- WG-UMA - mailman.kantarainitiative.org

Legal call is on for tomorrow
by Eve Maler 23 Feb '18

23 Feb '18

- *Fridays,* 8-9am PT - https://global.gotomeeting.com/join/857787301 - http://kantarainitiative.org/confluence/display/uma/Calendar We'll flesh out the list of relationships and artifacts further (something Jim and I were starting to do in email already) and take a look at Jim's candidate template work in CmA. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Apologies - there is no Legal call today
by Eve Maler 23 Feb '18

23 Feb '18

I sent out an agenda and I shouldn't have. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-02-22
by Eve Maler 22 Feb '18

22 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-02-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15>: APPROVED. Charter updating - See the emailed draft <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/lwESnNfKY…> The "Avoid (defining) cryptography" and "Permit digital signatures" design principles are sort of in tension. There's also an interaction with the "Avoid complexity" DP. What do we mean? UMA wants to be agnostic for the reason of adoptability, but there's a security consideration here so that "the fox doesn't run the henhouse". Maybe another way to state the "Permit..." DP is: "Permit (don't preclude) the use of cryptographic techniques that enable strong security and privacy properties". Most of our DPs have guided us pretty well over the years. But this last one seems like an exception, at least as stated. There are a lot of other security use cases we wouldn't want to preclude/would want to enable; Domenico mentions data integrity, for example. OTOH, originally it was meant as a kind of reciprocal to ensure that third parties could use digital signatures and encryption if they want to. Maybe we don't need the reciprocal. *MOTION:* Andi moves: Accept the charter refresh proposal. APPROVED by unanimous consent. *AI:* Eve: Get the approved charter refresh text into the online charter. *AI:* Eve: Edit the Requirements <https://kantarainitiative.org/confluence/display/uma/UMA+Requirements> document to indicate that the new charter has the most current version of our DPs and requirements. WG Legal Adviser role Do we need this role? It has potential benefits in helping us find liaison relationships, goes the theory. A "Legal Editor" role name is more in line with other roles we have on our leadership team. *MOTION:* Andi proposes for Tim Reiniger to serve in the Legal Editor role on the UMA WG Leadership Team for an annual term. APPROVED by unanimous consent. Next meeting Mike proposes that we discuss an extension for scope expressions. Eve asks that he propose a formal extension in order for us to discuss it productively. If anyone has extension ideas they'd like us to discuss, please do the same! Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Tim - Peter - Justin - Mark - Bjorn *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-02-22
by Eve Maler 21 Feb '18

21 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon UMA telecon 2018-02-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15> - Charter updating - WG Legal Adviser role - AOB MinutesRoll call Quorum was not? reached. Approve minutes Approve minutes of UMA telecon UMA telecon 2018-02-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15>: tbs Charter updating - See the emailed draft <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/lwESnNfKY…> WG Legal Adviser role tbs *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Please review the charter refresh draft
by Eve Maler 21 Feb '18

21 Feb '18

...as attached, for our meeting tomorrow. I added one phrase under the Audience section to enhance the "IoT-nature" of the charter just a tiny bit more; your input welcome. "...designers of digital services, >>including IoT device ecosystems,<<..." Agenda coming shortly. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Spec Locations
by Justin Richer 19 Feb '18

19 Feb '18

I may have missed this decision, but I can’t find the canonical HTML versions of the UMA specifications. If you go to the Kantara page, all of the links point to the PDF versions, which require you to fill out a form to download. This is problematic for me on a number of levels, not the least of which that I need a URL to reference the specification from another specification — in my case, HEART. If we do have canonical HTML versions, what are the URLs? And is it possible to get links to those put up in all the places that I looked for them (the WG homepage, the Kantara recommendations page, etc). If we do not have canonical HTML versions and only have the PDF versions, why not? And why did we make this horrible decision, and how can we reverse it? :) — Justin

4 4

Re: [WG-UMA] [KI-LC] FW: Reminder: LC BALLOT to approve a Group-Approved Draft Report as a Kantara Initiative DRAFT Report
by Eve Maler 17 Feb '18

