- WG-UMA - mailman.kantarainitiative.org

Notes from UMA telecon 2015-09-24
by Eve Maler 24 Sep '15

24 Sep '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24> Minutes Public review status Please retweet <https://twitter.com/UMAWG/status/645674926137958400> the @UMAWG tweet about the public review! Take a look at the new Release Notes <http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes> document. UIG status For the Organizations as Resource Owners and Requesting Parties section, is there really that much to say? Mike's folks are developing a sample resource server and an UMA client in Python, and will use the client credentials flow. His use cases typically use this grant flow. This will be Hello, World level. The org=RO circumstance is always the case for Mike, but the RqP might be an org or a human. For the Ensuring Resource Server Access to an Authorization Server When the Resource Owner Is Offline section, it's worth pointing out that the RO might not be a human at all, in which call "offline" isn't the right word. We might also want to mention "break glass" as a phrase specifically, since everybody knows this phrase. We don't want to burden developers with trust framework knowledge, but it might be a good idea to call out to the Binding Obs at this point, because it's around here that UMA protection might tip over into enterprise access management. AI: Eve: Make edits to the Ensuring Resource Server Access... section. AI: Andi and Zhanna: Please look at the section on optional and extension properties to see what might need an update to account for V1.0.1. AI: Maciej: Review and correct the Redirecting the Requesting Party to the Client After Claims Gathering section. AI: Maciej: Write up some recommendations for the RPT Refreshing section. AI: Maciej: Try to find Justin's old recommendations for the Permission Ticket Management section. AI: Eve: Ask Allan to write up why default-permit isn't a good idea. Logistics Next week, let's do a quick check-in on UIG status and Roland interop topics if possible. Let's go back to our previous usual pattern of weekly "ad hoc" meetings and last-week-of-the-month "quorate" meetings. (LATER: Eve notices that the last week of October would be IIW, when we won't be having a meeting, so let's strive for reaching quorum on both Oct 22 and Nov 5 so we can handle Public Review issues and results.) Previous AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. Attendees As of 10 Sep 2015 (post-meeting), quorum is 6 of 11. (François, Domenico, Sal, Thomas, Andi, Robert, Maciej, Eve, Sourav, Arlene, Mike) Eve Arlene Maciej François Mike Domenico Non-voting participants: James Katie Ishan Scott Marcelo Jin Regrets: Thomas Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

1 0

Notes from APAC-friendly UMA sync 2015-09-24
by Eve Maler 23 Sep '15

23 Sep '15

Attending: Eve, Nat, Paul Nat suggests that, once we have a draft that can be reviewed, we should send a request for comments to the Kantara Liaison Committee so that it can reach out to, e.g., the Article 29 Working Party and APEC (http://www.cbprs.org) The liaison that Kantara has is with ISO/IEC JTC1 SC27 WG5, of which the Article 29 WP is a member. The forthcoming EU GDPRs may impact what we’re doing here. This has been a topic of consideration for us, at least broadly; Mark and Eve have discussed some of the specific GDPR proposal wording. Paul will dig up a link to an institute in Sydney that has done work on global privacy issues, which might be another group from which to seek comment. Reminder: No APAC sync meeting next week (making our schedule be effectively “every three weeks" for a little while). Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Agenda for UMA telecon 2015-09-24
by Eve Maler 23 Sep '15

23 Sep '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24> Date and Time Thu Sep 24, 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Quick hits: Let's go back to our previous usual pattern of weekly "ad hoc" meetings and last-week-of-the-month "quorate" meetings Public Review status and outstanding comment review UIG review and next steps Interop and IIW planning AIs AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UIG has been somewhat revised
by Eve Maler 22 Sep '15

