- WG-UMA - mailman.kantarainitiative.org

No UMA WG call this Thursday again
by Eve Maler 07 Jun '17

07 Jun '17

But we should probably have a quick check-in meeting next week, so please plan on that. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

New paper on Identity, Data and next-gen Federation
by Thomas Hardjono 06 Jun '17

06 Jun '17

Eve, Mark, UMA folks, This new paper (PDF) might be of some use in framing-up the next level of discussions regarding "identity" and "data" and how to"federate data". Its permanent link is here: http://arxiv.org/abs/1705.10880 I'm thinking that the Claims-gathering flows in UMA and also the Consent-Receipts flows could use an "algorithm-identifier" value, effectively stating that "Alice consents to Algorithms X be run against her data set Y" (where the data-set lies in her private Resource Server). Best. /thomas/

9 22

Digital Privacy Is Making Antitrust Exciting Again
by John Wunderlich 06 Jun '17

06 Jun '17

https://www.wired.com/2017/06/ntitrust-watchdogs-eye-big-techs-monopoly-dat… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

required claims definition: array of object?
by Mike Schwartz 04 Jun '17

04 Jun '17

Another editorial suggestion... https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-04.html#autho… required_claims "An array containing parameters that describe the required claims, with the following subparameters:" Is parameters the right word there? Would objects be better? Maybe something like: required_claims "An array containing objects that describe the required claims, with the following keys." - Mike

4 3

OT: Funny
by Eve Maler 02 Jun '17

02 Jun '17

My company uses Expensify, and apparently they added a new delegated access feature (that I haven't seen or used yet) that sounds pretty UMA-ish. Wonder how much it cost them to implement it from scratch. Anyway, the CEO sends out these chatty newsletters, and the latest one included this blurb: "*2) "Wingman" renamed to "Copilot"* Remember how we had the genius idea of naming our amazing delegated access feature (where one user can sign in to another's account to help them out) "Wingman"? As a child of the 80's I just assumed that name conjured up images of Top Gun fighter jets and double high-fives in everyone. But it turns out that to the children of the 90's and beyond, it means cruising bars and picking up chicks -- who knew? Actually, almost everyone it seems. So, bowing to the wisdom of the crowd, "Wingman" is now the less-offensively named "Copilot". My bad!" Still laughing... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Fwd: Register Now for SOUPS 2017!
by Eve Maler 01 Jun '17

01 Jun '17

Wish I could attend this one, but for anyone else who is interested... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Mary Ellen Zurko <maryellen.zurko(a)usenix.org> Date: Mon, May 8, 2017 at 5:40 PM Subject: Register Now for SOUPS 2017! To: "eve(a)xmlgrrl.com" <eve(a)xmlgrrl.com> [image: SOUPS 2017, July 12–14, 2017, Santa Clara, CA, USA] <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct0_0/1?…> Greetings, Please join us in Santa Clara, CA, on July 12–14, 2017, for the Thirteenth Symposium on Usable Privacy and Security. SOUPS 2017 <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct0_1/1?…> will bring together an interdisciplinary group of researchers and practitioners in human computer interaction, security, and privacy. Register <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct1_0/1?…> by Monday, June 19, to take advantage of the early bird registration discount. The hotel reservation discount deadline is also June 19, so book your room today <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct2_0/1?…> . SOUPS 2017 will feature technical papers, a poster session, panels and invited talks, lightning talks and demos, and workshops and tutorials. The full program will be available in June. See the list of open calls <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct3_0/1?…> below: - Call for Lightning Talks and Demos <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct4_0/1?…> Early submissions deadline: Monday, May 22 - Call for Papers: 2nd Workshop on Inclusive Privacy and Security (WIPS 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct5_0/1?…> Submissions deadline: Thursday, May 25 - Call for Papers: 3rd Workshop on Security Information Workers (WSIW 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct6_0/1?…> Submissions deadline: Thursday, May 25 - Call for Papers: Who Are You?! Adventures in Authentication (WAY 2017) <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct7_0/1?…> Submissions deadline: Thursday, May 25 - Call for Posters <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct8_0/1?…> Submissions deadline: Monday, May 29 SOUPS 2017 is co-located with USENIX ATC '17 <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct9_0/1?…> . We look forward to seeing you in Santa Clara! Mary Ellen Zurko SOUPS 2017 General Chair soups17chair(a)usenix.org For more information and frequent updates regarding SOUPS, please check out our Facebook page <http://s.usenix.org/acton/ct/2452/s-0209-1705/Bct/l-1bc7/l-1bc7:db/ct10_0/1…> . Please use soups17chair(a)usenix.org to contact Mary Ellen Zurko. The email address maryellen.zurko(a)usenix.org is for automated list management only. About this mailing list: USENIX never shares, sells, rents, or exchanges email addresses of its members or conference attendees. We would like to continue sending you occasional email announcements like this one. However, if you no longer want to receive emails from USENIX, please click here <http://s.usenix.org/acton/rif/2452/s-0209-1705/-/l-1bc7:db/l-1bc7/zout?sid=…> to opt out. If you have any questions about the mailing list, please email office(a)usenix.org. We may also be reached via postal mail at: USENIX Association 2560 Ninth St, Suite 215, Berkeley, CA 94710, USA

1 0

Actually, Legal call canceled this week -- next Legal call is on Friday, June 9th
by Eve Maler 01 Jun '17

01 Jun '17

Talk to you then! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

No WG call on Thursday; Legal call is still on for Friday; offline tasks
by Eve Maler 31 May '17

31 May '17

Enjoy the time off on Thursday. I've updated the swimlane and linked it from the home page, but haven't yet broken it up to reflect the Grant/FedAuthz distinction -- which would probably necessitate breaking it up into two. Anyone interested to contribute to the Release Notes with me? Any additional suggestions for UIG topics? Here are our Wikipedia pages: https://en.wikipedia.org/wiki/User-Managed_Access https://de.wikipedia.org/wiki/User-Managed_Access https://es.wikipedia.org/wiki/User-Managed_Access https://fr.wikipedia.org/wiki/User-Managed_Access https://it.wikipedia.org/wiki/User-Managed_Access Domenico had offered to update the Italian one (thanks!). Other offers?... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 (UPDATED)
by Eve Maler 29 May '17

29 May '17

Note that the close of the comment period is now July 12. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Kantara Initiative <staff(a)kantarainitiative.org> Date: Sun, May 28, 2017 at 3:06 PM Subject: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 (UPDATED) To: announcements(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently approved the UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0. The documents described below now enter a 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Documents: UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Version: 2.0 Document Date: 2017-05-25 Document URLs: UMA 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html> and Federated Authorization for UMA 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> Overview of Documents: *UMA 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for UMA 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-05-25 Review period closes: *2017-07-12* at 11:59 UTC To Comment on the Specification: To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION". Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-07-09, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> Click here to unsubscribe: http://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= keohitgu&unsub=1&unsubconfirm=1

1 0

Glossary?
by Mike Schwartz 28 May '17

28 May '17

Eve, Just an editorial note: In UMA Grant, there is a glossary in section 1.3 (Abstract Flow). It says "Following are key concepts relevant to this specification," but it doesn't jump out at you. I was looking for a glossary in the TOC, and couldn't find it. And then in UMA Federated Authz, there is no glossary. You could perhaps reference the Glossary from Federated Authz to UMA Grant, but some of the definitions maybe needs to be tweaked. For example, I was looking at the definition of permission ticket: "A correlation handle, initially passed to the client by the resource server" That makes sense for UMA grant, but for federated Authz, it probably makes sense to mention the AS. - Mike

2 4