- WG-UMA - mailman.kantarainitiative.org

Notes from UMA Legal telecon 2017-05-26
by Eve Maler 26 May '17

26 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-05-26 - Reviewing deliverable #2 Attending: Eve, JohnW, Kathleen, Tim, Andrew, Scott D, Mark L Eve shared the experience of presenting to the Cloud, Big Data, and AI legal conference on May 23. She got to try out the elevator pitch for our nascent legal framework and the rest of the work. She'll point to the PDF of her slides when available. The first key element of this deliverable, as discussed previously, is the conceptual orange/blue chart. Communications are required in an electronic protocol context. The Communication/Autonomy nexus includes Consent(Autonomy/Law), Sharing(Autonomy/Commerce), and Protocols(Autonomy/Communication). Scott notes: "Consciousness" as part of this might sound "frilly", but as part of law it's actually not – it's a "meeting of the minds", so it's fundamental to contract formation. There are famous cases every law student learns regarding this concept. John comments, channelling Doc regarding contracts of adhesion: How does this play in? The problem of the human mind and questions of human authority are fundamental. We ultimately have to map UMA to law. Eve: Going by the matrix, this looks like Consent (Law/Autonomy), Access Authorization (Law/Reciprocity), License (Law/Objectivity). Reciprocity supports enforceability of transactions. How do we get to a grant of access rights? UMA's permission tokens are an anchor. The word "delegation" from a legal perspective doesn't make sense, quite. Kathleen observes that DRM is a technology that is literally used to effect access licensing already. Is it possible to get to the point of breaking the law by accessing some digital resource? Who controls the access relationship? Any requirement for consent is a basis for the authority we are looking to ensconce. So the various regulations that strengthen consent requirements, such as PIPEDA, GDPR, PSD2, and others (such as "patient right of access", which is an "economic clout-oriented" strength, as Kathleen points out) strengthen our ability to make these connections. Eve thinks FIPPS is too "soft power", in that it needs to be operationalized through other regulatory structures. (Eve reminds us all to focus on the "hard power" we have, which is to develop the framework and toolkits to influence those actually deploying services. Our "soft power" to influence policymakers to make law and regulation is to be done only through the framework level as interesting written material, and through other means. That's why we don't have a Resource Regulator role formally.) Scott remarks that "consent" is sort of a legacy system that isn't fit for purpose, but is well understood. He also notes that the word "control" is a difficult one; a "co-management regime" over digital resources is a more realistic way of seeing the challenge. Kathleen points out that consumers have the power to fill their profiles with false information; she calls it discombobulation. Eve points to The Economics of Privacy <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2580411>, which provides evidence that savvy consumers can manipulate businesses/organizations, and that greater data sharing can benefit (e.g.) patients. Eve agrees about stepping back *two* steps from "data ownership": from "own", and again from "control", to "management". *Also* from "data" to "(digital) resource" (because sometimes the data is very transient, e.g. provided through a streaming API). Scott adds that a person's relationship to a thing should really be a relationship to another person vis a vis the thing. Eve wonders if we can publish a Talmudic-style commentary version of deliverable #2 (or turn all the deliverables into eventual WG deliverables, or whatever) for benefit of the wider audience we're going for. Scott notes that the UCC Commentary provides a potential model; it's citable. Mark notes that trade associations are trying to figure out how to develop codes of conduct that are GDPR-conforming. Eve points to A Typology of Privacy, and specifically its typology of the objects of the rights to privacy, as great additional commentary that could extend our analysis of Communication; it puts "mediated communication" under the "semi-privacy zone" (which came from Westin's work). John points further to the NIST Privacy Engineering <http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf> work; see page 17. Similar to the security concept of CIA, it proposes "predictability, manageability, and disassociability". Regarding the opportunities to combine forces and possibly have a KI-wide Legal WG that at least encompasses the scope of the current UMA Legal and CIS legal-related work: There's consent receipt lifecycles, User Submitted Terms as ready-made licensing terms, a CR version of the orange/blue matrix?, and possibly more. Eve noted that the current UMA Legal mission is very much like a charter. The French court had said it was a derogation of human rights to give too-broad permission. (And GDPR has now ensconced a requirement to give specific purpose of use!) So Scott had suggested at the legal conference that maybe it could be possible to delegate to a fiduciary layer some broad ability to manage permissions, and then that layer could give more reliability around this. This was the point at which Eve leaned over and whispered, "Like an authorization server?" [image: (smile)] (Or the authorization server operator, to be precise.) The theory Eve has had is that a Resource Owner (Grantor as was) and Authorization Server Operator should be able to negotiate the former delegating to the latter the ability not just to execute to the former's protection policies, but to set policies on their behalf, e.g. setting default policies. This is a real use case that has come up in HEART, and we have even defined one of the profiles to account for this. Tim says this is where the word *agent* comes in, so it should be covered. *Next steps:* Everyone to review the document as sent in email by next week for deliverable #3 purposes. *AI:* Eve: Review deliverable #2 for copy-editing/Kantara approval purposes ASAP. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Andrew Hughes 26 May '17

