- WG-UMA - mailman.kantarainitiative.org

G2C attribute sharing use cases / OIX workshop event in London on May 5
by Eve Maler 25 Apr '16

25 Apr '16

Though the WG isn't meeting formally for a little while, we do always look for events where we can gather in person when possible, and another potential one has arisen. For those of you interested in attribute sharing use cases and where UMA might come into the picture, particularly in a government-to-citizen context, this is be one of the topics we'll explore at an OIX workshop on May 5th in London (that's just a couple of weeks from now): https://www.eventbrite.co.uk/e/oix-workshop-5th-may-2016-hosted-by-barclays… For some background on the motivations, you can check out this article: http://www.ukauthority.com/UKA-Local-Digital/Entry/5958/local-and-central-g… If you think you'll be there, let me know! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: User-Managed Communications
by Mike Schwartz 21 Apr '16

21 Apr '16

Interesting ideas and comments from Igor Zboran -------- Original Message -------- Subject: User-Managed Communications Date: 2016-04-20 15:02 From: "Igor Zboran" <izboran(a)gmail.com> To: <mike(a)gluu.org> Hello Mike, It has been a while since I was active on the UMA WG. Most recently, I worked as a solutions architect on Privacy Box project for one big customer Orange SK, which is a Slovak mobile network operator. Privacy Box is a secure data storage built on the top of the Identity-Based Privacy [1] trusted model. During my work I was trying to evangelize OAuth2/UMA all the time but without any significant success. It was rather disappointing for me. Gradually, I've realized that there is a marketplace for User-Managed THIS AND THAT built on the top of the OAuth2 protocol. Getting it understood I've started to look at the UMA from a wider perspective. Then the idea of User-Managed Communications (UMC) Platform came up. It is a platform that brings together people, processes, data, and things in an intelligent, manageable and secure manner. You can find the basic info here: https://token7.com [2]. From my point of view, the most valuable UMC Platform feature is the federation support. You can find more info here: https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… [3]. Just imagine it - with UMC Platform anybody can be a 'communications provider' on their own. Not for voice services but for various Internet of Everything services. Feel free to ask me anything if you are interested in UMC Platform. For the time being I prefer written communication because I am not fluent in spoken English. Best regards, Igor Zboran Solutions Architect Links: ------ [1] https://igi64.github.io/ibp.html [2] https://token7.com [3] https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… -- ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Draft minutes of UMA telecon 2016-04-14
by Eve Maler 21 Apr '16

21 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31>: They're approved. Wide ecosystem *Adrian's solution proposal* Alice has to have exactly one AS, and it has to work in a partitioned manner, such that Bob, the AS, and the RS have to work in a situation where they're on the same LAN with no Internet connectivity; this is required for #wideeco. Alice's AS has to be able to handle a client of Bob's if it's a web browser. Why the limited connectivity? Because if Alice decides that her AS wants to be on her phone vs. in the cloud, it may need to survive this lack of connectivity. Sal comments: The widest possible ecosystem would include examples of this, and there is some IoT that has this requirement, but this is not necessarily the best test of solutions for #wideeco. Eve wonders if we should be modularizing our problem space vs. bundling this challenge into #wideeco vs. in #IoT. Kathleen asks if this makes the ecosystem narrow vs. wide. What is the relationship between limited connectivity and the notion that Alice should ideally have exactly one AS? If the AS is "always on", then it would seem to be able to fulfill the needs of the other two components. If it has limited connectivity, then it would have problems whether Alice has one or more than one. Eve's solution proposal Alice's AS dynamically gets client credentials to Bob's claim sources. Lots of people have independently come up with this. In fact, MitreID Connect implements it. It's WebFinger-enabled. There's a constraint on the need to be in a canonical domain. (More notes may be coming from Sal.) Attendees As of 13 Apr 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Kathleen 3. Sal 4. Andi 5. Eve 6. Mike 7. Sarah Non-voting participants: - Scott - Justin - Adrian - Jin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

[legal] No legal subgroup call this Friday after all
by Eve Maler 21 Apr '16

21 Apr '16

Sorry for the almost-late notice, but it seemed appropriate to cancel Friday's call as I won't have a chance to do any model text edits tomorrow because I'll be unavoidably offline all day, and I know Jim H. is really slammed with lots of other things. We do have a fair amount of model text progress to share at IIW (again, let's please meet near the barista early on Day 1 to discuss how to go about this), so let's do that. Thanks, *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-15
by Eve Maler 20 Apr '16