17 Feb '18

Thank you, Megan! Please let us know when the report is published in the Reports & Recommendations area so we can point to it. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Thu, Feb 15, 2018 at 7:46 PM, Megan Cannon <mcannon(a)virtualmgmt.com> wrote: > Dear Kantara Initiative Work Group Chairs and UMA WG, > > > > I am pleased to report that the Group-Approved Draft Report has been > approved as a Kantara Initiative DRAFT Report with a simple majority of 5 > out of 8 votes. > > > > Congratulations! > > > > All the best, > > Megan > > > > > > *From:* megan(a)kantarainitiative.org [mailto:megan@kantarainitiative.org > <megan(a)kantarainitiative.org>] > *Sent:* Monday, February 12, 2018 10:24 PM > *To:* lc(a)kantarainitiative.org > *Cc:* staff(a)kantarainitiative.org; marketing(a)kantarainitiative.org > *Subject:* Reminder: LC BALLOT to approve a Group-Approved Draft Report > as a Kantara Initiative DRAFT Report > > > > > > Dear Kantara Initiative Work Group Chairs, > > > This email initiates a Leadership Council eBallot to approve a > Group-Approved Draft Report as a Kantara Initiative DRAFT Report. > > > > Motion: To certify the Group-Approved Draft Report “A Proposed Licensing > Model for User-Managed Access v. 1.0 2018-02-01” as meeting the Kantara > Initiative document publication requirements and to approve as a Kantara > Initiative DRAFT Report. > > > > Please follow this link to complete the eBallot > <https://www.surveymonkey.com/r/CT3WM6F>. > > > > Document: A Proposed Licensing Model for User-Managed Access > > Version: 1.0 > > Document Date: 2018-02-01 > > Document Attached > > > > WG wiki page: http://tinyurl.com/umawg > > WG Charter: https://kantarainitiative.org/confluence/display/uma/Charter > > > > Ballot Opens: 2018-02-07 > > Ballot Closes: 2018-02-14 > > > > Voting Rules: A simple majority of Voting members of the LC is required > > > > Ballot Information: Article 8 of the Kantara Initiative Operating > Procedures v2 require the Leadership Council to certify that the WG Draft > Report has met the following document publication requirements: > -- The Draft is within the scope of the WG Charter > > > > Eligible voters as of 2018-02-06: > > eGov > > Federation Interoperability > > Identity Assurance > > Identity Relationship Management > > Open Trust Taxonomy for OAuth2 > > User-Managed Access > > User-Managed Access Dev > > Consent and Information Sharing > > > > > > Megan Cannon | Senior Program Manager | Kantara Initiative > > D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 > <(781)%20258-5523> > > megan(a)kantarainitiative.org > > www.kantarainitiative.org > > 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA > > [image: Kantara-Logo] > > > > > > > > > > _______________________________________________ > LC mailing list > LC(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/lc > >