22 Sep '15

http://kantarainitiative.org/confluence/display/uma/UMA+Implementer%27s+Gui… Can everyone please take a look? I’ve added stub sections for each case when [UMA-Impl] was mentioned in the Core spec (in both V1.0 and V1.0.1), and I also added a candidate section on the RS API constraints. Andi and Zhanna, I wonder if you could please look at the section on optional and extension properties to see what might need an update to account for V1.0.1. Mike, you’re on point for “Organizations as Resource Owners and Requesting Parties”. Maciej, could you take “RPT Refreshing”? Justin and/or Maciej, would you be willing to take “Permission Ticket Management”? I remember that Justin had written some candidate text that we opted not to include in the actual spec, but I’ve gone nuts trying to find it in the mail archives or GitHub with no success. Justin or others (Allan?), what else might there be to say about “Default-Deny Policy Decision-Making Behavior”? Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: Special APAC-friendly UMA sync 2015-09-24
by Eve Maler 22 Sep '15

22 Sep '15

Thu Sep 24 at APAC-friendly times — this meeting is on an off-week due to a cancelled call last week Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-09-23): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. NOTE: Let’s cancel next week’s sync (making our schedule be effectively “every three weeks" for a little while); no sense stacking them up too close. I will be attending the IAPP Privacy Security Risk conference and can’t attend anyway... Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Re: [WG-UMA] Trust Framework non profits: Notes from APAC-friendly UMA WG sync 2015-09-02
by Colin Wallis 21 Sep '15

