- WG-UMA - mailman.kantarainitiative.org

Notes from UMA Legal telecon 2017-03-24
by Eve Maler 25 Mar '17

25 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-03-24 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U…> Attending: Eve, Andrew, Tim, Adrian, Paul *NOTE:* No Legal call next week – and possibly the week after! *AI:* Eve: Look for substitute Legal call as necessary. Tim reports that he's well on his way with deliverable #2. Let's take a "breadth-first" approach to the use cases in deliverable #1 today. Tim asks: What's the general nature of the authorization services being developed today? Are there any? Are they primarily C2G or C2B? Yes, and they are split, with also some B2B. Eve ranks the top three-to-four use cases as healthcare (and healthcare-plus-IoT, with IoT generally being quite broad and horizontal), government/citizen interactions, and financial. Adrian notes that regulation is a powerful motivator for using UMA, and thus the consumer component seems to be critical to adoption. Use case C: And here the FCC decision from October just got reversed again <http://www.nbcnews.com/news/us-news/senate-votes-let-isps-sell-your-data-wi…>! Reasons to think this use case for UMA is valid: UMA would give a standardized interface for ISPs to offer third-party partners for efficient integration (more money on both sides), and wherever regs allow either "legitimate business interests" or "consent" as valid bases to collect and share data it's better to ask for consent because of user trust risks and creeping regulation scope (IT cost and user trust risks of having to ask for consent later). This could be Alice-to-Alice sharing (she shares with some app that she will use) or Alice-to-other sharing (e.g. for marketing purposes, maybe even "targeted" for some goodie offered to her, but maybe not). Worked on use case D. Worked on use case E. We decided to make it just the parent/guardian use case. *AI:* Eve: Try to add a payment use case as a variation on D. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA Legal call tomorrow
by Eve Maler 23 Mar '17

23 Mar '17

Date and Time - *Fridays,* 8-9am PT - Screenshare and audio: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2017-03-24 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U…> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Substitute WG meeting Wed Mar 29: any preference for 8am PT or 9am PT?
by Eve Maler 23 Mar '17

23 Mar '17

"Summertime skew" ends on Sunday, so the Americas and Europe will be back in sync -- meaning 8am PT/9am MT/11am ET will equate to 4pm UK/5pm Eur, and so on. Please let me know, and I'll put one of the two options in the calendar by tomorrow afternoon. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2017-03-23
by Eve Maler 23 Mar '17

23 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-23 MinutesRoll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2017-03-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-02>: Deferred. Logistics Can we move to a Wednesday time next week? Let's try. *AI:* Eve: Cancel next Tuesday's meeting (Mar 30) and propose a Wednesday (Mar 29) meeting time if possible. UMA V2.0 work Issue #292 <https://github.com/KantaraInitiative/wg-uma/issues/292>: Eve was concerned about potential scope collisions. But George points out that collisions would be bad in the context of a whole set of resources that a client would be dealing with, and Justin notes that in UMA, scopes are per resource anyway, and scopes can actually differ per resource. Consensus: No need to add a new "type" field for scope description documents. *AI:* Domenico: Create UMA2 version of the more detailed "UMA oval". Issue #294 <https://github.com/KantaraInitiative/wg-uma/issues/294>: This would be of interest to some folks. Prabath has mentioned RFC 7800 to Eve. Justin notes that it solves only a small part of the puzzle, and that the OAuth PoP architecture <https://datatracker.ietf.org/doc/draft-ietf-oauth-pop-architecture/> draft et al. aren't finalized yet and the WG seems to have no appetite to finish them and that token binding solves All The Problems. George agrees token binding is useful, but it's not very deployable; it just provides correlatability of the same SSL session. Mutual TLS with token binding approaches being equivalent. When you go beyond a two-party system, which OAuth and especially UMA are, then it gets wildly complicated. Justin recommends his book, chapter 15 especially, specifically page 296. [image: (smile)] He points to Hans Z.'s recent Token Binding writeup <https://hanszandbelt.wordpress.com/2017/03/23/token-binding-for-the-apache-…> . Right now, in UMA2, we have excised every mention of Bearer from Core. So in fact it might be possible for RPTs to make *automatic* use of PoP tokens. Can we find out? Could token binding be used with refresh tokens (presumably this still applies) and even PCTs? How can we find out? Is it worth stating the result of our investigations in the spec or in the UIG? PoP is done by the RS. Justin has implemented a way for the AS to hand the RS the JWK it needs to validate the JWT, but there's no official spec (among the plethora of PoP specs) for handing over this particular piece of metadata. So as far as people have gotten is to say, basically, "Use whatever means you have available to get this info – local or introspect etc." Not being a "P*P" architecture, the RS still "reserves the right to refuse service". The client is the one proving possession. (This is not SAML HoK, where it would be Bob proving possession.) Justin recommends his diagram on pages 385-386!) *AI:* Issue on rescinding access positively/downscoping: Eve to add. DONE. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Mike 3. Eve Non-voting participants: - Justin - Dean - George - Crina - Scott F - Jin Regrets: - John W - Sal *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-03-23 (last week of "summertime skew")
by Eve Maler 23 Mar '17