1 0

Notes from UMA Legal telecon 2018-02-16
by Eve Maler 16 Feb '18

16 Feb '18

Note: No meeting next week. https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-02-16 Attending: Eve, Colin, Jim, Thomas, Tim, Sal The International Association for Contract and Commercial Management (IACCM) <https://www.iaccm.com/> as 40K or so members. It's old and venerable and works on "the contract problem". For large businesses, this looks like: coming up with a legal vs. a business deal, being unable to react to events, having insufficiently agile contracts, etc. Marketing, purchasing, and other business roles are engaging. They have chapter and annual meetings: Europe, NA, and Australasia. Jim is now head of the tech community, a new role. His goal is to network and bring together the threads around improving transacting. Tim Cummins founded IACCM. They are increasingly aware that businesses must play in networks and supply chains. Does a KI/IACCM liaison make sense? Colin and Jim can talk offline about this possibility. What is the premise of machine readability in our model? The terms of the license in our model could be conveyed through the form of a smart contract or in some machine readable form. Jim: Smart contracts aren't really contracts. Thomas: All smart-contracts need (a) Digital Identities and (b) some way to control ledger access by those identitiers. I would think Kantara is best possition to address the "edges" of a blockchain system. Colin: Agree with you Thomas. Actually the folks starting to operationalize ID on the BC are opening up to conversations about how to assure those pieces.. after having said initially 'we're new, we're hip, we know everything'.. a year on there is some appreciation that the essence of many aspects of the identity assurance puzzle don't change - only the environment that they operate in.. Jim: And (following Thomas) the blockchains may be something like the "edges" between resource and authorization nodes. Regulators are only nibbling at the edges of really fundamental and core identity issues, which KI is perfectly positioned to weigh in on. And UMA2 is well positioned to answer permissioning questions. Are all the smart contract questions too big for now? What if we just go for the mappings that enable machine readability if you want it? If you can end up with stable text that can live at the end of a URL, that may be sufficient for now so that we don't go nuts trying to solve the world's smart contract identity problems before testing the UMA business model proposition in front of us. Our business model report focuses on the resource owner/data subject and requesting party/requesting party agent needs first. But what about the IACCM "personas"? For example, slide 11 in the Legal Role Definitions deck shows "delegation relationships" we haven't yet captured in the report: how a service provider becomes an RSO or a CO. They would get "purple arrows" because they're partially based on UMA technical artifacts (namely, OAuth client credentials). Would we want to output clause templates? Sounds like it. Jim: Think in terms of general engagement, specific engagement, deployment. See this example <http://www.commonaccord.org/index.php?action=doc&file=G/TechContractsCom-IT…>he's working with. The use case: A company is buying data processing or consulting services. In this case it's US domestic, but we want to make ours GDPR-enabled so that it compels a particular pipeline of enforcement actions. With all the subcontracting, Jim guesses that GDPR will dictate a lot of the contractual terms. We have to pick a use case. Two candidate we've talked about include: - Origo/Pensions Dashboard - Health IoT For our use case, will it require multiple natural languages? We'll have to see. It would an uninteresting test of UMA not to include the Federated Authorization portion of the specs, so let's assume we're including the "Licensing access granting permissions on RO's behalf" relationship portion. We also have to enumerate the legal devices that would be created. There are static and dynamic ones. - Agreement that turns a service provider into an RSO (wasn't included in business model report) - Agreement that turns a service (or app) provider into a CO (wasn't included in business model report) - Agreement that enables a Person to acts on behalf of a Data Subject - Agreement(s) that delegates authorization for an ASO to grant access permissions on behalf of an RO (typically Ts & Cs, privacy notice, EULA...) - Agreement(s) that delegates authorization for an RSO to manage resources on behalf of an RO (typically Ts & Cs, privacy notice, EULA...) - Does the PAT simply link to all these previous agreements in order to establish that the RO has agreed to the "licensing of access granting permissions on RO's behalf"? We think so - It's possible to profile UMA to require that the basis for PAT issuance is interactive vs. silent – this is something we could consider building in to the agreements above, to ensure that a human RO is given the change to consent in a GDPR-compliant way - There should be a way to force interactive user consent again if there is a new version of the agreement available - (to be continued next time - licensing of permissions and the requesting party side of the equation) Note that we have no meeting next week, Feb 23. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Legal meeting tomorrow: focus on POC use case and scope
by Eve Maler 15 Feb '18

15 Feb '18

https://global.gotomeeting.com/join/857787301 <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…> <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…> https://kantarainitiative.org/confluence/display/uma/Calendar <https://www.google.com/url?q=https%3A%2F%2Fkantarainitiative.org%2Fconfluen…> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Draft minutes of UMA telecon 2018-02-15
by Eve Maler 15 Feb '18

