- WG-UMA - mailman.kantarainitiative.org

Yes, Legal is meeting tomorrow
by Eve Maler 02 Nov '17

02 Nov '17

We won’t have Tim with us. He’s asked us to focus on figuring out which diagrams to use to accompany the text, starting with the sharing scenarios. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Upcoming meetings and timeline for the 2.0 specs
by Eve Maler 01 Nov '17

01 Nov '17

Hi folks-- Unless someone raises a hand to discuss something more urgently, here is what I suggest for a timeline in the upcoming weeks (Legal calls will proceed apace): - Thursday Nov 2: no meeting (this week) - Thursday Nov 9: no meeting (next week) - Sunday Nov 12: second public comment period ends at 11:59 UTC - *Monday Nov 13: e-ballot starts*, to approve the Draft Recommendations as amended and forward them to the LC for certification for All-Member Ballot (see below) - *Thursday Nov 16: quorate meeting to review where we are, possibly foreshorten e-ballot, look at logos...* There are currently three outstanding issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>. Two are editorial and easily disposed of. One is Pedro's issue, which is intended to be a suggestion for an extension rather than a new V2.0 feature. (Since the issue was submitted during the second public comment period, I just wanted to make this clear, so it's not a surprise when we take no action at this stage and record it in the Disposition of Comments document.) Assuming there are no more comments, I'll plan to prepare a rev 09 of Grant for the occasion of the Nov 13 e-ballot (FedAuthz is currently unaffected by the comments). We'll revise as necessary depending on what other comments come in. Please let me know if you have any questions. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

WebFinger for Resource Discovery
by Pedro Igor Silva 01 Nov '17

01 Nov '17

Hello, Have you ever considered WebFinger [1] to discover resources protected by a resource server ? For instance, that could help clients to obtain from the RS itself the resource identifier and AS in order to obtain a RPT without a permission ticket. [1] https://tools.ietf.org/html/rfc7033 Regards. Pedro Igor

2 1

Projects by IF as a small business using personal data
by Eve Maler 27 Oct '17

27 Oct '17

I've pointed to these folks before; they're a design studio doing excellent work on privacy and consent. Here's a great article <https://iapp.org/news/a/looking-at-how-our-small-business-uses-data-a-gdpr-…> at IAPP on how they have analyzed and captured their own use of personal data as GDPR enforcement approaches. It's a microcosm of how big orgs should perhaps be doing it. (And Jim H, they're using GitHub to capture the diffs to their data use statement... :-) ) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Fwd: Reminder: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Eve Maler 27 Oct '17

27 Oct '17

FYI. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Megan Cannon <megan(a)kantarainitiative.org> Date: Wed, Oct 25, 2017 at 7:39 AM Subject: Reminder: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 To: announcements(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently concluded a round of public review, compiled comments, updated the original drafts, and approved the *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization* and *Federated Authorization for User-Managed Access (UMA) 2.0*. The documents described below now enter a second 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Document 1: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization (revision 08) Document 2: Federated Authorization for User-Managed Access (UMA) 2.0 (revision 08) Version: 2.0 Document Date: 2017-09-04 Document URLs: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html> and Federated Authorization for User-Managed Access (UMA) 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-08.…> To see a summary of comments and changes made related to the first public comment period, see this Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. Overview of Documents: *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for User-Managed Access (UMA) 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-09-28 *Review period closes: 2017-11-12 at 11:59 UTC* *To Comment on the Specification:* To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION" referencing the section or sub-section number, your comment and your proposed text to change. *Intellectual Property Rights Notice: * In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-11-12 at 11:59 UTC, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Cannon Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo] Click here to unsubscribe: https://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= maobupbo&unsub=1&unsubconfirm=1

1 0

Notes from UMA Legal telecon 2017-10-27
by Eve Maler 27 Oct '17

27 Oct '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-10-27 Attending: Eve, Tim, Kathleen, Devon, Theresa, Colin, Jim, Bjorn Eve was just attending "EWF USA", where GDPR knowledge is dawning. We put tons of new notes into the legal model doc <https://docs.google.com/a/meshfire.com/document/d/1eNutACnnr9EkIXrwG0TAbgWh…> and did some editing as well. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Re: [WG-UMA] [projectvrm] Mastercard Simplifies Managing Your Digital Footprint
by Adrian Gropper 26 Oct '17

26 Oct '17

Seems like a reaction to PSD2. If regulators impose payment services substitutability, then payment services have to compete on the basis of differentiated services and lock-in. Would MasterCard adopt UMA standard as an API for the authorization Server or is standards adoption driven by the banks and merchants? Adrian On Thu, Oct 26, 2017 at 3:39 AM Tom Barnett <tomma100(a)gmail.com> wrote: > > https://newsroom.mastercard.com/press-releases/mastercard-simplifies-managi… > -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: https://patientprivacyrights.org/donate-3/

2 1

No WG call tomorrow; Legal call is on for Friday
by Eve Maler 25 Oct '17

25 Oct '17

I haven’t seen any comments come through during this second public comment period so far, other than a couple of minor editorial items I threw into GitHub. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

FYI - MEF Paper
by Mark Lizar 17 Oct '17

17 Oct '17

1 0

UMA paper from the recent Rebooting Web of Trust
by Adrian Gropper 16 Oct '17

16 Oct '17

The DIF http://identity.foundation has a lot of sponsors you will recognize. They could be an important ally in bringing UMA to the masses. https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/… -- Adrian

3 7