- WG-UMA - mailman.kantarainitiative.org

Follow-up to the UMA Legal call and FutureCommerce hackathon planning
by Adrian Gropper 20 Nov '15

20 Nov '15

The legal call today had a clear focus at the junction of CommonAccord, blockchain, and UMA. The use-case was negotiation of a Non-Disclosure Agreement between two parties using CommonAccord as a structure for the changes that each of the parties would make as they passed the drafts back and forth. Blockchain was introduced as the non-repudiation mechanism to track the intermediate and final version of the NDA contract. UMA was not central to the discussion on the legal call today but was tacked on vaguely as the means to control access to the final contract by unspecified parties. It was not clear to me who the Resource Owner would be in the use-case we discussed. For the FutureCommerce hackathon, I'm hoping to gather a team to hack a personal UMA authorization server. This server, which I'm calling HIE of One http://hieofone.org/ could be linked to the CommonAccord project we discussed today to the extent there was a Resource Owner to associate with the contract being negotiated. At this point, instead of an NDA, the contract being negotiated in HIE of One is a Release of Information policy that establishes what requesting parties and clients can access the protected resource. An NDA is, in some sense, the opposite of a release of information agreement. An NDA is often mutual and therefore does not have a clear resource owner. This may not be a problem for some applications of UMA but it doesn't seem to work well for a personal authorization server linked to a personal resource. I'm hoping we could coordinate some of the FutureCommerce hacks over the coming week. Ideally, the CommonAccord hack and the personal AS hack would complement each other around the same type of contract and we could even try to demo some interaction between them. Please let us know your thoughts and consider joining FutureCommerce http://futurecommerce.civics.com/index.html online Nov 20-22. Anyone specifically interested in working on the personal AS hack should email me and I will invite you to the GitHub project. Adrian <http://patientprivacyrights.org/donate-2/>

3 9

Notes from UMA telecon 2015-11-19
by Eve Maler 19 Nov '15

19 Nov '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-19 Minutes Roll call Quorum was not reached. Approve minutes tbs Upcoming meetings No meetings Thu/Fri next week (US Thanksgiving holiday) No meeting Thu the following week (Thu Dec 3) due to Eve absence (Adrian can run Fri Dec 4 legal subgroup call) No meetings Thu/Fri Christmas Eve/Day No meetings Thu/Fri New Year's Eve/Day Status of V1.0.1 process LC ballot to certify Draft Recommendations has passed Kantara All-Member Ballot process can begin shortly after a few "metadata edits"; complete by end of 2015 Maciej has made the required edits to the specs' metadata to ready them for All-Member Ballot. So now it's up to Oliver and Jane. Incidentally, the XSLT stylesheet now handles everything automatically rather than requiring manual tweaking. This means that other WGs could be using it too! AI: Maciej: Alert Jane Celusak that the stylesheet could be used as a tool by other WGs. Funding requests The main purpose of the UMA Dev WG is really seeding the ecosystem, not interop testing. And the interop test GUI he developed is separable. And Roland hasn't done much development since he started refactoring. Does this mean the job properly devolves to this group? On the other hand, software – especially if we want to ensure that it remains FOSS – does nicely go hand in hand with the Dev group. The UMA group is still working pretty hard on features and such, so spending time overseeing software development may overwhelm us. So maybe software should stick with software, and interop testing is a natural function of encouraging wide ecosystems as long as testing is made very easy. Resource servers are a policy enforcement point, so it's very important to know that they're getting it right. Adrian's new HIE of One project deals with this by saying "Here's a very simple implementation of an authorization server that can be given away (and used by a single individual)." The RO would have to do no setup; it's a "personal data store" kind of use case. Each of the existing open-source authorization servers is optimized for different use cases: API security vs. individuals, individual scale vs. whole consumer populations... AI: Eve: Report back to Jane that this WG won't be spending our budget allotment in 2015, and we're withdrawing the request. (She'll bring up the idea of doing a 2016 funding request through the UMA Dev WG.) IETF 94 news It appears there's now interest in RSR, or something like it, in OAuth now that they're rechartering. Would a general service metadata endpoint be a good idea in addition to registering the stuff that needs to be protected? Could the OTTO work be added to the mix? What are our thoughts on next steps? Mike advocates for moving everything (Core and RSR) to IETF. Eve advocates for being tactical and only working to explore "sedimenting" RSR into IETF right now. George is not in favor of moving Core. Maciej seconds George. Sal too – he notes that this could be a diversion. It's important to move ahead with deployments and use cases and proving the value. Mike's rationale: Adoption is what matters; Core could be very useful to enable a federation standard where UMA is the access token for identity information – then UMA would become a federated identity protocol. Mike feels that if we don't "move both", we shouldn't even "move RSR"! More to come on this subject. (See the Skype chat for more.) AI: All who are able and willing: Track IETF OAuth conversations about OAuth/UMA/API security more closely. Permission registration extension spec Deferred. Previous AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Maciej: Review and correct the Redirecting the Requesting Party to the Client After Claims Gathering section. AI: Maciej: Write up some recommendations for the RPT Refreshing section. AI: Maciej: Try to find Justin's old recommendations for the Permission Ticket Management section. Attendees As of 13 Oct 2015, quorum is 7 of 13. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Sourav, Lisa, Arlene, Mike) Eve Mike Maciej Domenico Sal Non-voting participants: Katie George James Sarah Scott Adrian Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Specs certified by LC for All-Member Ballot
by Maciej Machulak 19 Nov '15

