- WG-UMA - mailman.kantarainitiative.org

Agenda for UMA telecon 2015-07-23
by Eve Maler 21 Jul '15

21 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-23 Date and Time Thu Jul 23 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25> and read into today's minutes the notes of UMA telecon 2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01>, UMA telecon 2015-07-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09>, and UMA telecon 2015-07-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16>. Handling post-V1.0 issues Considering the proposal <https://docs.google.com/document/d/1c50top8X6Aqw3CEVeX_SD2THqO508ihs14QwLem…> on the table: can we reach consensus on an approach? Timeline and meeting schedule: e.g., extend the meeting times? can we consistently reach quorum? If time and consensus on the above: possible to take the first steps on issue nomination and selection? AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Taking a coordinated, efficient approach to handling UMA issues -- your thoughts?
by Eve Maler 21 Jul '15

21 Jul '15

As we enter the UMA post-V1.0 era, gaining implementation experience and even being asked by some parties what they should do/not do in the face of the new issues being raised (“should we wait to start implementing?” No!), I thought it would be a good idea to have a clear, documented process and timeline for handling our issue backlog. To that end, I put together a proposal, which I’ve reviewed with Maciej and Thomas so far, and which I’d now like to share with you all: https://docs.google.com/document/d/1c50top8X6Aqw3CEVeX_SD2THqO508ihs14QwLem… As discussed on the last call, there’s interest in putting our “legal” discussion track into a persistent subgroup meeting series, which will leave us free to focus on technical topics for the time being. I think we’ll need to do that to meet the relatively aggressive schedule I’m proposing — please share your thoughts in this thread. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 1

The RSA 2016 conference CfP is open
by Eve Maler 21 Jul '15

21 Jul '15

If anyone is thinking of putting in an UMA session... http://www.rsaconference.com/events/us16/speakers/call-for-speakers …can you let me know? Joni is looking to gather interest so that she can get a view at the all-of-Kantara level. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

6 6

A new idea for the APAC crew: additive meetings
by Eve Maler 20 Jul '15

20 Jul '15

The “APAC crew” and I have just been batting an idea back and forth. Instead of moving one meeting a month to a different time, which puts us at quorum risk when we can least afford it, we’re going to keep meeting solidly on Thursdays every week of the month, but ADD an APAC-friendly synchronization meeting on a BIWEEKLY schedule at a NEW even later time that accommodates even people based in Singapore. As far as I know, the only people who’d be candidates to attend such a meeting would be me, Gil, Colin, Allan, and Nat, so I’m going to schedule this as an “ad hoc” type of meeting to which only we are invited. If anyone else would be interested to attend, please send me a note and I will invite you as well. And if if you know anyone in the APAC region who has been interested to get active in the group but who has been hanging back due to time zone difficulties, I hope this solution may prove attractive enough to get them to join! Those of you who are on the calendar invites: Please expect to see some invitation shuffling. Don’t panic, I’ll sort everything out by the end of the week. By that time if something still looks funny, let me know and I’ll try to fix it. Eve p.s. Why didn’t I think of this before? Duh. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Kuppinger-Cole APAC event
by Gil Kirkpatrick 20 Jul '15

20 Jul '15

Greetings all, K+C took down the web page for their APAC Identity Summit... it is being rescheduled to Feb 10-11 2016 in Melbourne (a wonderful time to visit Melbourne BTW). So no need to pursue a panel for November. But we should keep the Feb conference in mind, I expect we will have some things to talk about. -gil

1 0

Clarification Regarding OAuth 2.0 Resource Set Registration Update Method
by Farazath Ahamed 19 Jul '15

19 Jul '15

Hi, The method described in the spec to update Resource Set descriptions[1] is supposed to return a HTTP 204 including the _id value of the successfully updated resource set description. but the HTTP Status Code Definition for 204 says, The 204 response MUST NOT include a message-body, and thus is always terminated by the first empty line after the header fields. Therefore is it correct to include a body in a 204. Is it possible to do that? Am I missing a trick here? [1] https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg.html#rfc.se… Thanks, -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

3 8

Re: [WG-UMA] [UMA-Specifications] Citation to Dynamic Client Registration should reference RFC 7591 (#174)
by Adrian Gropper 19 Jul '15

