- WG-UMA - mailman.kantarainitiative.org

Calendar disruption should be just about done now
by Eve Maler 23 Jul '15

23 Jul '15

http://kantarainitiative.org/confluence/display/uma/Calendar If you didn’t get calendar invitations that you were expecting, let me know. If you’re a non-voting participant and you’d like to be added to the invites, send me private mail and I’ll add you (I now try to add new voting participants to the invites as a matter of course). I made the fresh calendar entries repeat just through the end of 2015 because I believe Google Calendar is sort of buggy when it comes to repeating entries that go “forever”. I also created fortnightly entries (thanks, Robert, for explaining British usage to me :-p ), starting on August 5/6, for all the APAC participants I’m aware of. I only invited "APAC-type people" to them. If I missed you and you’re located in a region for which those meetings are the only good ones for you, or you’re interested to have even *more* UMA meetings in your life, let me know and I can invite you too. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

IEEE Workshop on Privacy Engineering article on UMA published
by Eve Maler 23 Jul '15

23 Jul '15

Hi folks— FYI, My article on UMA, presented at IWPE’15 back in May, has finally been published: http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7163222 ($) The presentation slides are available linked from the event program, here: http://ieee-security.org/TC/SPW2015/IWPE/program.html Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

4 3

Draft minutes of UMA telecon 2015-07-23 (next week: V1.0.1 issue nominations!)
by Eve Maler 23 Jul '15

23 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-23 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-23> Minutes Roll call Quorum was reached. Minutes approval MOTION: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25> and read into today's minutes the notes of UMA telecon 2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01>, UMA telecon 2015-07-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09>, and UMA telecon 2015-07-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16>. APPROVED by unanimous consent. Macro, micro, and current-plan process We love the idea of treating the future UMA specification process agilely and as if it were software, and using GitHub for managing the process. Mike points out that Kantara already has a GitHub organization <https://github.com/KantaraInitiative>; let's use it. He's been using it for OTTO. Let's figure out the right process and ownership – and document it for use by other groups, Eve suggests. We need to do a final historical checkin on the xmlgrrl repo, and then move on with a native process. Sprint themes and priorities We're good with them. Logistics We plan to nominate issues to pull forward from the backlog on the next call. We will plan for 90-minute calls in August, starting 30 minutes earlier than the "normal" start time, with the "normal" hour being consider the "core" time to meet (recognizing that not everyone can change their schedules very dynamically). Eve will do a cleaning of the voting participation rolls and expects everyone to do their level best to attend in August (and beyond!). Plans for Independent Submission to IETF Should we now wait until V1.0.1 is at the Recommendation stage? Let's, in fact, have the conversation about the the added value of publishing the specs as IETF documents, with Nat and others. Justin recommends recalculating the cons vs. the pros of publishing through IETF, given that the documents may change and there are significant costs. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Eve: Review Marcelo Wikipedia comments and take next actions. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 1 Jul 2015 (pre-meeting), quorum is 7 of 13. (François, Domenico, Sal, Mark, Thomas, Andi, Ishan, Robert, Maciej, Eve, Arlene, Mike, Jin) Eve Arlene Robert Maciej Domenico Mike Sal Non-voting participants: Justin Sarah Scott Adrian Zhanna Regrets: Thomas Andi Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Agenda for UMA telecon 2015-07-23
by Eve Maler 21 Jul '15

21 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-23 Date and Time Thu Jul 23 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25> and read into today's minutes the notes of UMA telecon 2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01>, UMA telecon 2015-07-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09>, and UMA telecon 2015-07-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16>. Handling post-V1.0 issues Considering the proposal <https://docs.google.com/document/d/1c50top8X6Aqw3CEVeX_SD2THqO508ihs14QwLem…> on the table: can we reach consensus on an approach? Timeline and meeting schedule: e.g., extend the meeting times? can we consistently reach quorum? If time and consensus on the above: possible to take the first steps on issue nomination and selection? AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Taking a coordinated, efficient approach to handling UMA issues -- your thoughts?
by Eve Maler 21 Jul '15