26 May '17

From: Megan Cannon <megan(a)kantarainitiative.org> Date: Fri, 26 May 2017 04:59:22 +0000 Subject: NOTICE: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently approved the UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0. The documents described below now enter a 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Documents: UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 Version: 2.0 Document Date: 2017-05-25 Document URLs: UMA 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html> and Federated Authorization for UMA 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.…> Overview of Documents: *UMA 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for UMA 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-05-25 Review period closes: 2017-07-09 at 11:59 UTC To Comment on the Specification: To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION". Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-07-09, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo]

2 1

Re: [WG-UMA] Reminder: Legal subgroup call is on for tomorrow (Friday) morning
by Eve Maler 26 May '17

26 May '17

Thanks, Tim! Note: I may be a tiny bit late starting today's call. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756) > On May 26, 2017, at 3:19 AM, Tim Reiniger <tim(a)futurelaw.net> wrote: > > Here is the paper for today’s call. > > Tim > > From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Eve Maler > Sent: Thursday, May 25, 2017 9:37 PM > To: wg-uma(a)kantarainitiative.org > Subject: [WG-UMA] Reminder: Legal subgroup call is on for tomorrow (Friday) morning > > Tim and I met earlier this week, and he will have a revision of deliverable #2 and news about the direction of deliverable #3 for us. Our legal framework is starting to shape up! > > I can also share news of a talk I gave at a legal conference yesterday, and we can discuss the prospect of a Kantara-wide Legal WG, if time. > > Eve Maler (sent from my iPad) | cell +1 425 345 6756 > <UMA Legal Model Deliverable 2 Paper.docx>

1 0

Reminder: Legal subgroup call is on for tomorrow (Friday) morning
by Eve Maler 25 May '17

25 May '17

Tim and I met earlier this week, and he will have a revision of deliverable #2 and news about the direction of deliverable #3 for us. Our legal framework is starting to shape up! I can also share news of a talk I gave at a legal conference yesterday, and we can discuss the prospect of a Kantara-wide Legal WG, if time. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Draft minutes of UMA telecon 2017-05-25
by Eve Maler 25 May '17

