaccord.org/index.php?action=doc&file=GHx/KantaraInitiative…> ". This direction is starting to look good; however, Andrew would like to see more of an if/then structure. Dazza suggests looking at MITRE's trust framework and its Order of Precedence (text <https://github.com/mitreid-connect/trust-framework/blob/master/TrustFramewo…> and CmA <http://www.commonaccord.org/index.php?action=doc&file=GH/FutureCommerce/Sta…>). Andrew has a couple of government levels and then private-sector levels. It wouldn't be a good idea to "force" anyone trying to use our legal stacks/templates use too much of our non-UMA elements, since only the UMA stuff is really de novo. There's a lot of history and cruft out there. But since the whole CmA approach doesn't have to disturb the model clauses when reusing them in multiple contexts, we can eventually show multiple exemplars for different use cases -- e.g., for an HIE of One use case, a corporate federated authorization use case, up-front terms of service use cases, and various consent receipt use cases. And pretty much every legal document defines terms, so having a terms section would be pretty normal in most circumstances. *Our budget proposal, the legal subgroup, and 2016* We'll likely find out about our budget proposal in mid-January or so. The UMA WG would be responsible for oversight over spending that money, and this subgroup would be the specific natural place for it if we continue. Eve will propose a 2016 subgroup mission statement and timeline for next week, and get everyone's sense on that call. Andrew and Mark are supportive so far. *Actions for next week* *AI:* Jim and Eve: Revise the clause text, and create 2-3 exemplars leveraging the clauses, for consideration. *AI:* Eve: Speak to additional legal eagles and ask for their especial participation next week. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

GOTV efforts: assignments going out tomorrow
by Eve Maler 11 Dec '15

11 Dec '15

Tomorrow I will be approaching people who volunteered for the V1.0 effort (Sal, Colin, Mike, and Andi, along with myself) with assignments, and would love to have one or two more people volunteer in addition. The requirement would be for you to send short personal emails to 4-6 people and ask them to respond to the ballot with a Yes. In a handful of cases, I don't have any contact information at all for the Kantara member, so if you like to do a bit of sleuthing, or know a lot of the Kantara members, that would be a good reason to volunteer too. Thanks in advance, *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

The shape of UMA legal draft deliverables
by Eve Maler 10 Dec '15

10 Dec '15

Jim and I have been meeting frequently (Andrew and I a bit less so) and working on some homework to show y'all. Here is a description of the deliverables we're working on, which we'll be asking you to review -- and Andrew with his "business owner" hat on to review in more depth come January, if it passes muster in the group: - Model clauses for the various UMA role functions, both at a granular level and in the context of some templated agreements (think up-front "terms of service" in many cases) - Supported by all the necessary term definitions - As a sub-use case of this, templated "consent receipts" for a variety of cases when the party expecting some other party to function in an UMA role is themselves in an UMA Authorizing Party or UMA Requesting Party role - For example, instances where the Authorizing Party has created a policy for delating a right of access to a Requesting Party (there are others...) Some technical considerations of the CommonAccord (CmA) mechanism -- which we know our "first customer", Andrew, can't directly consume but will have to translate into something like MSFT Word for actual consumption -- that we would like to work on (but likely won't have ready immediately) include: - A round-trip CmA format<->JSON mapping - A lightweight mechanism for technical integrity, so that the web location where an entire agreement gets saved off to contains within its URL a hash of the agreement itself *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA legal subgroup telecon 2015-12-11 (penultimate meeting of the year!)
by Eve Maler 10 Dec '15

10 Dec '15

- *Fri Dec 11* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma /Calendar - Interest in a bit longer session this and/or next week? - Review of the list of draft deliverables to be produced (see forthcoming separate email) - Review of Jim/Eve's candidate text and structures - Status of our budget proposal - How to take our work forward? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Action requested: Getting out the vote just from among WG participants!
by Eve Maler 10 Dec '15

10 Dec '15

The following WG participants can directly help with GOTV activities by going to this link and filling out the survey (in the positive...): https://www.surveymonkey.com/r/737G5MJ *Colin* for the NZ DIA (or whoever your organization representative is, if you're not) *Allan* for ForgeRock *Ishan* for UnboundID (or whoever your company representative is, if you're not) *Sal* for himself *Andrew H* for himself *Mark L* for himself *Mike S* for himself Can you all please take this action and let me know when you have done so? Thank you! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2015-12-10
by Eve Maler 10 Dec '15