21 Jul '15

As we enter the UMA post-V1.0 era, gaining implementation experience and even being asked by some parties what they should do/not do in the face of the new issues being raised (“should we wait to start implementing?” No!), I thought it would be a good idea to have a clear, documented process and timeline for handling our issue backlog. To that end, I put together a proposal, which I’ve reviewed with Maciej and Thomas so far, and which I’d now like to share with you all: https://docs.google.com/document/d/1c50top8X6Aqw3CEVeX_SD2THqO508ihs14QwLem… As discussed on the last call, there’s interest in putting our “legal” discussion track into a persistent subgroup meeting series, which will leave us free to focus on technical topics for the time being. I think we’ll need to do that to meet the relatively aggressive schedule I’m proposing — please share your thoughts in this thread. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 1

The RSA 2016 conference CfP is open
by Eve Maler 21 Jul '15

21 Jul '15

If anyone is thinking of putting in an UMA session... http://www.rsaconference.com/events/us16/speakers/call-for-speakers …can you let me know? Joni is looking to gather interest so that she can get a view at the all-of-Kantara level. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

6 6

A new idea for the APAC crew: additive meetings
by Eve Maler 21 Jul '15

21 Jul '15

The “APAC crew” and I have just been batting an idea back and forth. Instead of moving one meeting a month to a different time, which puts us at quorum risk when we can least afford it, we’re going to keep meeting solidly on Thursdays every week of the month, but ADD an APAC-friendly synchronization meeting on a BIWEEKLY schedule at a NEW even later time that accommodates even people based in Singapore. As far as I know, the only people who’d be candidates to attend such a meeting would be me, Gil, Colin, Allan, and Nat, so I’m going to schedule this as an “ad hoc” type of meeting to which only we are invited. If anyone else would be interested to attend, please send me a note and I will invite you as well. And if if you know anyone in the APAC region who has been interested to get active in the group but who has been hanging back due to time zone difficulties, I hope this solution may prove attractive enough to get them to join! Those of you who are on the calendar invites: Please expect to see some invitation shuffling. Don’t panic, I’ll sort everything out by the end of the week. By that time if something still looks funny, let me know and I’ll try to fix it. Eve p.s. Why didn’t I think of this before? Duh. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Kuppinger-Cole APAC event
by Gil Kirkpatrick 21 Jul '15

21 Jul '15

Greetings all, K+C took down the web page for their APAC Identity Summit... it is being rescheduled to Feb 10-11 2016 in Melbourne (a wonderful time to visit Melbourne BTW). So no need to pursue a panel for November. But we should keep the Feb conference in mind, I expect we will have some things to talk about. -gil

1 0

Clarification Regarding OAuth 2.0 Resource Set Registration Update Method
by Farazath Ahamed 19 Jul '15

19 Jul '15

Hi, The method described in the spec to update Resource Set descriptions[1] is supposed to return a HTTP 204 including the _id value of the successfully updated resource set description. but the HTTP Status Code Definition for 204 says, The 204 response MUST NOT include a message-body, and thus is always terminated by the first empty line after the header fields. Therefore is it correct to include a body in a 204. Is it possible to do that? Am I missing a trick here? [1] https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg.html#rfc.se… Thanks, -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

3 8

Re: [WG-UMA] [UMA-Specifications] Citation to Dynamic Client Registration should reference RFC 7591 (#174)
by Adrian Gropper 19 Jul '15

19 Jul '15

How much of RFC7591 would be different in a specification for how a resource owner registers their home-built authorization server with a protected resource? Adrian On Saturday, July 18, 2015, Eve Maler <notifications(a)github.com> wrote: > UMA Core contains a number of references to [DynClientReg], which spec is > now IETF RFC 7591. The normative reference should be updated to point to > the final document: > > https://tools.ietf.org/html/rfc7591 > > — > Reply to this email directly or view it on GitHub > <https://github.com/xmlgrrl/UMA-Specifications/issues/174>. > -- Adrian Gropper MD Ensure Health Information Privacy. Support Patient Privacy Rights. *http://patientprivacyrights.org/donate-2/* <http://patientprivacyrights.org/donate-2/>

2 1