21 Sep '15

Thanks Eve Indeed, a great quick rundown. But with a number of us on this list pretty deeply involved in IDESG, I guess we are honour-bound to slightly correct you there.. :) << IDESG is the private-sector-led steering committee overseeing the US public-sector NSTIC initiative. I don't think it has a specific focus on trust frameworks vs. other various elements that are thought to be valuable for making privacy-sensitive federated identity successful.>> Actually it does have a very specific focus on a Trust Framework, the IDEF (IDentity Ecosystem Framework) based on the NSTIC Guiding Principles. The (soon to be announced) IDEF consists of a Functional Model from which Baseline Requirements and Supplemental Guidance are drawn, which has a major focus on Privacy along with UX, Interop, Security etc. A Self Attested Listing Service (SALS) will initially indicate relative compliance level of the applicable players, and in the fullness of time, a TrustMark or similar may emerge to 'brand' that compliance level. Cheers Colin From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Eve Maler Sent: Thursday, 3 September 2015 4:30 p.m. To: Adrian Gropper; Paul Templeman Cc: wg-uma(a)kantarainitiative.org UMA Subject: Re: [WG-UMA] Notes from APAC-friendly UMA WG sync 2015-09-02 Here's an attempt at a quick (?) rundown. An identity federation trust framework is a set of federated identity "rules and tools" identified by a set of policymakers representing a community of interest, which may be vertical/sectoral or horizontal in nature. Here's a white paper<http://openidentityexchange.org/wp-content/uploads/the-open-identity-trust-…> from 2010 that presents what is intended to be a model for open identity trust frameworks. The community could run/use cloud identity services, or just be a bunch of companies or organizations that want to be able to single sign-in to each other's stuff, or whatever. As noted below, Kantara does the care and feeding of a specific identity federation trust framework, including "assessing the assessors" for it. That trust framework has a FICAM heritage; FICAM is a US gov-specific trust framework. OIX is becoming capable of hosting listings of the members of multiple trust frameworks, and doesn't itself offer one and is agnostic as to the types. What OTA published is very cool; I don't know if I'd call it a trust framework; more a set of best practices (ymmv). The Federal Bridge is a PKI-based trust framework. PKI predates the cross-domain federated identity protocols such as SAML and OpenID connect, and the Federal Bridge has been around a long time. Connect.gov<http://Connect.gov> is a service that offers brokered federated identity services; parties involved in it have to be FICAM-accredited. IDESG is the private-sector-led steering committee overseeing the US public-sector NSTIC initiative. I don't think it has a specific focus on trust frameworks vs. other various elements that are thought to be valuable for making privacy-sensitive federated identity successful. (This isn't a complete list of federations, identity trust frameworks, or initiatives!) My take on why this is all relevant to UMA is that, where identity federations deal with "rules and tools" for IdPs and relying parties and users, UMA is a different beast and needs "rules and tools" for its own involved parties: resource owners, requesting parties, resource servers, and the like. The name we've given to UMA deployment ecosystems with a formal organizational principle is "access federations", and we believe they would benefit from trust frameworks too. The main reason why we have the legal subgroup is to develop some starter (and/or meta?) "rules and tools" to encourage UMA deployment ecosystems to flourish, while staying true to UMA's design principles. (I welcome corrections...) Eve On 2 Sep 2015, at 7:47 PM, Paul Templeman <paul(a)templeman.co<mailto:paul@templeman.co>> wrote: Thanks Adrian Appreciate the list. The discussion was as a result of a newby question asked by myself, whilst there were only a few people to annoy. :-) Still on a learning curve ... Regards Paul... ________________________________ Date: Wed, 2 Sep 2015 22:17:17 -0400 From: agropper(a)healthurl.com<mailto:agropper@healthurl.com> To: eve(a)xmlgrrl.com<mailto:eve@xmlgrrl.com> CC: wg-uma(a)kantarainitiative.org<mailto:wg-uma@kantarainitiative.org> Subject: Re: [WG-UMA] Notes from APAC-friendly UMA WG sync 2015-09-02 I have the following list of overlapping trust framework non-profits: OTA - https://otalliance.org/iot-trust-framework-submission Kantara - http://kantarainitiative.org/ FICAM - https://www.ise.gov/federal-identity-credential-and-access-management-ficam Federal Bridge - http://www.idmanagement.gov/fbca-certificate-policy-page Connect.gov<http://Connect.gov> - http://www.connect.gov/ OIX - http://openidentityexchange.org/ IDESG - https://www.idecosystem.org/ I can't tell them apart. Some of them depend on the others to some extent. How does any of this affect UMA? Adrian On Wed, Sep 2, 2015 at 7:57 PM, Eve Maler <eve(a)xmlgrrl.com<mailto:eve@xmlgrrl.com>> wrote: Attending: Eve, Paul, Allan Agenda bashing: - Looking at UMA in the context of sport (Australian Digital Transformation Office has an interest) There are similarities to health, and there are customer relationships as well. An under-6 soccer game involves two teams, two clubs, a competition organizer, a venue manager, and a referees' organization. There are different legal entities, and a lot of personal data flying between them. This is what makes it a little similar to health. "Children checks" involves officials who are members of sport organizations that cross state-level jurisdictions. And a lot of people involved are volunteers. If a dad is a volunteer coach, he still has to go through the check. If one person is a coach for two different teams/kids/sports, the person may have to go through the check multiple times. Paper forms are often still involved in this world. There are also sport associations at local, state, national, and international levels, responsible for different parts of the process. The vision would be, e.g., that a volunteer coach could go through a single check and have it be valid for other activities as long as it's fresh enough. Along with underage child regulations, there are also anti-doping regulations to think about. There's an interest in trust frameworks around this. What's the relationship between UMA trust framework opportunities and the Kantara and OIX work on trust frameworks and the UMA legal subgroup work? The Kantara trust framework came out of the US FICAM and NIST SP 800-63 material, but is not US-specific. Kantara has approved assessors that approve organizations under that trust framework. A key motivation for doing this is actual FICAM acceptance, which is valuable for (likely) being accepted sight unseen by the US General Services Administration. There's work ongoing to map US and UK trust frameworks. OIX runs a registry that can hold registrations, for communities of interest that have a trust framework, of members in good standing in that framework. Right now it only holds one set of entries, for a technical-level community run by OpenID Foundation recording self-certified conformance to the specs. So Kantara sort of specializes in "config-time" and OIX sort of specializes in "run-time". Some other identity federations in higher education and research have their own trust frameworks. What is the UMA legal subgroup doing? The mission of record is: "Develop recommendations about resource owner-and-requesting party [Alice-and-Bob], resource server-and-authorization server [service-and-hub], and any other transactional relationships in the UMA environment, keeping in mind international jurisdictional friendliness; applicability to many different vertical and horizontal use cases, including health; and support of higher-level access federation trust frameworks and similar efforts." The parallels between health and sport are actually pretty strong, as long as we stay away from only government, only health, only US, etc. One difference is that the people and even some of the organizations involved are at a small, non- or under-funded scale. It's mom-and-pop a lot of times, and volunteers can't deploy IT infrastructure. AI: Paul: Follow up on these notes with some specifics on "legal use cases" that arise out of the sport scenario. Who would be the Principal of interest in each? Etc. - V1.0.1 status update? We should close the specs for 45-day public review as of next Thursday or earlier. That would mean it's effectively stable at that point, modulo public review period comments. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com<mailto:xmlgrrl@gmail.com> _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org<mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma -- Adrian Gropper MD RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/ _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org<mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com<mailto:xmlgrrl@gmail.com>