10 Dec '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-12-10 MinutesRoll call Quorum was not reached. Approve minutes Deferred Kantara All-Member Ballot is open till Dec 23 The staff is broadcasting the survey <https://www.surveymonkey.com/r/737G5MJ>, and making sure that any non-member who participates in the survey will be removed from the totals. It's great to do get-out-the-vote activities! The list of members <https://kantarainitiative.org/members/> is here. *AI:* Eve: Reach out to past and potential volunteers to contact Kantara members to ask them to vote in favor of passage. NZ case study availability Colin W has provided a version of the NZ Ministry of Education's Delegations POC closure report that can be published. Exciting stuff! Everyone is encouraged to read, discuss, and publicize the report. Adrian is currently working with the US government on delegation matters. He is looking into the question of delegation to the *agent* of a patient, in the form of the authorization server. The US feds have formed an API task force that is issuing recommendations next year (N.B.: not legal guidance). *AI:* Eve: Publish the NZ report on the Case Studies <http://kantarainitiative.org/confluence/display/uma/Case+Studies> page. Holiday greetings on the home page Thanks, Domenico! Status of budget request The board is considering all the requests as part of 2016 planning. They are considering time-sensitive ones first, and ours doesn't fall under this category. So we can expect news probably mid-January. The timeline we identified in the request would be pushed out accordingly. CIS and the UMA masterclass CIS is 6-9 June 2016 in New Orleans. The CfP is opening next week. Please pay attention and consider submitting. What were "workshops" are now "masterclasses". Eve has taken on the duty of delivering – or finding someone to deliver – an UMA masterclass. It's made of three 45-minute sections. *AI:* All: If anyone is interested to deliver the masterclass, drop Eve a note. Further discussion of IETF interest related to UMA (and I-D publishing interest?) Justin notes that the OAuth list hasn't seen any "API security/UMA/RSR" discussion since the Japan meeting. The cultural dynamic of IETF is to spend a lot of face time at meetings to see progress, and there may be a "spec penalty" in terms of incompatible changes. Mike would like to see UMA go to IETF because of IETF's larger community. Justin agrees with the size of community, but doesn't agree with moving UMA. Eve sees UMA's natural constituency more aligned with the Kantaras, OIDFs, and OIXes of the world. Is it a question of getting OAuth developers to "accept UMA"? If the current WG works, then Justin suggests: Keep it where it is! Then perhaps the only question is about the expired I-Ds. Eve asked Hannes about Justin's innovative solution to that (switch the I-Ds to information, remove the content, and replace it with links out to the current content). *AI:* Editors: Refresh the I-Ds (at least the two technical specs and not Binding Obs?) with Justin's innovative solution. Permission registration extension spec review and discussion We need to rev this up again. Kick off roadmap and charter refresh discussions Our current charter is here <http://kantarainitiative.org/confluence/display/uma/Charter>. We know that use cases of interest include: - Local token introspection (interesting for IoT and more) - Permission registration extension - Wide ecosystems and how the AAT and identity claims tie in - (Add your own in the coming weeks) Let's also pump up the UIG. *AI:* Eve: Extend the meeting calendar invitations through 2016. Attendees As of 9 Dec 2015, quorum is 8 of 14. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Søren, Sourav, Lisa, Arlene, Mike) 1. Eve 2. Andi 3. Domenico 4. Maciej 5. Mike 6. Sal Non-voting participants: - Katie - Sarah - Adrian - Justin - Joni - John - Ishan - Jin Regrets: - Arlene - James *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2015-12-10
by Eve Maler 10 Dec '15

10 Dec '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-12-10 Date and Time - *Thu Dec 10,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2015-09-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24> and UMA telecon 2015-11-05 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05> - Holiday greetings on the home page - Kantara All-Member Ballot is open till Dec 23 - GOTV activities - Status of budget request - Further discussion of IETF interest related to UMA (and I-D publishing interest?) - Permission registration extension spec review and discussion - Kick off roadmap and charter refresh discussions - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: APAC-friendly UMA sync 2015-12-10
by Eve Maler 08 Dec '15

08 Dec '15

- *Thu Dec 10* at APAC-friendly times - Voice: Skype: +99051000000481, room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-12-09): http://kantarainitiative.org/confluence/display/uma/Calendar If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Thoughts on model clauses that describes proper functions of parties serving in UMA roles
by Eve Maler 08 Dec '15

08 Dec '15

The Binding Obligations <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> draft factors out descriptions of such functions first according to the party serving in the role and then according to the party to whom those functions are “owed”. For example, Section 2.4 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor16> contains the “obligations” of the Authorization Server Operator (the party operating the software service that performs the function of the UMA authorization server); Section 2.4.1 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor17> contains an “obligation” to the Authorizing Party (the party corresponding to the UMA resource owner), Section 2.4.2 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor18> contains an “obligation” to the Resource Server Operator (an party operating a software service that performs the function of an UMA resource server), and so on. If you look in Sec 2.4.1, you’ll see text like this: “When the Authorization Server issues a PAT to the Resource Server and as long as the PAT is valid, the Authorization Server Operator gains an obligation to the Authorizing Party to adhere to the Authorizing Party's policies accurately and timely in granting permissions.” For now, we can put aside the “When…, the [party] gains” construction, and save it as an idea for an optional model clause that could come into play if some legal team or individual wants to create an audit log entry/consent receipt requirement. Also note that what is called an “obligation”, I think may want to be a “commitment” or “prohibition” or “sanction” (or one of the other two norms coming from the sociotechnical norm <http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/TIST-13-governance.pdf> work). This would be more precise, and we could define those norm terms up front. Does this give a good direction for how we could “CommonAccordionify” our work?? :-) All this said, I don’t know if the Binding Obs set of “obligations” is the right set, inadequate, overstated, or legally wrongheaded! I’m sort of hoping that if we can make a run at accordionifying it, then the legal minds can really stare at it in familiar contract form and see what they think. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 6