- WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] Minor comment
by Justin Richer 12 Jul '17

12 Jul '17

This is a good point, might as well spell it out. --Justin Sent from my phone -------- Original message --------From: James Phillpotts <james.phillpotts(a)forgerock.com> Date: 7/11/17 3:57 AM (GMT-05:00) To: Eve Maler <eve(a)xmlgrrl.com> Cc: "wg-uma(a)kantarainitiative.org UMA" <wg-uma(a)kantarainitiative.org> Subject: Re: [WG-UMA] Minor comment Only in that in UMA 1.0 the token type hint was not access_token. J. On 11 July 2017 at 02:14, Eve Maler <eve(a)xmlgrrl.com> wrote: Since both PATs and RPTs are already formally defined, and function, as OAuth access tokens, I wonder if it's necessary to spell this requirement out. (The protection API is just about introspecting the RPT.) Eve Maler (sent from my iPad) | cell +1 425 345 6756 On Jul 10, 2017, at 6:44 AM, James Phillpotts <james.phillpotts(a)forgerock.com> wrote: Hi all, In https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.… given we just talk about RPTs and PATs, should we specify that the token_type_hint (if used) should be set to access_token? ref: https://tools.ietf.org/html/rfc7662#section-2.1 and https://tools.ietf.org/html/rfc7009#section-4.1.2.2 CheersJames _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma

2 1

Minor comment
by James Phillpotts 11 Jul '17

11 Jul '17

Hi all, In https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.… given we just talk about RPTs and PATs, should we specify that the token_type_hint (if used) should be set to access_token? ref: https://tools.ietf.org/html/rfc7662#section-2.1 and https://tools.ietf.org/html/rfc7009#section-4.1.2.2 Cheers James

2 2

Notes from UMA Legal telecon 2017-07-07 / a few extra notes and requests
by Eve Maler 07 Jul '17

07 Jul '17

A few more notes and requests: - There is *no Legal call next Friday*, as I've got a conflict. - Everyone please comment on the definitions <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/553hZKy8h…> *Tuesday, July 18*. Please send to the whole list. Ideally, don't just reply to this note; start a new thread with "Legal" in the subject. - *Tim,* if you're okay with it, let's please meet soon after that date to ensure you have what you need for deliverable #3. (I can also meet Mon-Thu next week.) - If anyone has any questions or thoughts, as always, please let me know. Thank you! http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-07-07 Attending: Eve, Kathleen, John, Ann, Mark, Tim Tim sent definitions according to the "exercise" Eve set. He derived many of them from UCITA, and some from prior UMA materials, including the draft model clauses, and then "protected resource" is new and may need more work. Let's treat these definitions, not as final model definitions, but our working draft that could be published in deliverable #3 (potentially accompanied by some diagrams showing mapping relationships) to show where the framework is headed. We can all review the document prior to the next call and send comments. *Access Contract:* *A contract or agreement to obtain by electronic means access to, or information from, an information processing system of another Person, or the equivalent of such access.* What is the difference between an access contract and an information sharing agreement? The former is a term out of UCITA law, so that's why he grabbed it. *Resource Owner:* *A Person with legal authority to grant access rights to Protected Resources; authorized to delegate access control functions to an ASO and to license access and use rights (permissions) relating to Protected Resources; acts as licensor to the Resource Server Operator.* Do both parts of the second clause relate to the ASO, or does licensing access and use rights pertain to the RO alone and not something the ASO mediates? The theory was that the ASO mediates this because it manages and executes/makes decisions on the RO's policies (which it does). Does taking out "*and*" in "*and to license access*" fix this, roughly? It seems so. Note: In UMA, the policy does not inherently travel with the resource, without some other layer of technology ("sticky policy" technology or similar). Do we need to define *Policy* (or *Authorization Policy*) vs *Business Policy* somehow? Does that add value to what we're doing? *Person:* *An Individual or Legal Person.* Great, same as before. *Legal Person:* *A legal entity means a corporation, business trust, estate, trust, partnership, limited liability company, association, joint venture, governmental subdivision, instrumentality, or agency, public corporation, or any other legal or commercial entity.* This seems to need just a touch of wordsmithing, e.g., "*A legal entity; a corporation...*". *Protected Resources:* *All data, applications, or software in which a Person either has Informational Rights or gives the Person the ability to exercise Informational Rights.* First, should this be singular? Second, regardless of singular or plural, the RSO has inherent authority in various aspects of "what counts as a resource" and "what types of access are possible to perform on a resource", as described here <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> (so possibly it's worth breaking down into *Resource* and then *Protected Resource*, as the former is RS-related and the latter is AS-related?). Is it interesting to consider mentioning "URI" as the location of the resource somehow, or no? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: We have a Legal telecon tomorrow (Friday)
by Eve Maler 07 Jul '17