25 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-05-18 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18>: APPROVED. Logistics - Final Draft Specification to be remanded to Kantara staff TODAY UMA V2.0 work We discussed FedAuthz Sec 3.2 in the scratch draft and changed editorial text to ensure that the UMA errors for the resource registration endpoint are clarified to be MAYs while the HTTP errors are MUSTs. (Take out of hanging list.) By contrast, we confirmed our understanding that Sec 4.3 – "the authorization server responds with an HTTP 400 (Bad Request) status code and includes one of the following error codes" – stays declarative and thus is definitely still implicitly a MUST in the fashion of our issue #312 decision. Issue #313 <https://github.com/KantaraInitiative/wg-uma/issues/320>: We needed more explanation from Justin. He meant that the phrase "human-readable" needs better definition. The method suggested is to do what RFC IETF 7591 Sec 2 <http://The value of this field MAY be internationalized, as described in Section 2.2.> does, which is say "The value of this field MAY be internationalized, as described in (7591) Section 2.2." Since that section already says it's OPTIONAL for the AS to do anything with it, and all other details are already covered, that's all we need to do; we can remove the paragraph. Issue #315 <https://github.com/KantaraInitiative/wg-uma/issues/315>: Reverse the wording so that REQUIRED is first. Issue #316 <https://github.com/KantaraInitiative/wg-uma/issues/317>: A big problem is the example of a hash of the session cookie, which is a really unusual way of doing things. Justin can do a pull request by 2pm ET. Issue #317 <https://github.com/KantaraInitiative/wg-uma/issues/317>: The two logical response options, = and <, shouldn't say MUST; for consistency they should just say "the authorization server responds...". (Yes, Justin did mean non-null!) Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: Regarding 3.3.6: invalid_scope should also cover cases where the client asked for a scope it's not registered for: In Sec 3.3.4, mention that if the client requests a scope that it didn't pre-register for, it's not an error (at the RPT request stage) because, during the authorization assessment process, the RequestedScopes might include scopes requested on the client's behalf by the RS. However, it is not included as a requested scope. Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: s/other entity other/any entity other/ Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: PoP: Let's keep as is. Other: - Catch curly quotes. - Catch out-of-date references. - Update publication dates. - Choose the correct Status of This Document. - Close issues! Logistics Eve and Justin will get the spec drafts ready in the next hour for Kantara staff to publish. Other artifact work: Let's work on those things casually next week and in the interim. Items include: - UIG (Eve) - Wikipedia page (Domenico will work on Italian one; Eve will reach out to others who have edited other pages in the past) - Release notes - FAQ (Eve has one to add) - Case Studies page - Swimlane (Eve) - Implementation page (Maciej) - ... Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Kathleen *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-05-25
by Eve Maler 24 May '17

24 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-05-18 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18> - Logistics/timing: - Final Draft Specification to be remanded to Kantara staff TODAY - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor) - Eve has implemented all decisions where possible and is expecting final Justin comment by this morning - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

No Legal call tomorrow
by Eve Maler 18 May '17

18 May '17

Instead, I'm going to do some offline doc review with Tim. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Do Promises To Use "Best Efforts" To Protect Data Really Require Unreasonable Action? - Data Protection Report
by John Wunderlich 18 May '17

18 May '17

In UMA legal and the Information Sharing workgroups, it will be important to be mindful of 'best practices' vs 'reasonable efforts'. http://www.dataprotectionreport.com/2017/05/do-promises-to-use-best-efforts… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 3