19 Nov '15

Hi all, The UMA specs, certified by LC for All-Member Ballot, are now uploaded and can be accessed at: https://docs.kantarainitiative.org/uma/draft-uma-core-v1_0_1.html https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html As you can see, the status of both specifications changed to the following: "This Draft Recommendation was developed by the User-Managed Access Work Group and has been certified by the Leadership Council to undergo a Kantara All-Member Ballot." We should be discussing these specs on today's call. Kind regards, Maciek -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

1 0

Agenda for UMA telecon 2015-11-19
by Eve Maler 18 Nov '15

18 Nov '15

(Sorry for the delay in sending — lovely windstorm and power outage in Seattle yesterday…) http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-19 Date and Time Thu Nov 19, 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Approve minutes of UMA telecon 2015-09-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24> and UMA telecon 2015-11-05 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05> Status of V1.0.1 process LC ballot to certify Draft Recommendations has passed Kantara All-Member Ballot process can begin shortly after a few "metadata edits”; complete by end of 2015 Funding requests IETF 94 news API management <https://www.ietf.org/proceedings/94/slides/slides-94-oauth-6.pdf> interest related to UMA Permission registration extension spec review and discussion AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

FW: Authentication and Authorization for Research, and Collaboration 2: expressions of interest
by Keith Hazelton 15 Nov '15

15 Nov '15

The major authNZ initiative in EU at the moment, focusing on user-driven innovation. ________________ On 2015-11-15, 03:22, "David Groep" <davidg(a)nikhef.nl> wrote: >Dear FIM4R and parties interested in AAI for collaboration and research: > >As you are likely aware the Authentication and Authorization for Research >and Collaboration project AARC [aarc-project.eu] works towards an >integrated authentication and authorization infrastructure - built on >federated access - to enable users (using their existing credentials) to >seamlessly access e-infrastructures and support increased penetration >of federated access. Supporting actions include training and policies >and best practices harmonization. > >With this communication we would like to inform you about the plans >by the AARC Board and Project Partners to reply to the "User-driven >e-infrastructure innovation" call [1] by the EC, with a focus on >user-driven innovation and pilots on existing e-Infrastructures to >respond to user-community challenges > >You are requested to read the attached document and consider the >next steps detailed therein to help our researchers, educators and >students with an AAI that facilitates inter-federated usage >and sharing of resources. > > With kind regards, > Licia Florio, p.p. David Groep. > >[1] Please see >http://ec.europa.eu/research/participants/portal/desktop/en/opportunities/ >h2020/topics/2120-einfra-22-2016.html > >-- >David Groep > >** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group >** >** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL >**

1 0

Draft minutes of UMA Legal telecon 2015-11-13
by Adrian Gropper 13 Nov '15

13 Nov '15

Minutes Jim - GAGH (Global Alliance for Genetics and Health) - With machine readable consent group. Starting with taxonomy for access. Figure out a way of handling the specification of authorization of use of a genome. With Thomas working on a UMA / Common Accord / Blockchain hack. Scot interested in gene information sharing. Adrian also involved via a Mayo Clinic genomic determinism and data management. Steve with blockchain. Ann wants to help. Will be at FutureCommerce Hackathon. Thomas: CommonAccord for GitHub contract version tracking and specialization. The core contribution from Jim allows modularized pieces of the contract. Transacting parties A and B would each have to set up their own GitHub client and each time a party makes a change a hash is sent along with the diff that's sent to the other party and the hash is also put up on a blockchain. UMA comes in for the privacy aspects of the contract. Access control to contract via UMA to avoid having to ship the contract around. Consents expressed in CommonAccord format - points to data item - Organize the machine readable consent to drive UMA policies. CommonAccord + UMA + Blockchain is a general solution. Blockchain is advertising my signature / providing non-repudiation / for the process. Helps with escrow. SHA-1 to find data a la BitTorrent and SHA-256 are combined. May need to also conform to the Digital Signature Act using X509. Stock market analogy - stock certificates, then derivatives. Multi-channel verification of rights. What can we code to explain this? CommonAccord interacting in a GitHub like server + add the hash drop out - then add UMA and later blockchain. Patient consent or material transfer agreements. Jim demos NDA between two parties. Called Nameless. Common Accord + code to build something like a Merkle tree + post hash to blockchain as the minimum viable demo. Separate piece of this - what would be a taxonomy of access - by adding UMA - Dazza suggests the iAuth project for FutureCommerce that takes the hash of a commit in GitHub and its message digest via GitHub API (blocksign) - then make it so one of the commits are linked to OAuth2 / UMA and tied to a scope. Let's continue this discussion on 1 2 or 3 projects on the Slack channel for the next week as prep for http://futurecommerce.civics.com/index.html Please email Dazza or Mark to join the Slack channel (I don't seem to have invite power). Legal call next week will go on as scheduled and FutureCommerce starts an hour after (1PM EST). ----------- Proposed Agenda: - How can we reduce legal and business barriers to real-world UMA adoption? - What does the link between a minimal / personal UMA AS and Agency Law look like on GitHub? - FutureCommerce Hackathon at MIT and online next Friday - starts an hour after the end of our UMA Legal call http://futurecommerce.civics.com/index.html - AOB Roll call Attending Clayton Bonnell - USPS - Postal Inspection Service Steve John Jim Paul Thomas Ann Scot Sal Dazza -- Adrian Gropper MD <http://patientprivacyrights.org/donate-2/>