07 Jul '17

8am PT/11am ET/4pm UK/5pm CET http://join.me/findthomas Agenda: - Review a final proposal for UMA roles, their definitions, and licensing mappings and relationships, and other language to use/stick to in describing this world - Take a look at a visual formalism for explaining all this *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Notes from UMA Legal subgroup telecon 2017-06-30
by Eve Maler 01 Jul '17

01 Jul '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-06-30 Attending: Eve, Tim, Kathleen, John W, Bjorn, Colin, Mark L, Sal, Mary Let's clarify all our role terms and concepts today: 1. *Resource Owner** (was Grantor)* 1. *Data Subject* *(was Resource Subject)* (has privacy framework meaning) - could be the Resource Owner or has delegated authority to a separate Resource Owner by law or contract 2. *Authorization Server Operator* - Agent (fiduciary?) of the Resource Owner - role is controlled by the PAT, and in practice it issues the end-to-end licenses because it issues the RPTs 3. *Resource Server Operator* - Data Controller (has privacy framework meaning) - is the Resource Server Operator 4. *Client Operator* - 1st-tier Data Processor (has privacy framework meaning) - is always the Client Operator? or if the Resource Owner grants access in order to make the Requesting Party be another Data Controller, what does that make the Client Operator in this case? 5. *Requesting Party* - 2nd-tier Data Processor (has privacy framework meaning) - is always the Requesting Party? - or maybe the Resource Owner wants to make the Requesting Party be another Data Controller? 1. *Access Beneficiary*??? - a party that the Requesting Party is acting on behalf of, either themselves or another party - a better name for this? We definitely don't like the word "ownership" of data or records. Is there licensing of data, or a record, or what? Since the access grant could be about disclosure of data, or deletion of data, or execution of an algorithm, or whatever, the licensing similarly could be sophisticated. It could specify that the recipient gets a copy of the data, etc. We want to have a concordance between all of these roles and the UMA flow. Do we use the role terms *Licensor* and *Licensee* at different points in our clause text vs. the terms above? Or can we punt on that for now? E.g., maybe the Resource Owner becomes (dons a role of) a Licensor at a certain point in a contract, and a Requesting Party becomes a Licensee. Two of the parties listed above would be parties to the license/contract, and others are subsidiary. But we still need to complete our mapping work to understand the precise relationships of them all, wrt UMA. The Resource Owner is the one that has to hire/contract with the ASO, because it can't be someone who doesn't have legal capacity etc. Or even if the Data Subject contracted with some agent, say, an attorney, to take care of financial business or whatever for them, then that Resource Owner really does function as their delegated agent and contracts with the ASO on their behalf. Of course, just as in Google Docs, the agent might need to "transfer ownership" of resources back to the data subject at some point – and the IRM group's design guidelines include just such actions! Delegable, Transferable, etc. This justifies our "indenting" the Data Subject role; it's "offline" wrt UMA, and our model. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: We are on for the Legal call tomorrow (Friday)
by Eve Maler 29 Jun '17

29 Jun '17

Tim will be leading the discussion. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Draft minutes of UMA telecon 2017-06-29
by Eve Maler 29 Jun '17

29 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-29 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-05-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25>, UMA telecon 2017-06-15 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-15>: APPROVED. Public Comment period Public Comment/IPR Review period concludes on July 12 – please report any comments you have during this period. Do we have any other comments coming from the "outside" through the officially published channel? Colin reports that no such comments have been received. An email reminder was sent out a few days ago, and more are coming. Eve will start a social media campaign from the UMAWG handle today, through July 12. Please RT etc. CIS trip report Eve, Colin, Maciej, Mike, Justin, and others were there. The "Authorization: Age of UMA" approach communicated the Alice-to-Bob (Tony-to-Pepper) approach really thoroughly and seemed to have the right light touch that late in the conference. Maciej could testify that his wife, who was present, finally understood UMA for the first time after eight years! There were ways it didn't go into as much depth. But "CIS Twitter" did seem to appreciate it as a teaching device. Colin notes that Kantara overall ended up having a "community area" near its booth, with ID.me, Gluu, etc. The pre-conference workshop went well. A very "agile" no-screenscraping pledge effort <https://kantarainitiative.org/psd2statement/> was put together; don't forget to go and sign up! IDpro.org <https://idpro.org/> is spreading its wings. Eve notes the Women in Identity effort and the corresponding #ZZAuth song. [image: (smile)] At CIS, Eve made announcements about interest in interop testing and asked for people to contact her with interest in providing funding and other resources. UMA 2.0 work #332: Justin's article <https://medium.com/@justinsecurity/uma-2-0-437c293c3283> says succinctly: "If the authorization server chooses, the claims represented by the PCT can fulfill the policies set by the resource owner." But the closest we get in actually saying this directly, after building up a story in bits and bites, is in Grant Sec 3.3.4 in a Note where we say "Note: Claims and other information gathered during one authorization process may become out of date in terms of their relevance for future authorization processes. The authorization server is responsible for managing such relevance wherever information associated with a PCT, or other persistently stored information, is used as input to authorization, including policy conditions themselves." Can't we do better, from the beginning definition and throughout? It's not enough to say "optimizing" in the beginning without saying what that means and how it's accomplished. Mike notes that in Sec 3.3.3, "Such persisted claims will be represented by a PCT issued to the client in a subsequent step", the "will" part isn't strictly true if the client doesn't provide the PCT in the request. There are a few challenges: The PCT discussion is spread out, and it's too oblique. Mike notes that the example of redirect_user with a custom URI with a query parameter was helpful, and suggests extending the normative language describing it in Grant Sec 3.3.6 would be good. E.g.: "Providing a value in this response might be appropriate, for example, if the URI needs to be customized per requesting party *with a query parameter*." *AI:* Eve: Add issue; look up the URI/reference/etc language to get this right. Leadership team elections MOTION: Re-elect Eve Maler as WG chair for an annual term, Maciej Machulak as WG vice-chair for an annual term, Domenico Catalano as Graphics and User Experience Editor for an indefinite term, and Maciej Machulak as Implementations Coordinator for an indefinite term. APPROVED by unanimous consent. Meeting schedule and preparing for All-Member Ballot Let's not meet on July 6. Let's try to meet on July 12 and see if we can make quorum to approve our Recommendations, ideally already edited if we get no huge substantive/troubling comments, so they can proceed to the Leadership Council for approval on July 19 (or in an electron ballot) to proceed. Interop testing plans ForgeRock will ship a platform release with UMA2 support in approximately October. Gluu should ready by then too. We should reach out to the KeyCloak guys around then. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Maciej 3. Eve 4. Mike Non-voting participants: - Colin - John W - Thomas - Robert Guests: - David Turner Regrets: - Cigdem - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-06-29
by Eve Maler 27 Jun '17

