- WG-UMA - mailman.kantarainitiative.org

Email troubles
by Eve Maler 06 Dec '15

06 Dec '15

Folks-- If you sent me any off-list email in the last few weeks and have been waiting (im)patiently for a response or wanted to be sure I kept whatever it was in my archives, I have to ask you to re-send. I've had some kind of server crash and lost a bunch of email, some of which is definitely unrecoverable. Thanks/sorry in advance... Eve (from my iPad)

1 0

Reminder: UMA legal subgroup telecon 2015-12-4
by Adrian Gropper 04 Dec '15

04 Dec '15

- *Fri Dec 4* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar - Limits of delegation: Breach liability "safe harbor", audit, and notice when resource servers accept dynamic registration of a resource-owner specified authorization server. - AOB -- Adrian <http://patientprivacyrights.org/donate-2/>

2 2

Reminder: UMA legal subgroup telecon 2015-12-04
by Eve Maler 04 Dec '15

04 Dec '15

Please see the Meetings and Minutes page or the UMA calendar linked from http://tinyurl.com/umawg to find dial-in information. The basic goal for the rest of December is to flesh out UMA-specific "model clauses" for for the required functions of party roles, some of which would be required (axiomatic?) and some of which might be optional. By hook or by crook, I will send some simple examples as warmups before this meeting -- but won't be attending as I'll be on a plane. Adrian has offered to facilitate. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
by Mike Schwartz 01 Dec '15

01 Dec '15

UMA WG, This draft for proof of possesion is getting pretty far along: https://datatracker.ietf.org/doc/draft-ietf-oauth-proof-of-possession/ Justin did this nice web sequence diagram: http://gluu.co/oauth-pop-websequence My question is... do you think we should recommend proof of possesion tokens for the RPT? - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

3 4

URGENT: Opportunity to request 2016 funding, with a proposal for a "legal subgroup" project
by Eve Maler 30 Nov '15

30 Nov '15

Hi folks— In conversation with SteveO and Robin W from ISOC, I learned they would be willing to support the UMA WG with some directed funding to Kantara to the tune of US$10K, to arrive by 31 Dec 2015 and to be spent in 2016. (Thanks, SteveO/Robin/ISOC, for your support!) I thought it would be a good idea to treat this as a matching funds opportunity in addition to a (required) formal writeup of what I have already described to them as a good target for development. The target: A user interface/environment for enabling the convenient creation of a variant UMA-specific set of contract clauses that could be used in real business settings, such as Adrian brought up in a legal subgroup meeting a few weeks ago. As research, I just spent the last hour meeting with Jim Hazard, and we worked out the following draft budget proposal with which we feel pretty comfortable: https://docs.google.com/document/d/1DFFwU_7EmXVtpTb0s7SZVkQ4NFOC6oi4uNInLDq… There is a DEADLINE OF TODAY for getting 2016 budget proposals in. Can I ask people to review this proposal and weigh in on a) the idea of submitting the proposal at all, and b) the text of the proposal if they think the submission is a good idea? To be clear, ISOC has guaranteed its contribution already; we are asking for Kantara funding over and above this in order to ensure we can do a really good job (so perhaps, in a sense, we’re asking Kantara to match ISOC’s funding!). If you have any questions, of course, please let me know. If I don’t hear any strenuous objections by 10pm CET (where I currently am) / 4pm ET / 1pm PT (sorry for the early hour on the west coast), I will send in the proposal. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 4

Reminder: no WG call on Thu and no legal subgroup call on Fri due to the US holiday
by Eve Maler 24 Nov '15

24 Nov '15

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: APAC-friendly UMA sync 2015-11-26 (see note at end)
by Eve Maler 24 Nov '15

24 Nov '15

Thu Nov 26 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: none for this meeting as I’ll be joining by phone (normally http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line)) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-11-25): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. NOTE: I have a dentist’s appointment just prior, and there’s a not-entirely-insignificant chance that I might be a bit delayed. If so, I’ll send a note to the UMA Chat Skype group. If you are not in that group, please send me a note to add you. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

OAuth Identity Federation
by Mike Schwartz 20 Nov '15

20 Nov '15

UMAtarians, I have finally caught up to all of you founders, and I am seeing the benefit of using UMA for federated identity (not just federated authorization). I've created a new project to just sketch out some of my ideas: http://www.gluu.co/oauth-identity I'm trying to gather feedback to see if this idea has any merit or would be worth the effort to undertake... Please send me email directly unless you think it would relevant for the whole list. thx, Mike

