- WG-UMA - mailman.kantarainitiative.org

The Nightmare GDPR Letter
by Adrian Gropper 19 Mar '18

19 Mar '18

This letter seems like a nice way to sell UMA to industry as core to both compliance and customer satisfaction. How many of the issues raised in this letter would be solved by outsourcing to a patient-controlled authorization server? https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-unde… -- Adrian

1 0

No meeting tomorrow / Other schedule notes
by Eve Maler 07 Mar '18

07 Mar '18

Last week we said “Unless a request for an extension erupts, let's not meet next week.” There has been no such eruption. Reminder: There is already no Legal call on Friday. Please note: I’ll be traveling the following TWO WEEKS and will need to cancel the March 15-16 and 22-23 calls. This is a good chance for those wanting to propose extensions, profiles, and/or security considerations to write them up in easily consumable fashion for discussion in later calls. As I had noted, I do plan to push forward on already-mentioned Legal deliverables in the meantime by reaching out to some of you in email for review. Finally, if anyone approximately London-based wants to get together at/near IETF 101, let me know! Eve Maler (sent from my iPad) | cell +1 425 345 6756

2 1

No Legal call on Friday of this week
by Eve Maler 05 Mar '18

05 Mar '18

Unfortunately I'm unavailable at that time. I'll try and send some ad hoc thoughts on the "formal model" topic in the meantime. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2018-03-02
by Eve Maler 02 Mar '18

02 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-03-02 Attending: Eve, Colin, John, Kathleen, Mark, Tim, Thomas, Bjorn Status update on the publication of the business model doc: It is finally posted! The listing on the Reports & Recommendations page needs to be fixed, but you can point people directly here <https://kantarainitiative.org/file-downloads/uma-business-model-0-7e-2018-0…> . We kind of need a UML diagram (or some kind of graph that lets us label the arcs) to express our delegation and licensing relationships more clearly, and we may need more role names for clarity as well. For example, a Resource Owner "is-a" Data Subject Representative (or whatever we want to call it – that's what GDPR calls it) but we have gone directly from DS to RO in our delegation mapping step. It would be clearer if we had a formal model that went: - DS delegates-X-rights-to DSR (the mechanism for this might be law, by contract – e.g. a will...) - DSR is-a RO - RO delegates-X-rights-to ASO - etc. Can we get hold of a UML modeling expert to ensure we don't miss any of the relationships and roles? In terms of finding one – or multiple – use cases to map onto the model, Eve is talking to 2-3 candidates about this. The complete list of agreements that seem to be possible in our model so far (the purple ones weren't mentioned in the business model paper yet): - Agreement that turns a service provider into an RSO (wasn't included in business model report) - Agreement that turns a service (or app) provider into a CO (wasn't included in business model report) - Agreement that enables a Person to act on behalf of a Data Subject [which puts them into position to act as a Resource Owner -- otherwise RO=DS] - Agreement(s) that delegates authorization for an ASO to grant access permissions on behalf of an RO (typically Ts & Cs, privacy notice, EULA...) - Agreement(s) that delegates authorization for an RSO to manage resources on behalf of an RO (typically Ts & Cs, privacy notice, EULA...) - Agreement that enables a Person to act on behalf of a Requesting Party [which puts them into position to act as a Requesting Party Agent -- otherwise RqPA=RqP] - Agreement that delegates access seeking to a CO on behalf of a Requesting Party - Agreement that delegates permission to know and persist personal data to an ASO on behalf of a Requesting Party It sounds like we need to do this for the POC: 1. Complete the formal model (and likely express it in a formal way) 2. Construct the set of agreements and licenses (or whatever the latter end up being in the case of individual permissions?) in a skeletal CmA format 3. Use the CmA format to invite UMA deployers to work with us on testing the format by applying their use cases A central element of our proposal is that licenses have the right design characteristics to give ROs (acting on behalf of whoever the DS is) to enable the autonomy, reciprocity, and objectivity needed above and beyond contracts. Regs variously require policy elements of the contracts to enable the individual to have certain rights. "Right of action" in healthcare is one. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

We really do have a Legal call tomorrow
by Eve Maler 01 Mar '18

01 Mar '18

...to flesh out the POC planning. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-03-01
by Eve Maler 01 Mar '18