27 Jun '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-29 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-05-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25>, UMA telecon 2017-06-15 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-06-15> - Public Comment/IPR Review period concludes on July 12 – please report any comments you have during this period - CIS trip reports - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor)/Release Notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> /UIG <http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui…> /Wikipedia <https://en.wikipedia.org/wiki/User-Managed_Access> - New editorial issues (trivial, regarding IANA registration matters) #329, #330, #331 – three responses from registrars have come back and four are pending - New editorial issue #332 <https://github.com/KantaraInitiative/wg-uma/issues/332> about whether PCT definitions for AS and client are sufficient for implementation – discuss? - Release notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> are getting fleshed out bit by bit - Leadership team elections - Terms <http://kantarainitiative.org/confluence/display/uma/Leadership+Team> expire June 23 - Nominations - Elections (if quorum) - Upcoming meetings: Need to meet on *July 6*? Definitely meet on *July 13* and *shoot for quorum* - If no issues other than editorial by July 12, could have an edited spec ready for review July 13 - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder of no WG call this week / canceling Legal call this week / Legal Qs to ponder
by Eve Maler 21 Jun '17

21 Jun '17

Let's cancel the Legal call as well this week, as Tim has some other obligations on Friday. (I'll delete the calendar invitation for Friday.) He sends these questions for us to discuss in email, however: *"One point I would like to clarify (in response to questions about whether we are talking about grantors, obligate, bailouts, etc) and s that we have in mind licensors in our proposed UMA model.* *Also, I find it helpful to sort out two categories of consent with UMA: 1) delegations of authority to another person/entity to make access decisions on our behalf and at our direction and 2) granting/assigning access rights and uses for a particular purpose ( i.e. licensing) by another person/entity. It seems that all of the various possible relations between the UMA operators/roles flow from this."* Please share all your thoughts! I'll try to send mine as I'm able, given that CIS is still raging... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Leadership team positions and nominations
by Eve Maler 16 Jun '17

16 Jun '17

Folks-- The current roster is recorded here <http://kantarainitiative.org/confluence/display/uma/Leadership+Team>. It goes like this: 1. Chair: Eve Maler 2. Vice-Chair: Maciej Machulak 3. User Experience Editor: Domenico Catalano 4. UMA-Dev WG liaison: Maciej Machulak Roles #1 and #2 are formal. (Technically, we're supposed to have a Secretary role too, which I myself fill in practical terms but we haven't filled formally.) The terms are one year, renewable. Roles #3 and #4 are informal and discretionary. We have tended to cast role #3 pretty wide, and sometimes call it Graphics/UX Editor. And the UMA-Dev WG isn't active at the moment, so role #4 is currently more like (and used to be called something like) Implementation Coordinator. These terms all happen to expire on June 23. (We could actually make the informal role terms longer than a year if we wish...) Let's discuss the role-squishiness (Secretary and informal-role) situation on June 29. Please feel free to drop me a note nominating yourself or another participant (maybe seek their okay first? :-) ) prior to that date. Note that chairs and vice-chairs have to be voting participants. See this Roles description page <http://kantarainitiative.org/confluence/display/GI/Roles> and the Kantara Operating Procedures <http://kantarainitiative.org/confluence/download/attachments/84279306/Kanta…> for more detail. Thank you! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0