23 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-23 Date and Time - Thursdays, 9-10am PT (back to regular time slot, still in "summertime skew" this week) - Screenshare *AND* dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-03-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-09> - Logistics - UMA V2.0 work: - 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> / GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> (all issues to be kept here for the duration!) / dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - Core is up to 20 <https://docs.kantarainitiative.org/uma/wg/uma-core-2.0-20.html> and RReg is up to 06 <http://docs.kantarainitiative.org/uma/wg/oauth-resource-reg-2.0-07.html> (WG drafts) - See new issues - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2017-03-17
by Eve Maler 19 Mar '17

19 Mar '17

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2017-03-17 - Reviewing use cases doc <https://docs.google.com/document/d/1otArZxgjNKCCqnlqswxKqgJ_0TnJOjJ3IywVz2U…> Attending: Eve, Tim, Colin L, Adrian, John W, Ann Sal provided info on an event being held Mar 23 on Information Law <https://www.eventbrite.ie/e/information-law-2017-first-annual-conference-ti…>. We also discussed Jim H's Wise Contracts paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2925871>and Jane Winn's comments in another context (BSC). This is relevant to Tim's intended matrix regarding allocation of economic value. Adrian sent a link <https://link.springer.com/article/10.1007%2Fs12553-017-0179-1#Sec10> to the Google DeepMind problem with trust, through extreme lack of transparency and communication with overseers. Eve's "golden rule" is to tell business owners that they should treat personal information as a joint asset. John W tells them the business owns the record while the individual controls the information. Note that OAuth's use of "resource owner", and thus UMA's effectively means control of access (to some extent/scope of access). Adrian "is alone in using" the definition of ownership where you can delete it. We've stayed away from "owning" terms so far for all these reasons, except at the technical level. Tim is listening for device connectivity, issues of content, and issues of context. For example, how to prove the connection of a device to a responsible mind? Eve points to a particular OAuth grant flow called OAuth Device Flow <https://tools.ietf.org/html/draft-ietf-oauth-device-flow> that helps to bind a device to a person and their account, which could help in an UMA context. Should we include a connected car use case? Here's an example <https://www.youtube.com/watch?v=8UFMJo9P_Fo&feature=youtu.be> we could potentially use. Regarding the distinction about the legal bases for collecting and using data (and also for presenting interfaces and granting access beyond just "collecting and using data", keeping in mind that UMA can protect any API – think "resource controller" vs. just "data controller"), is this exactly the bright line that lets us say that this lets the resource server be a "resource owner" for those resources that it doesn't give Alice the rights to control access to? This may be tautological because UMA has a notion of enterprise ROs anyway. Bridging terminology thoughts: - From resource server to resource server operator to resource controller to data controller???? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 3

GDPR lawful processing graphic
by John Wunderlich 17 Mar '17

17 Mar '17

John Wunderlich, BA, MBA IAPP Fellow of Information Privacy CISA, CIPM, CIPP/C, PbD Ambassador @PrivacyCDN <https://twitter.com/PrivacyCDN> & Privacist -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Can't make the call today
by John Wunderlich 16 Mar '17

16 Mar '17

John Wunderlich, BA, MBA IAPP Fellow of Information Privacy CISA, CIPM, CIPP/C, PbD Ambassador @PrivacyCDN <https://twitter.com/PrivacyCDN> & Privacist -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Upcoming meetings (spoiler alert: no WG call tomorrow)
by Eve Maler 15 Mar '17

15 Mar '17

Let's take a breather from the whole-WG meetings this week, and not meet tomorrow. Instead, All interested to review/test/provide feedback can be doing so at any time. Also, there are auxiliary deliverables we can be fleshing out: - Mike S has an action to kick off some kind of "UMA-enabling an OAuth client" writeup (and/or code?). - I'm hoping to start the proper draft release notes. - If those who have contributed to the Wikipedia entry (in various languages) in the past are willing, it's probably time for some updates. - Justin and Sarah, I've been wondering if it's appropriate to list or link to the HEART use cases from the Case Studies page or similar. Any thoughts? - Is there someone who is interested to take a look at the FAQ and other similar pages to see what else is rusty? The Legal call is on for this Friday. As far as I know right now, both meetings will be on at the regular times next week (for 60 minutes each). It would be great to finish reviewing the legal use cases doc by next week, since we'll be expecting deliverable #2 not long after. I'm unavailable on Thursday March 30 and Friday April 1; I'll be canceling those calls. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

WG last call for the UMA2 specs: please get the word out
by Eve Maler 15 Mar '17

15 Mar '17

Thanks to the ministrations of the Kantara marketing folks, there's a new blog post up here <https://kantarainitiative.org/user-managed-access-group-takes-last-call-loo…>, and it's been tweeted here <https://twitter.com/UMAWG/status/842000948071292929> and FB'd here <https://www.facebook.com/UserManagedAccess/>. Please help spread the word! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0