20 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-15 - Grantee and Resource definitions; how to handle role stacking (Grantor can be Resource Subject, RSO can be ASO, etc.) – handle in a generic way? (see this thread <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/%5Bleg…> ) - (Based on input from Scott D.) RSO - ASO model clauses (original proposal <https://kantarainitiative.org/confluence/Newly%20revised%20versions%20of%20…> ): - How to parameterize to enable different legal models for handling the granting of "access"? - How to identify/parameterize to enable exceptions to normal access/non-access? (see decision tree <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> ) - How to handle notification requirements? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Avoiding huge holes in our WG meeting schedule
by Eve Maler 20 Apr '16

20 Apr '16

To smooth out our meeting schedule a bit, I'm hoping we can add a couple of non-Thursday meeting times to make up for missed meetings. Rather than a heavyweight process, I'm going to propose a few particular dates/times that work for me, and ask for private responses back from those people who tend to attend. Week of Apr 18: WG call Apr 21 canceled due to Eve absence (still have a legal call Apr 22) - How about meeting *Wed Apr 20 9am PT*? (usual hour for WG calls, one day earlier) - Topic: Justin's #wideeco (and #IoT and #simplify and...?) solution proposal Week of Apr 25: WG call Apr 28 canceled due to IIW (still have a legal call Apr 29) - No replacement meeting Week of May 2: WG call May 5 canceled due to Eve absence - Legal call May 6 may be canceled as well due to Eve absence - But if not, would *Fri May 6 9am PT* make a good substitute for a WG call? - Likely topic: more #wideeco, likely still Justin's proposal Week of May 9: WG call May 12 canceled due to EIC (legal call May 10 also canceled) - No replacement meeting Rest of May: Back to regular meetings Thanks in advance. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Interested in 20% off IIW tickets?
by Eve Maler 19 Apr '16

19 Apr '16

Kantara is a sponsor, and there are some discounted passes available with this link! https://iiw22.eventbrite.com/?discount=KANTARA_XXII_20 *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Shared Door Challenge - Was: Asking #wideeco "solution champions" to prepare to present their ideas at upcoming WG calls
by Adrian Gropper 14 Apr '16

