- WG-UMA - mailman.kantarainitiative.org

Kantara Mailing lists/ Spam-bot attacks - WG UMA
by Megan Cannon 07 Sep '17

07 Sep '17

Dear UMA WG members, We experienced a spam-bot attack on all our publicly listed mailings lists yesterday. One result of this attack was that some of you were no longer receiving emails from the list for a period of time. Your email addresses have since been unblocked at 3rd party providers and re-subscribed to the list. Also, a reminder that we keep an archive of the emails sent on the list at: https://kantarainitiative.org/pipermail/wg-uma/ ..so you haven't missed anything! On behalf of all staff, I am very sorry for the inconvenience, but we have worked swiftly, intelligently and collaboratively to minimize the impact. Thank you for your understanding and continued support of Kantara. Kind Regards Megan Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 | M: +1.781.258.5523 megan(a)kantarainitiative.org <mailto:megan@kantarainitiative.org> kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA

1 0

UMA 2.0 Vote
by Mike Schwartz 06 Sep '17

06 Sep '17

UMA 2.0 Vote: [X] Yes [ ] No (you are encouraged to provide a rationale explaining why) [ ] Abstain - Mike

1 0

ID.next 28-29 Mar 2018 call for presentations closes on Sep 8
by Eve Maler 06 Sep '17

06 Sep '17

http://www.idnext.eu/en/events/annual-idnext-2018/request-for-presentations/ Anyone interested to submit UMA-related topics? Time is growing short... Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Revs 08 are available; IMPORTANT: please read carefully now, for e-ballot on Wednesday
by Eve Maler 06 Sep '17

06 Sep '17

I'm still having trouble uploading (I've asked Oliver to help with that already), so the drafts are attached to this email. As already requested, all of you, PLEASE take an hour ASAP to read through these specs to ensure they look okay. Key updates: - Resolutions to newish issue #354 <https://github.com/KantaraInitiative/wg-uma/issues/354>, sub-issue 1 and 2, including a new but pretty minor OPTIONAL FedAuthz error code in FebAuthz Sec 3.2 -- thanks to James and Cigdem for their important contributions here! - Grant Sec 3.3.4 on authorization assessment -- I caught a super-confusing point in the wording here, and Cigdem unravelled more of the same in the worked example and all over -- please read through, you won't be sorry. :) The example turned out to be critical to put in, and I think our #337f commenter will be very glad of our efforts. Voting participants will need to weigh in starting Wednesday with your e-ballot vote (voting participants: Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem). By the way, right now we DO have a meeting scheduled on Thursday, but I report for jury duty tomorrow morning, so we'll see what happens... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 3

Canceling our telecon this Thursday / other calendar updates
by Eve Maler 05 Sep '17

05 Sep '17

It is highly unlikely I will be available for this Thursday's call, as I have jury duty. Our main task this week (assuming you've all completed your review of revs 07/08 -- haven't seen any comments other than from Cigdem and James, and the discussion from Pedro -- and are considering the IP email I sent earlier today) is to have our WG's voting participants respond to the forthcoming emailed e-ballot. So I will *remove this Thursday's meeting from the calendar*. Let's meet next Thursday, Sep 14, to check in on e-ballot results and any word from the LC on their intent for the rest of the specs' timeline. We can also discuss get-out-the-vote planning and the upcoming IIW. Looking further out, I do also need to *cancel our Thursday, Sep 21 telecon* because I'll be heading to the airport. So I'll remove that meeting from the calendar too. As for Legal telecons, here's how the calendar looks: - This Friday, Sep 8: yes - Friday, Sep 15: yes - *Friday, Sep 22: NO (will remove from calendar)* *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