1 0

Reminder: UMA legal subgroup telecon 2015-11-13
by Adrian Gropper 13 Nov '15

13 Nov '15

- *Fri Nov 6* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar - How can we reduce legal and business barriers to real-world UMA adoption? - What does the link between a minimal / personal UMA AS and Agency Law look like on GitHub? - FutureCommerce Hackathon at MIT and online next Friday - starts an hour after the end of our UMA Legal call http://futurecommerce.civics.com/index.html - AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 2

This will get more people talking about HEART
by Adrian Gropper 11 Nov '15

11 Nov '15

http://geekdoctor.blogspot.com/2015/11/the-path-forward-for-meaningful-use.… Halamka is arguably the chief spokesperson for the health IT industry. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

1 0

Gluu Blog: How to centrally issue OAuth tokens for API access management
by Mike Schwartz 09 Nov '15

09 Nov '15

Umatarians, I wrote a quick blog this afternoon about using UMA for API access management: http://www.gluu.co/central-oauth2-tokens Any comments are welcome if I messed it up or missed anything crucial. - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Notes from UMA legal subgroup telecon 2015-11-06
by Eve Maler 08 Nov '15

08 Nov '15

Fri Nov 6 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Goal: start building a general "legal stack" for UMA-specific elements Learn more of Andrew H’s use case details Examine the sociotechnical norms for potentially useful concepts AOB Attending: Eve, John, Ann, Adrian, Andrew H, Jim, Jon, Mark, Nat, Sal Andrew has sketched a model for resource set registration services. So far this is very informal, so we won’t be minuting it in detail. What’s a better word/phrase for “community of interest”/CoI? Policymakers? Constituents? He’s trying to capture “reliance” relationships, and obligations/commitments. Adrian has concerns: Can we look at the simplest possible scenario and just map that? On the other hand, providing “legal resources” (akin to “developer resources”) for those who have constraints that require an UMA solution would be very valuable, because this is a real-world situation that we expect to be common. The “Open Identity Trust Framework Model <http://openidentityexchange.org/wp-content/uploads/the-open-identity-trust-…>” white paper may be useful for background on generic trust frameworks. OITF was influenced by the Liberty Alliance work, and Andrew has contributed to TF work heavily over time. Once you have the abstract model, then you can identify your specific “users” and “operators”. So can we make progress on our goal, given Andrew’s input? We could work on outputs for his “C” elements, and a lot of the “B”. Jurisdiction clauses are something everyone needs. And if we pick a business environment (university, or health, or DIACC!), we know of typical clauses they’ll need. UMA-specific stuff may affect, all of the business, legal, and technical sections (portions of the stack). Standardizing these clauses is the benefit we’re aiming to supply. Can we use the sociotechnical norms language <http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/IJCAI-15-TIST.pdf>? Eve suggests that the five norms are so clear, and clarifying, that they would be helpful for distinguishing the piece-parts of UMA flows that reflect different norms and developing model clauses for each of the B, L, and T layers that can focus on one type of norm at a time. John W thinks that there is relevance for consent receipts. Eve muses: Maybe Authorization could be for true consent receipts, and Commitment, Prohibition, Sanction, and Power could be for other types of transaction receipts? Powers could be conveyed to another party (such as durable medical power of attorney), and then there could be a flow chart after that where prohibitions and sanctions and such come into play. Next steps: Adrian is kindly running the next call. He will send out an agenda focusing on agency restatements. After her vacation, Eve will work with John and Andrew (and maybe rope in Tim as well?) on recasting whatever old Binding Obligations are still useful into norms language, and try to bucket them into B/L/T clauses for putative sections of a “stack". Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

8 8