Draft minutes of UMA telecon 2017-05-18
by Eve Maler 18 May '17

18 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-04-27 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-04-27>: APPROVED by acclamation. Logistics - Candidate motion for consideration: - "Approve the draft UMA 2.0 specifications [as amended according to the instructions of UMA telecon 2017-05-18] as Draft Recommendations for public comment and IPR review." - Assuming we approve and forward the specs today, how to structure the next 45 days' worth of time? UMA V2.0 work We reviewed the recommendations of UMA telecon 2017-05-12 and everything seemed to be acceptable. We have consensus. Issue #312 <https://github.com/KantaraInitiative/wg-uma/issues/312>: Consensus to remove the language (option 2). Issue #313 <https://github.com/KantaraInitiative/wg-uma/issues/313>: Copy the text instead of move it. The second paragraph is not entirely relevant to Grant, so only a subset should be copied over. Issue #314 <https://github.com/KantaraInitiative/wg-uma/issues/314>: The RS, along with the AS, has to manage mappings of resource IDs to specific resource owners. Let's drop the note. Issue #315 <https://github.com/KantaraInitiative/wg-uma/issues/315>: Eve has suggested wording. This is practically editorial. We should say "pre-registered" instead of "registered". Should we say first "Only if the client has pre-registered a single full claims redirection URI, this is OPTIONAL." and then put the other proposed wording at the end? Yes. Issue #317 <https://github.com/KantaraInitiative/wg-uma/issues/317>: Did Justin mean "also non-null", or did he mean "also null"? Gluu first gets a token with no scopes, and then adds scopes to it. Is that first token a true RPT? It doesn't have permissions associated with it, so this could be a sort of interim step. It's certainly okay for a client not to pre-register for/request scopes. And we decided that it's okay for the RS to include zero scopes in its permission ticket. (Justin had made a separate comment about some inconsistency in FedAuthz about our language on this point.) So if we were serious about allowing zero scopes in *RequestedScopes*, then if that is null too, then it should be possible to issue a token with "nothing – that's what you wanted, and you'll like it!" But if it was non-null, that should result in a hard error. So we need to break this out into two bullets, with the two different conditions. Or the more elegant solution is to remove "is non-null" from the current last bullet, because if CandidateGrantedScopes is null and RequestedScopes is non-null, then the former is < the latter, and it would come under the third bullet. There should be only two logical bullets: = and <. Issue #322 <https://github.com/KantaraInitiative/wg-uma/issues/322>: We made a strong decision to make permissions be a SHOULD for extensibility reasons, in case someone wanted to experiment with the dividing line between AS and RS responsibilities. However, token introspection is already optional in OAuth, and with the spec refactoring, maybe this isn't necessary anymore. And changing from a SHOULD to a MUST is backwards incompatible, whereas the reverse isn't (it would break implementations to change it in this direction). Consensus to change to a MUST. Issue #320 <https://github.com/KantaraInitiative/wg-uma/issues/320>: We don't understand this one. Hopefully this will result in only non-normative language later. Issue #321 <https://github.com/KantaraInitiative/wg-uma/issues/321>: Simple fix. Issue #318 <https://github.com/KantaraInitiative/wg-uma/issues/318>: This is a normative change, but we should do it for consistency. (This also changes the WSD.) Issue #316 <https://github.com/KantaraInitiative/wg-uma/issues/316>: Eve will work with Justin to ensure it says everything he wants, in addition to reiterating any OAuth messages as appropriate. Mike also notes that FAPI from OIDC went beyond requiring state (but of course that is an industry profile). Attend to: Issues #319 <https://github.com/KantaraInitiative/wg-uma/issues/319> and #323 <https://github.com/KantaraInitiative/wg-uma/issues/323> and the following editorial instruction: - Remove "Note:" from beginnings of "For an example of how..." references. A candidate motion: MOTION: Mike moves and Maciej seconds: Approve the draft UMA 2.0 specifications, Grant rev 04 and FedAuthz rev 04, as amended according to the instructions of UMA telecon 2017-05-18, as Draft Recommendations for public comment and IPR review. APPROVED by unanimous consent. *AI:* Eve, Justin, and Maciej: Edit! and ensure the Draft Recommendation markers are properly in place. *AI:* Eve: Work with Kantara staff on review/publication next steps. Logistics Note that, once this 45-day review has begun, any substantive (think backwards-incompatible) changes will require going back to another such review. We should review the 05 drafts ASAP to catch any text implementation boo-boos before this goes out the door – even before next Thursday. Maybe we can also figure out #320 before publication as well. Let's try to make hay early next week while the sun shines. Maybe Eve will even call an ad hoc. We can figure out our meeting schedule after that. Note: No meeting the week of CIS (June 22). Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - James - Jin Guest: - Jim Willeke Regrets: - John W - Justin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-05-18 (looking for quorum for this meeting!)
by Eve Maler 17 May '17

17 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-04-27 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-04-27> - Logistics/timing: - Candidate motion for consideration: - "Approve the draft UMA 2.0 specifications [as amended according to the instructions of UMA telecon 2017-05-18] as Draft Recommendations for public comment and IPR review." - Assuming we approve and forward the specs today, how to structure the next 45 days' worth of time? - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>/ dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor) - *Grant rev 03 <https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-03.html>** and FedAuthz rev 03 <https://docs.kantarainitiative.org/uma/ed/oauth-uma-federated-authz-2.0-03.…>*; stay tuned for revs 04 shortly - See UMA telecon 2017-05-12 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-12> for detailed notes about issue-closing recommendations, spec wording proposals (to appear in revs 04), and issues already closed - Revs 04 may also contain some editorial changes to intro sections - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1