- WG-UMA - mailman.kantarainitiative.org

Reminder: UMA business model telecon tomorrow
by Eve Maler 27 May '19

27 May '19

...at 8am PT, at this GTM: https://global.gotomeeting.com/join/857787301 <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…> <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…>Last meeting notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. I've continued to fill out a lot of basic information in the Business Model Use Cases spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>. All of the terms from the first Report are now in there. Tomorrow, let's try to achieve the following: - Capture additional use cases people have on their minds (up to some limit so we can get to the other items too) - Decide what to do about "Proxy" and "Org equivalent of a Data Subject" as legal roles - Start to figure out/capture technical "links-to" relationships that enable us to go from "code" to "prose" Please note that I'll have to *cancel* the business model meetings for *June 4* and *June 11 *due to chair travel. June 18 is still on. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-05-23
by Eve Maler 23 May '19

23 May '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23 MinutesRoll call Quorum was not reached. Approve minutes - - Approve minutes of UMA telecon <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28, 2019-04-04, 2019-04-18>2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28, 2019-04-04, 2019-04-18>2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28, 2019-04-04, 2019-04-18>2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> Deferred. IIW and EIC updates Eve gave HEART updates at both events, and did an UMA 101 session by request at IIW, which was well-attended. There were "cross-community" discussions at IIW. Here are the IIW 28 notes <https://iiw.idcommons.net/IIW_28_Session_Notes>. Adrian has sent some thoughts to our list. How could you accept VCs at the claims gathering (interaction) endpoint? Adrian is involved in 3-4 other projects that are trying to figure out machine-to-machine interactions in the "agent" sense. UMA and the SSI work seem complementary. George wonders if so – conceptually perhaps, but protocol-wise, perhaps no. Matt Hailstone/Nathan George/Eve had a session at IIW <https://iiw.idcommons.net/XACML_/_ABAC_/_UML_2.0_and_SSI_Policies> discussing the "policies" and "permissions" topic. Adrian observes that UMA invented an AS and SSI invented a wallet and they're 70% like each other – but George pushes back on the characterization. UMA's design center has enabled it to apply to "today's web" and the API economy directly. And it has already been applied to uPort. Does it make sense to document (profile) how it works with specific SSI-type technologies in the places where it has touchpoints with identity, including a resource owner's identity interactions with an RS, and with an AS, and an AS's claims collection methods for the requesting side? Eve's conversation with a rep for HL Indy yesterday revealed some clear deltas between UMA's capabilities/deficits and those of an Indy wallet. UMA doesn't do cryptographic proofs and proof requests around the permissioning model, but it enables asynchronous sharing (proactive and access approval options), sharing with autonomic third parties using clients (requesting parties), sharing of access to arbitrary resources behind APIs (such as control of devices, inserting data in, large volatile data sets, etc.)... A DIF identity hub is apparently a cloud agent. EIC had a lot of AI sessions this time. It's being used to detect fraud (when you're "not you"). Context is important to detecting and reducing what the user has to consent to. This perhaps connects to the "risk-based authentication" type of topic that comes up when we've discussed the Keycloak extension for fine-grained authorization. The RS passes along claims at permission request time to the AS, after having had the client attempt access to the resource. The "claims" the RS passes along could consist of observations made about the client at that time, such as apparent IP address, etc. The AS could use those as part of its later authorization assessment, e.g, comparing them to the client that shows up later at the token endpoint. That's a good chance to use "context". IETF 105 and OAuth.XYZ/transactional authorization discussion IETF 105 is coming up July 20-26 in Montreal. <https://www.ietf.org/how/meetings/105/> Eve is planning to go, and is planning to do an "UMA Q&A" with the OAuth WG there. Who else is attending? No one else currently on the call. Justin has submitted an I-D for his "XYZ" proposal <https://oauth.xyz/>, called "transactional authorization". He's been coordinating with Torsten Lodderstedt on it. This I-D is influenced by a lot of UMA ideas and other ideas; for example, the "transaction handle" is basically a permission ticket. Given that this new I-D has a lot of promise and we think there's evidence of appetite in that community to work on it (we'll know a lot more by the end of July), maybe we should change our recommendation about the UMA2 contributions to say that they should be published as-is as individual I-Ds. The upside: Stability for UMA2 with something of an IETF imprimatur. The downside: It wouldn't have gotten the total IETF workup from that community. Business model update There's a new spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> reflecting our use cases work. Upcoming meetings We're meeting next week. We're not meeting Jun 6. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Eve 3. Cigdem Non-voting participants: - Adrian - George - Nancy - Colin Regrets: - Andi *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-05-23
by Eve Maler 22 May '19

22 May '19

Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> , 2019-04-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18> - IIW and EIC updates - IETF 105 and OAuth.XYZ/transactional authorization discussion - Business model update - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Business model telecon notes for 2019-05-21
by Eve Maler 21 May '19