4 3

New OAuth book (and UMA gets a mention!)
by Justin Richer 20 Sep '15

20 Sep '15

Hi all, First, apologies for the cross-posting while we’re trying to get the word out today. Antonio Sanso and I are writing a book about OAuth 2, and it’s just gone up for pre-order on the publisher’s website: https://www.manning.com/books/OAuth-2-in-Action <https://www.manning.com/books/OAuth-2-in-Action> You can download the first chapter for free, and if you pre-order you’ll get the first three chapters immediately and more as they get finished. You’ll also be able to give us feedback on the book that we can incorporate into the final publication, so it’s a great way to help make sure this reference is the best it can be. Plus, they’ve given us a discount code that gets you half off for the next couple days: mloauth2 We cover UMA in one of the later chapters of the book, talking about how it uses OAuth to solve a more advanced use case, and the kinds of things that it has added to OAuth in order to do that. We also cover two things that were originally born of UMA, dynamic client registration and token introspection, in depth in their own chapters. So, sorry for the commercial message, I’m just very excited that this is finally getting out there. Thanks, — Justin

2 2

New document, UMA Release Notes, now complete (for some definition)
by Eve Maler 20 Sep '15

20 Sep '15

http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes Please feel free to comment. I’ve also updated the UMA wiki home page to help everyone get the word out, as they see fit, during the comment period: http://kantarainitiative.org/confluence/display/uma/Home Oh, and I also did a bit of housekeeping in other parts of the UMA wiki — changing the name of the “UMA 1.0 Core Protocol” page to “UMA Protocol”, updating its content, and changing the name of the “Working Drafts” page to “Specifications and Auxiliary Documents”. Thanks, all! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

No legal subgroup meeting this week -- make sure not to miss next week
by Eve Maler 17 Sep '15

17 Sep '15

I’ve been talking to several subgroup contributors offline, and received some great feedback and suggestions about next steps. Unfortunately, I can’t make the call this Friday, and the timing isn’t great for some others either. So let’s take a cue from the larger WG and “take the week off”. I’ll send a followup note next week summarizing those suggestions. (And if I haven’t spoken to you yet and you’ve got feedback and suggestions too, hey, reach out and let’s chat.) Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Public Review status; release notes
by Eve Maler 16 Sep '15

16 Sep '15

We’re really close to getting the Public Review notification out. The online comment form has been changed in anticipation, and Oliver helped us solve what turned out to be a charset mystery, so the odd characters in the HTML specs are now gone. I’m hoping it will launch tomorrow, which means (I think...carry the one...:-) that we should close it on Monday November 2, the Monday just after IIW. In other news, I’ve created a draft set of release notes. Please take a look and give me any comments... http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes Thanks! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0