01 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-02-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22>: APPROVED. Report on number of downloads Downloads of the PDF versions of the Recommendations on the increase, seemingly because of the press release that was put out. Call for interest in RS/C open source Eve is increasingly asked about libraries for RS's and clients. Gluu's OXD has a lot of language support. Its approach is to have a middleware service, with connectors. They're working on a Kong proxy that acts as an UMA RS. It swaps the contents of the authorization header for an RPT. Mike thinks the barrier to writing UMA client software is pretty high; the same is sort of true for OIDC, as demonstrated by the sheer number of libraries. So maybe with UMA a "clean slate" approach could be taken vs. just making random libraries. The demand surely seems to be there. Might this an IIW topic? Who is attending in the spring (Apr 3-5)? Mike, Eve, Sal possible, Thomas hopefully. Scope expression extension discussion Mike's email proposal is here <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/ESSwRI7B-…>. The idea is that it wasn't clear whether somebody meant "this scope AND this scope" or "this scope OR this scope" in selecting scopes in a policy-setting interface. He came across JSON Logic, a standard format for expressing Boolean expressions in JSON. There are some GUI tools out there with the ability to take JSON Logic and do something with it. He proposes extending the resource description with a scope_expressions parameter, which adds relationships of the scopes provided in the resource_scopes parameter. Example: An RS admin configures a /profile path into their API gateway; in order to do a GET on that endpoint, you need either a Customer or Partner scope and must have the 2Factor and FraudOk scopes. This drives resource registration. (The Gluu Gateway, coming out in roughly early April, will be MIT-license open source, but OXD will be a licensed solution, Mike says.) In FedAuthz Sec 3.1 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0…>, notice that we've been somewhat ambiguous about whether any resource_scopes are required to be supplied: "resource_scopes: REQUIRED. An array of strings..." Conclusion for now: There's no particular urgency around this. It would be good if Gluu writes up a "clean' extension document that could enable others to interoperate on the basis of this extension parameter and its operating rules. If there ends up being a community of interest around the extension, then that suggests it's worth taking up as a work item in the WG. Upcoming work Unless a request for an extension erupts, let's not meet next week. Note that gathering new security considerations also counts as "enhancing the current specs" for purposes of the fresh roadmap/charter we just hammered out. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Yuriy - Thomas *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

Agenda for UMA telecon 2018-03-01
by Eve Maler 01 Mar '18

01 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon UMA telecon 2018-02-2 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22> - Report on number of downloads - Call for interest in RS/C open source - Scope expression extension discussion - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Scope Expressions
by Mike Schwartz 28 Feb '18

28 Feb '18

UMA WG, We are proposing "scope expressions" as a way to enable the RS to express complex scope requirements. The serialization format for scope expressions we've tested is JSONLogic: http://jsonlogic.com --------------------- RESOURCE REGISTRATION --------------------- If the scope_expression claim is present, resource_scopes should be blank--scope expression and resource_scopes are mutually exclusive. For example: { "resource_scopes":[], "description":"Collection of digital photographs", "icon_uri":"http://www.example.com/icons/flower.png", "name":"Photo Album", "type":"http://www.example.com/rsrcs/photoalbum", "scope_expression": { "rule": { "and": [ { "or": [ {"var": 0}, {"var": 1} ] }, {"var": 2} ] }, "data": [ "http://photoz.example.com/dev/actions/all", "http://photoz.example.com/dev/actions/add", "http://photoz.example.com/dev/actions/internalClient" ] } } ------------------- Ticket registration ------------------- The RS registers tickets with all scopes mentioned in "data" (we need all scopes in order to evaluate expression. If scopes are missing--it should fail. For example, if 3 scopes are required in the example above. If only 2 are sent, this would be an error. { "resource_id":"112210f47de98100", "resource_scopes":[ "http://photoz.example.com/dev/actions/all", "http://photoz.example.com/dev/actions/add", "http://photoz.example.com/dev/actions/internalClient" ] } ---------- Evaluation ---------- The UMA AS should iterates over each scope and decide if it has enough claims. If not, it should return the need_info error. The RPT would not return the scope expression, but the granted scopes as normal. { "active":true, "exp":1256953732, "iat":1256912345, "permissions":[ { "resource_id":"112210f47de98100", "resource_scopes":[ "http://photoz.example.com/dev/actions/add", "http://photoz.example.com/dev/actions/internalClient" ], "exp":1256953732 } ] }

1 0

A reminder: looking for extension proposals
by Eve Maler 28 Feb '18

28 Feb '18

This means we should have written extension proposals in front of us to consider. Mike specifically mentioned scope expressions. We also have a number of other extension ideas in GitHub <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>. If you would like to champion any of these ideas in this week's call, please let me know, for planning purposes. Otherwise our agenda is pretty light, just a few quick updates. I'll assess the "agenda load" by noon PT tomorrow and see if it's worth having a call. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Permissions and Obligations Expression Working Group
by Adrian Gropper 27 Feb '18

27 Feb '18

https://www.w3.org/2016/poe/wiki/Main_Page This W3C WG just showed up in my decentralized identity group. It seems to be mostly concerned with published data rather than private but there could be something there we want to consider. -- Adrian

2 1