In consideration of a potential second IPR review period
by Eve Maler 05 Sep '17

05 Sep '17

The Leadership Council has discussed whether a second IPR review period might be required for the changes made to the UMA2 specifications since our first Public Comment/IPR Review period began on May 25th. Colin has asked me to: - Highlight our Work Group's IPR policy to all of you (it is "Option Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non discriminatory (RAND) <https://kantarainitiative.org/confluence/download/attachments/2293776/Kanta…>" (HTML version <https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=41025…>), as can be seen on our wiki home page) - Ask you all to let me/Kantara know, if possible, if you intend to opt out to RAND prior to the Leadership Council taking up its certification process (it would do this starting in approximately the next 7 days, once our week-long e-ballot, starting tomorrow, closes) This will help the LC in its deliberations as it determines what sort of additional Public Review period might be needed. To help you in your own deliberations, I have taken extra care to document the nature of the *technical* changes in the Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. Here's a summary: 1. #337c,d: Added claims_redirect_uris OpenID Connect Dynamic Client Registration metadata field: design tracks OAuth redirect_uris metadata field 2. #340: Reintroduced UMA1 not_authorized error code and renamed it to request_denied 3. #341: Added interval parameter to request_submitted; design tracks OAuth Device Flow interval parameter 4. #354-1: Added optional invalid_request error code to resource registration endpoint; design tracks OAuth and OAuth bearer token error codes 5. #354-2: Reintroduced UMA1 requirement for PAT as bearer token to be supported (Note that the technical changes fall into two categories: Reintroducing UMA1 design elements (items 2 and 5) and tracking existing OAuth design elements (items 1, 3, and 4) -- the latter aligning with one of our key roadmap design priorities, btw.) If you have any questions, please let me know. Please conclude your review today, as I'll send out the e-ballot tomorrow first thing!) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Issue #354: No error for bad request body in FedAuthz RReg (also PAT handling)
by Eve Maler 04 Sep '17

04 Sep '17

https://github.com/KantaraInitiative/wg-uma/issues/354 Please take a look and weigh in on this new issue as soon as you can (I have already done so in the thread). We do not have a call in which to discuss the issue live this week, so I will plan to draw editorial conclusions from the issue thread unless it seems there's some controversy that needs discussion. After any required editing, I'd like to get our e-ballot under way by next Tuesday morning. Eve Maler (sent from my iPad) | cell +1 425 345 6756

2 2

Revs 07 are here for your review! (attached)
by Eve Maler 01 Sep '17

01 Sep '17

Hi folks— I’m having trouble FTPing the specs onto the Kantara site; I’m attaching them here so as not to delay your ability to review them. Please take your earliest opportunity to do a review, paying close attention to whichever issues you submitted or care most about. You can find the close-to-final Disposition of Comments doc here to help guide you: https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o… Knowing US and Canada people have a long weekend coming up, let’s make the deadline for review *THIS FRIDAY* (or *first thing Monday morning* if that works for your schedule). I don’t think you should need more than about an hour to read through all this, especially if you focus on key passages of interest. Do please pay special attention to *Grant Sec 3.3.4, Sec 3.3.6, and Sec 5*. If any issues are reported, I will turn around rev 08 drafts by first thing Tuesday morning and then start an e-ballot for Draft Recommendation approval, and then w can get the resulting specs to the Leadership Council for certification for All-Member Ballot. Thank you for your awesome efforts on the disposition of all the comments! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

UMA Legal role definitions, annotated
by Eve Maler 25 Aug '17

25 Aug '17

Please find attached Tim R's final draft of his Legal role definitions document for our review. This is a really excellent piece of work that I'm excited to share with you all! I've put a few new diagrams at the front of the slide deck <https://docs.google.com/a/meshfire.com/presentation/d/1I12agEsfaJK3LEiJyROr…> that illustrate some of the concepts and relationships herein in a lightweight way. Please consider this draft deliverable #3 to be close-to-final, and provide comments in that spirit. We might very well enhance the definitions that appear here to prepare them for use in any model clause text, but please view this version as the foundation for our legal framework. As such, this would simply be the conceptual basis for such clauses and any other tools. I apologize again for having had to cancel today's call; we had a medical emergency at home that seriously messed with my schedule. Note that we have no meeting next Friday (due to my being away on vacation). However, I will be peeking at email during my absence, so keep those cards and letters coming. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Apologies for the late notice, but Legal telecon canceled for today
by Eve Maler 25 Aug '17

25 Aug '17

Tim, if we can sync up 1:1 later on in the day, that would be great. If people have comments on the diagrams, please send them to the list. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0