1 0

Notes from UMA legal subgroup telecon 2015-11-20
by Eve Maler 20 Nov '15

20 Nov '15

Exciting progress today! Attending: Andrew, Ann, Jon, Adrian, Steve, Jeff, Adrian, Scott Andrew still needs to keep some project details under wraps, but he notes that any provider whatsoever in that project needs to have SLAs etc., and for each of the identity roles, he’s created a list of archetypes for, e.g., IdPs and such. He’s also set out UMA archetypes — this is where the Binding Obs come in. If you have an UMA authorization server defined and built as such, what are its proper functions? He has a notion of this, but he just needs the text. Being a framework, it can handle both an AS that serves multiple ROs, and an AS that serves a single RO. When you downselect the rules you want, that gives shape to your deployment. Is it also interesting to attach the proper functions of the roles in terms of protocol state changes? Andrew is not so sure, for the work he’s doing right now in making a framework. Eve notes that it may simply have relevance only when it gets to “receipt” time, that is, when a particular norm gets executed by a particular role. Andrew’s analysis tool is designed to be able to record that if someone is a signatory to an agreement, then they commit to being in a certain role. So: Click the box to be in a role. He needs the role definition. We can write the latter. Scott asks: Have we talked about standards of care? Adopting a role in the real world comes with standards of care that are affected by statutes and/or contracts. Here’s where the CommonAccord approach could come in, with a flexible normative cross-reference. Andrew is planning to handle this in the base layer. Andrew made a matrix of expectations and commitments. Contracts are just exchanges of promises! Say what you’re going to do, and then doing what you said you were going to do. This is the Invisible Hand model. Offer and acceptance of a contract has a notion of the time of acceptance. This again suggests recording/logging as an important function. (Hence the blockchain mention as a ledger…) In legal parlance, a “prohibition” is a "condition subsequent”. This is a way to effect the “chain-link confidentiality” effect Domenico has drawn our attention to. It’s useful for real estate, but people bristle at it when used for intellectual property. Think of software licensing. But then again, it’s used for NDAs, embargoes, etc. It’s tricky. How different are “power” and “authorization”? This is the central preoccupation of Steve’s adult life. :-) ==== Can we draft statements of UMA role functions with required parts (clauses?) and optional parts (clauses?)? Should the latter include something about consent receipt/audit log entry generation, where appropriate? Andrew says this fits in pretty well with his goals. Obviously we’re not thinking about producing these statements in Word! They’d hopefully be in CommonAccord, and ultimately be available in a cool online tool with dropdowns and such. :-) Who is interested to actively take part in the action item? Eve, Andrew, Steve, Ann… Scott is happy to do intense kibbitzing! Eve and Andrew are meeting in depth later today, and will try and sketch a draft skeleton to help push things forward. Eve will round up those who are/may be interested to work together in the interim. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Follow-up to the UMA Legal call and FutureCommerce hackathon planning
by Adrian Gropper 20 Nov '15

20 Nov '15

The legal call today had a clear focus at the junction of CommonAccord, blockchain, and UMA. The use-case was negotiation of a Non-Disclosure Agreement between two parties using CommonAccord as a structure for the changes that each of the parties would make as they passed the drafts back and forth. Blockchain was introduced as the non-repudiation mechanism to track the intermediate and final version of the NDA contract. UMA was not central to the discussion on the legal call today but was tacked on vaguely as the means to control access to the final contract by unspecified parties. It was not clear to me who the Resource Owner would be in the use-case we discussed. For the FutureCommerce hackathon, I'm hoping to gather a team to hack a personal UMA authorization server. This server, which I'm calling HIE of One http://hieofone.org/ could be linked to the CommonAccord project we discussed today to the extent there was a Resource Owner to associate with the contract being negotiated. At this point, instead of an NDA, the contract being negotiated in HIE of One is a Release of Information policy that establishes what requesting parties and clients can access the protected resource. An NDA is, in some sense, the opposite of a release of information agreement. An NDA is often mutual and therefore does not have a clear resource owner. This may not be a problem for some applications of UMA but it doesn't seem to work well for a personal authorization server linked to a personal resource. I'm hoping we could coordinate some of the FutureCommerce hacks over the coming week. Ideally, the CommonAccord hack and the personal AS hack would complement each other around the same type of contract and we could even try to demo some interaction between them. Please let us know your thoughts and consider joining FutureCommerce http://futurecommerce.civics.com/index.html online Nov 20-22. Anyone specifically interested in working on the personal AS hack should email me and I will invite you to the GitHub project. Adrian <http://patientprivacyrights.org/donate-2/>

3 9