15 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-15 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-02-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-01> and UMA telecon 2018-02-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-08>: APPROVED. Discussion of the new Mozilla IoT gateway project Here is the TechCrunch article <https://techcrunch.com/2018/02/06/mozilla-announces-an-open-framework-for-t…>. It is using JSON-LD. Eve mused on Twitter that it could integrate with an UMA AS to be a personal AS. Mike likes JSON-LD and noted that OTTO is using it in preference to Fast-Fed, which is using SCIM. IoT use cases discussed in chat: - Thomas: Can my home panel control all my smart-appliances and manage their respective access relationships - Thomas: Alice-to-Alice - Thomas: My washing machine be a "resource" to my Control Panel on the wall - Sal: door controllers... - Maciej: Thomas, I think the control panel would nevertheless be the client with the AS sitting somewhere else (potentially within the panel as well but not necessarily) - Maciej: I'd prefer to connect my panel to my existing AS and then use it purely as the client, potentially requesting some new permissions as I add new resources (i.e. new locks and what not) - Maciej: what do you think - Sal: actually it needs to be able to run offline, so it end up being AS and RS and the reader is client - Thomas: Agree. The OIC/OCF model is that there is a "Domain Controller" (not Microsoft AD). The DC will be our AS. The Panel will be the Client. Homeowner is the RqP - Thomas: The thing is that some vendors are placing the DC board as part of the wall-panel. - Thomas: The DC board could be (should be) part of the Gateway box. - But our UMA model fits perfectly. - Maciej: it does, yes - Sal: yes, most of these things have pretty archaic architectures, UMA absolutely handles this better.. - Thomas: A bigger problem might be the multi-dwelling (non-Enterprise) use case. Example is an Apartment building where all the apartment units are leased. - Thomas: The Building Owner is the legal owner, and owner of all AC/HVAC units inside each apartment. - Thomas: It must allow service personel access to each apartment. - Thomas: So we potentially have a hierarchical UMA model. - Thomas: Each apartment has its own AS. Then building owner has its "Super-AS". - Maciej: with the 'slave AS' being clients relying on policies in the super AS - Thomas: Yes. There will be local policies, and then building-wide policies. - Sal: Yeah, the trick is not to have one offs and hve it explode for every control point, 1000+ policies (I have seen this) may enable the disconnected use case but can croak the backend.. - Thomas: Agree. Needing to push multiple tokens Mike and Eve had been discussing offline that UMA1 allowed the pushing of multiple claim tokens <https://docs.kantarainitiative.org/uma/rec-uma-core-v1_0_1.html#claim-push>, but we (deliberately) removed that capability in UMA2 at some point because we couldn't think of a use case. Mike actually has a use case at this point, which is to send, not multiple ID tokens per se, but "badges" such as professional certifications (so, third-party-asserted attributes). Since any claim token format can be defined by anyone, a "compound" claim token format could be defined to carry multiple tokens as necessary. Each badge would typically come from a different authority. There are various authorities: Badgr.io, cred.ly, trailhead.salesforce.com. A badge is just a simple JSON-encoded assertion. It's very similar to an ID token, only the recipient part is weak. The offline version of a badge ("baked") is signed. The hosted version is just a URL that you have to resolve (an "artifact" pattern!). There's an MIT project called BlockCert around verifiable claims about badges. (See our Requirements document <https://kantarainitiative.org/confluence/display/uma/UMA+Requirements> for proposed requirement P11 for "verifiable claims" from 2009.) Okay, so how does such a "verifiable claim" work securely and with privacy with an audience parameter? The issuer of a badge does specify an audience, after a fashion, by specifying an email address. Sovrin would say: Issue a unique DID per badge, then require that the recipient prove that they're the owner of the DID. Mike is working on use cases where simple possession can count for something too. We went into a discussion of where, on a sliding scale of lightweight to deep security and privacy, we should aim our efforts, and an observation that specs often decide that the perfect is the enemy of the good. More best-practices development is usually welcome and beneficial. Charter updating - See draft <https://docs.google.com/document/d/1_kk8JLQZY-8eQfkWlMl0r7YJXN26dqAMTJBUMUm…> Discussion point: Given that the UMA architecture succeeded early on in ensuring that the "human as resource owner" use case, do the functional requirements, which focus heavily on this use case, need to be expanded to mention other kinds of resource owners? Eve has edited to say "a person (human or legal person)". Also, what about devices as/managed by resource servers? Saying "managing data-sharing and service- *and device-access* relationships" gets us partly there, but what about the disconnection use cases? We only did part of that work in UMA2. We didn't get to a full set of work on locally validated self-contained RPTs. This might be seriously interesting extension work. Let's think on the right way to add more indications of IoT to the charter. We didn't vote on it today but we think we're close. Consider Tim Reiniger as WG Legal Adviser We discussed this. There is considerable support for having him in such a role! Is this the right name for the role? Can't think of suitable alternatives. No time for a vote at the end of the call, but we'll pick this up again next time. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Andi 3. Maciej 4. Eve 5. Mike Non-voting participants: - George - Thomas - Bjorn *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0