14 Apr '16

Here's how a shared door lock would work today: Step 1: Bob approaches the shared door and sees a sign telling him how to access the building directory 2: Bob connects his phone to the local wi-fi access point 3: Bob types the URL of the building directory into his browser - the door lock RS serves up a directory page 4: Bob clicks Alice's link in the RS directory page - is redirected to Alice's AS 5: Alice's AS challenges Bob somehow - it could be that Bob has to enter his cell phone number, or open a WebRTC call with Alice - whatever 6: Alice thinks up an access PIN for Bob - enters Bob's cell phone number and PIN into her AS 7: Alice tells Bob the PIN - however she does that 8: Bob enters the cell phone number and PIN into the AS 9: The RS opens the door Case A (LAN only): The sequence above mirrors what happens today when Bob talks to Alice and is "buzzed-in". The only difference is that Alice must sign-in to her AS to enter a phone number and PIN and Bob must enter the same two things into the AS. This is not a great user experience but it is needed because we took away the proprietary buzzer connecting Alice to the lock. The benefit is that Alice can decide when Bob's PIN must expire. Case B: Add a WAN connection and an IDP that might or might not be trusted. Alice's AS asks Bob for his IDP and name https://onename.com/agropper . Alice's AS either accepts Bob's attributes automatically or it sends a text message to Alice with the link. Alice replies to the text message with yes and an optional expiration date. I'm not sure what the challenge analysis document is. Adrian On Sunday, April 10, 2016, Eve Maler <eve(a)xmlgrrl.com> wrote: > Adrian, so far this looks like a use case (and an interesting IoT use case > at that) -- but not quite a solution description, in that we don't know if > it actually resolves #wideeco problems we've identified. E.g., the > mechanism of providing claims works great in narrow and medium ecosystems > already, but it seems to break down in wide ecosystems for various reasons. > > Can you please start a new thread, and also be sure to describe which > challenges in the challenge analysis document (and/or any other new > challenges not previously discussed) your solution purports to solve? It's > perhaps also worth noting that there are smart door looks and doorbell > products on the market, if not ones with UMA capabilities; can we learn > from what they do now? > > (We'll probably want a new thread per solution area.) > > > > *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl > > > On Sat, Apr 9, 2016 at 2:07 PM, Adrian Gropper <agropper(a)healthurl.com> > wrote: > >> AI for discussion: Different patterns of Alice's AS and RS's accepting >> and providing federated logins? (Adrian) >> >> I would like to champion a #wideeco solution called "A Lock to Alice's >> Shared Door" as follows: >> >> - The RS is an IoT lock on the shared door of a multi-unit condo. >> - The lock has to work even if disconnected from the internet. >> - Alice has her own AS in her own condo. >> - Alice has to be able to unlock the shared door even if disconnected >> from the internet. >> - Alice carries a smartphone that can connect to the RS and AS >> locally and via the internet. >> - Bob is a guest that wants to access the shared door based on >> Alice's AS policies. >> - Bob carries a smartphone that can connect to the RS and AS locally >> and via the internet. >> - The shared door RS and Alice's AS are each built on standard >> commodities that include a typical secure element. >> - e.g.: https://www.arduino.cc/en/Main/ArduinoMKR1000 including >> http://www.atmel.com/products/security-ics/cryptoauthentication/ecc-256.aspx >> - Bob can present claims to Alice's AS: >> 1. by referencing a personal certificate previously stored in the >> AS (e.g.: using PGP, a FIDO key, or equivalent) >> 2. by contacting Alice out-of-band for a one-time credential into >> her AS >> 3. by authenticating to the RS (assuming the RS has been >> configured as an IdP and is trusted by the AS) >> 4. by authenticating to an IdP (assuming the internet is working >> and the IdP is trusted by the AS) >> 5. by authenticating to a blockchain persona like >> https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-browser-b133a83fe… >> this could involve a camera and face recognition as in >> http://www.planetbiometrics.com/article-details/i/4238/desc/google-triallin… >> 6. by following a claims gathering process directed by Alice's AS >> >> I believe these 6 are the only distinct categories and I would hope that >> Alice's AS supports all of them if Alice is willing to take the time to >> configure them. Within each category, there will be various user >> experiences depending on what kind of technology Bob has in his pocket. >> >> Adrian >> >> On Fri, Apr 8, 2016 at 4:40 PM, Eve Maler <eve(a)xmlgrrl.com> wrote: >> >>> I've also done a little bit of suggested reordering of the roadmap >>> <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> >>> priorities to account for the appearance of so many use case buckets in the >>> first bullet in the list, and other realities; please see what you think. >>> Essentially, we can't really consider Justin's proposals for #wideeco >>> without also considering their #simplify impact, and some of their #IoT >>> impact, but some other #IoT analysis will have to wait a bit longer. Also, >>> we don't have any #security work on our docket at the moment, but more >>> could arise at any time, and there's some constant legal-subgroup work >>> being done. Etc. >>> >>> Oh, and I've put the named people who I hope will take on action items >>> directly on the cc list this time, to draw their attention to my request. >>> >>> Happy Friday! :-) >>> >>> >>> >>> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>> >>> >>> On Fri, Apr 8, 2016 at 9:52 AM, Eve Maler <eve(a)xmlgrrl.com> wrote: >>> >>>> Hi all-- The agenda for our call yesterday tried to summarize what I >>>> think is the most up-to-date list of ideas I've heard so far: >>>> >>>> >>>> - Examining solutions for wide ecosystem challenges (Eve's >>>> challenge analysis doc >>>> <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – >>>> look at: >>>> - UMA-protected UserInfo? (various) *[Mike]* >>>> - Different patterns of Alice's AS and RS's accepting and >>>> providing federated logins? (Adrian) >>>> - "Multi-party" proposal? (Justin) (engages with #APIsec and >>>> #simplify use case buckets too) *[also #IoT as discussed on >>>> Thursday]* >>>> - AS requests claims and client does act_as Bob to send them? >>>> (Mike, James) >>>> - Alice's AS dynamically gets client credentials to Bob's claim >>>> sources? (various) *[Eve]* >>>> - Meta-suggestion: Should trust elevation methods be >>>> modularized? (James) >>>> - Others? >>>> >>>> >>>> Can the people identified above please take action items to present at >>>> upcoming calls? If you're not clear on what this is about, or if you can't >>>> do this action, please let me know. Thanks! >>>> >>>> And remember, we've got some upcoming "holes" in our Q2 WG meeting >>>> schedule. I've just deleted some of our Thursday meetings (Fridays haven't >>>> been impacted yet), with possibly a couple more to come. We've got some >>>> exciting work coming up, so let's try to press ahead with offline prep such >>>> as this. >>>> >>>> >>>> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>>> >>>> >>> >> >> >> -- >> >> Adrian Gropper MD >> >> PROTECT YOUR FUTURE - RESTORE Health Privacy! >> HELP us fight for the right to control personal health data. >> DONATE: http://patientprivacyrights.org/donate-2/ >> > >

3 4

Agenda for UMA telecon 2016-04-14
by Eve Maler 13 Apr '16

13 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14 Date and Time - *Thu Apr 14,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31> - Solution proposals against wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – today's solution proposals include: - Alice's AS dynamically gets client credentials to Bob's claim sources (Eve) - Different patterns of Alice's AS and RS's accepting and providing federated logins (Adrian) - (Adding a new solution proposal to the list for a future meeting: Sourcing Bob's claims from a distributed ledger (champion?)) - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

[legal] Use cases and design patterns for resource owner/Grantor/Resource Subject
by Eve Maler 13 Apr '16

13 Apr '16

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3