21 May '19

(To get access to the spreadsheet linked below, please request access individually, and I will add you.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-05-21 Attending: Eve, Nancy, Lisa, Tim, Cigdem, Adrian, Domenico, Mark Our goals in filling out the new use cases spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> are: - Make crystal-clear the legal-technical mappings - Link to definitive definitions (and figure out which concepts need new terms and better definitions, and figure out if we need to refine our definitions in a new report vs. the first report) - E.g., define a new Proxy/Agent/whatever term? Define a term for an organization that is the equivalent of a "data subject" (the information is "about it") only it's not an individual? - Get people to put their hands up in identifying which use cases they care about, and add new use cases - Figure out how to incorporate all the necessary complex information into licenses, such as covering Requesting Agents and Requesting Parties as required (Dr. Bob and the institution he works with, e.g.) Our hope is that there are some kinds of licensing that you can boilerplate, a la Creative Commons. That has been the premise behind our looking at CommonAccord.org, which literally has a GitHub system for reuse of legal text (and the Ricardian system in general: prose, code, parameters). Also, jurisdictions will suggest some similarities. (See our very early UX work <https://kantarainitiative.org/confluence/display/uma/UMA+User+Experience>.) But there is extreme variability that can arise based on things like the types of resources and scopes; for example, "getting some data" is different from "controlling a smart camera". Eve's "new permission taxonomy" lists five possible axes of control: Scope, Grantee, Environment, Usage, and Downstream. UMA as a technical layer enables three of them. Legal licensing is needed for Usage (e.g., preventing usage for marketing purposes) and Downstream (e.g., specifically, preventing sharing with a further requesting party that doesn't share the same AS as the initial requesting party). Adrian suggests following up to learn about the work of this group <https://identity.foundation/working-groups/storage-compute.html>. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 4

Reminder: UMA business model telecon tomorrow (Tue May 21)
by Eve Maler 20 May '19

20 May '19

At 8am PT, at our usual GTM: https://global.gotomeeting.com/join/857787301 In our call, I would like to propose a framework, or maybe it's a set of building blocks, for cataloguing different real-world relationships that exercise our "UMA legal party" definitions and tease apart those vs. the "UMA technical entity" definitions, to help us map use cases to them. This exercise is neutral with respect to what type of identity system any one deployment uses; we can get into that level as soon as we see how the use cases (and their "owners" in the real world) fall against the framework. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…> and our most recent email thread is here <https://kantarainitiative.org/pipermail/wg-uma/2019-May/thread.html>. (I can't seem to find our Google Groups archive; checking into that now.) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: Information about User-Managed Access (UMA)
by Colin Wallis Kantara 13 May '19

13 May '19

Folks Can we help Philip with this request? Kind regards Colin ---------- Forwarded message --------- From: Philip Kershaw - UKRI STFC <philip.kershaw(a)stfc.ac.uk> Date: Mon, May 13, 2019 at 3:29 PM Subject: Information about User-Managed Access (UMA) To: federatedIdentity-members ( federated identity system for scientific collaboration) <federatedIdentity-members(a)cern.ch> Hi all, I’m looking for practical applications of UMA in the research community. Can anyone provide me any pointers or contacts? Thanks, Phil

2 1

Business model telecon notes for 2019-05-07
by Eve Maler 10 May '19

10 May '19

They can be found here: https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

8 15

Call for agenda items for tomorrow - or cancel
by Eve Maler 08 May '19

08 May '19

It seems like the business model work is hitting on all cylinders, but unless we have somebody (Pedro? Alec?) contributing a concrete extension before tomorrow, I suggest we cancel. Many of us are preparing for EIC in Munich. There is no meeting next week, but we can try and have an UMA BOF alongside the Kantara plenary or workshop! (Lots happened last week; IIW 28 session notes are starting to appear <https://iiw.idcommons.net/IIW_28_Session_Notes>...) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Reminder: New business model telecon series starts tomorrow
by Eve Maler 06 May '19

06 May '19

We're meeting 8am PT at the usual GoToMeeting link we use for Thursday telecons (https://global.gotomeeting.com/join/857787301) If you weren't yet added to the calendar invitation but want to be, let me know. Standing agenda: work on producing our second business model report by September, initially focusing the work on use cases that illustrate each of our mappings from business relationships (and changes in those relationships) to UMA technical artifacts. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Looking for quick review of "UMA 101" slides for IIW first day
by Eve Maler 28 Apr '19

28 Apr '19

Hi folks-- I put together some slides to present at IIW for a requested UMA 101 session, which I have shamelessly based on UMA overview/deep dive material presented at last week's HEART webinar. I'm considering this sort of a "version 2" of the material that Maciej and I delivered to the IETF 104 meeting; it was a welcome chance to refactor it. If you have a chance to look at it quickly and comment on it by Monday afternoon Pacific time, that would be great. I'll upload the final version to our wiki and advertise it in the usual fashion. Thanks in advance! *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0