19 Jul '15

How much of RFC7591 would be different in a specification for how a resource owner registers their home-built authorization server with a protected resource? Adrian On Saturday, July 18, 2015, Eve Maler <notifications(a)github.com> wrote: > UMA Core contains a number of references to [DynClientReg], which spec is > now IETF RFC 7591. The normative reference should be updated to point to > the final document: > > https://tools.ietf.org/html/rfc7591 > > — > Reply to this email directly or view it on GitHub > <https://github.com/xmlgrrl/UMA-Specifications/issues/174>. > -- Adrian Gropper MD Ensure Health Information Privacy. Support Patient Privacy Rights. *http://patientprivacyrights.org/donate-2/* <http://patientprivacyrights.org/donate-2/>

2 1

UMA-related webinar next Tuesday
by Eve Maler 17 Jul '15

17 Jul '15

I meant to mention this on the last call. In case anyone’s interested, my colleague Markus Weber and I are doing a webinar this coming Tuesday with an update on ForgeRock’s OpenUMA implementation work. Here’s the registration link: http://go.forgerock.com/OpenUMA-Webinar-July-2015_Register-Now.html Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Notes from UMA telecon 2015-07-16
by Eve Maler 16 Jul '15

16 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16> Minutes Roll call Quorum was not reached. Minutes approval Deferred. New UMA Developer Resources WG Is this way of doing open source going to work? It seems worth a try. Mike points out his experience of writing an Apache module, which took longer than expected. Libraries might be valuable, but he points out that how-to recipes for building, e.g., smart clients might be even more valuable. Examples of how to apply the components could be valuable. "Client" means a lot things. Sorting that out would be super-helpful. And maybe that group wants to expand its charter to include, if not specs, then non-code deliverables. Maybe this WG will want to remand the UIG to that WG for completion! The implementations that exist are, Mike believes, are AS-heavy and Java-heavy. His implementation protects SCIM deployments. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. License/contract/Binding Obs next steps Adrian wants to solve the problem of making the entire system more user-centric. What are the properties of a license model vs. a contract model wrt this problem? For example, in health, resource servers tend to err on the side of security over privacy, and thus don't want to allow dynamic client registration. He's looking to provide a safe harbor to them, to allow Alice to achieve what she wants. The transference of responsibility is valuable for his ends. Adrian believes the biggest hurdle is getting the RS to sign on with the AS, not between the RO and RqP. Let's take this up next time. The license model we discussed last time could be extended with the machine-readable license language Tim brought up if we bake the language into the scope (or even resource set?) descriptions; this is an idea Dazza had a long time ago. Eve calls this a "notice model" because the act of using the scopes (exercising the license?) binds the RqP. Jon would say, rather that the RO is the licensor and has issued the license; it's the opposite of a notice model. You can have choice exercised through the issuance of multiple different licenses. Eve's attempt at a dialogue that achieves Bob's consent need not be mapped to contract; licensure could work as a model too, says Jon. The time seems to be right to start having legal subgroup meetings to come to recommendations about RO-RqP, RS-AS, and any other transactional relationships in the UMA environment. Adrian suggests inviting Jim Hazard as well. The goals might be: Jurisdictional friendliness internationally Applicability to many different vertical and horizontal use cases, including health Support of higher-level access federation trust frameworks and similar efforts Issue backlog next steps What do people think about breaking changes? Mike is okay with them. Justin feels it's important to consider the changes. He doesn't care what the version number is. MIT is only tracking a released version of the protocol, vs. drafts. We need to discuss timelines for any revision considerations, and also our plans for the Informational RFC submission process. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. Treat this as a reminder! AI: Eve: Review Marcelo Wikipedia comments and take next actions. AI: Tim: Expound on the licensing idea in email. DONE. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. Let's discuss this at the next LC call. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. PROGRESSING. There are multiple steps. He has gone through the process with OAuth and OIDC already. AI: Mike: Rework UIG section on organizations as ROs and RqPs. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 1 Jul 2015 (pre-meeting), quorum is 7 of 13. (François, Domenico, Sal, Mark, Thomas, Andi, Ishan, Robert, Maciej, Eve, Arlene, Mike, Jin) Eve Andi Arlene Thomas Robert Non-voting participants: Justin Adrian Abhi George Colin Marcelo Regrets: Domenico Guest: Jon Neiditz - intended participant - lawyer - consenting adult - leads a practice focused on privacy, consent, cybersecurity Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Possible mistake in the OAuth Resource Set Registration Spec Example
by Farazath Ahamed 15 Jul '15

15 Jul '15

Hi, I think there might be a small error in the example[1]. When creating the resource set description the HTTP PUT method is used instead of the HTTP POST method as described in the spec. I am not sure whether this has already been noticed/reported and being corrected. Please ignore if so. [1] https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg.html#resour… Thanks, -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

2 2