- WG-UMA - mailman.kantarainitiative.org

[legal] Use cases and design patterns for resource owner/Grantor/Resource Subject
by Eve Maler 12 Apr '16

12 Apr '16

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

[legal] Newly revised versions of RSO - ASO model clauses, with questions/commentary
by Eve Maler 12 Apr '16

12 Apr '16

We agreed to start with the RSO - ASO trust relationship because it's most "upstream" and has no dependencies. It also turns out to be one of the most simple, at least in terms of previously brainstormed obligations/clauses. Below, I've taken the original obligations/duties and revised and commented on them given recent conversations. Let's discuss tomorrow. ==== *Condition applying to all:* For the period that the {Resource_Server_Operator} and {Authorization_Server_Operator} have mutually agreed to serve in these respective roles for each other… *Candidate duty A.* “RSO-Register-Accurately-and-Timely” …the RSO gains an obligation to the ASO to register resource set descriptions accurately and timely. Q A1. Do we have to qualify the wording above any further (given that we haven’t reached “Resource Subject/Grantor mention stage” yet) to talk about which resource set descriptions need to be registered? Note that there is no obligation for any RS to give any Grantor a choice about which resources to put under/take out of AS protection etc. It’s actually totally up to the RS. *Candidate duty B.* “RSO-Respect-Permissions” …the RSO gains an obligation to the ASO to respect the permissions that the AS associates with “bearer”-type RPTs when such RPTs are later borne to the RS by Clients. Q B1. This gets to the heart of our #RSctrl issue, as represented by the decision tree in these January meeting notes <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…>. Do we need to rejigger this so that it is a) finer-grained and/or b) per-Resource Subject or on a case-by-case basis vs. per-ASO? Note that this a matter for ASO liability, as much as for Resource Subject concern, so this trust relationship does need to bear some of the weight. Much work to do here! Q B2. The “bearer”-type token profile is mentioned specifically because each token profile comes with its own distribution of policy decision-making responsibility between RS and AS. Does this make sense? *Candidate duty C.* “ASO-Elevate-Trust-Accurately” …the ASO gains an obligation to the RSO to perform trust elevation accurately and represent the results of trust elevation accurately in permissions in “bearer”-type RPTs. Q C1. This is the reciprocal liability duty that the ASO carries regarding the RSO. Does that make sense? ==== What other clauses might make sense to add? ==== The theory is that if we get the RSO - ASO clauses right, then these would all be prerequisite for the next two batches, Grantor - ASO and Grantor - RSO. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 5

$100 to support UMA
by Mike Schwartz 11 Apr '16

11 Apr '16

Please vote "YES" if you can contribute $100 to an UMA video being shot at IIW! http://gluu.co/iiw-uma-video-poll It would be great if we could get 15 people before Eve offers to contribute, because you all know how much she's done for this effort! - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Smart Contracts - Bridging the Gap Between the Real World and Blockchain - Blockchain News
by John Wunderlich 10 Apr '16

10 Apr '16

Saw this on another list, and thought some of you might be interested: http://www.the-blockchain.com/2016/04/06/smart-contracts-bridging-the-gap-b… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Asking #wideeco "solution champions" to prepare to present their ideas at upcoming WG calls
by Eve Maler 10 Apr '16

10 Apr '16

Hi all-- The agenda for our call yesterday tried to summarize what I think is the most up-to-date list of ideas I've heard so far: - Examining solutions for wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – look at: - UMA-protected UserInfo? (various) *[Mike]* - Different patterns of Alice's AS and RS's accepting and providing federated logins? (Adrian) - "Multi-party" proposal? (Justin) (engages with #APIsec and #simplify use case buckets too) *[also #IoT as discussed on Thursday]* - AS requests claims and client does act_as Bob to send them? (Mike, James) - Alice's AS dynamically gets client credentials to Bob's claim sources? (various) *[Eve]* - Meta-suggestion: Should trust elevation methods be modularized? (James) - Others? Can the people identified above please take action items to present at upcoming calls? If you're not clear on what this is about, or if you can't do this action, please let me know. Thanks! And remember, we've got some upcoming "holes" in our Q2 WG meeting schedule. I've just deleted some of our Thursday meetings (Fridays haven't been impacted yet), with possibly a couple more to come. We've got some exciting work coming up, so let's try to press ahead with offline prep such as this. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Notes from UMA legal telecon 2016-04-08
by Eve Maler 10 Apr '16

10 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-08 - Our budget request was accepted! Let's work out a timeline - Work on RSO - ASO model clauses more – can we get to "beta" quality today? - How are invitations to our April 15 meeting going? Attending: Eve, Andrew, Ann, Adrian, Mark, Kathleen Budget request accepted The Kantara board has asked us for a cash flow timeline. Eve's estimate was that we could develop our requirements by early Q3, say no later than July, and identify a contractor by early-mid Q3, and ideally conclude the project by the end of Q3 (Sep). This gives us a forcing function to have a credible set of beta model text to work with by Q2. We seem to be able to accept this, even though there are some question marks. AI: Eve: Reach out to our community of "legal eagle" participants to wake up active participation once again. Realistic first beta review timelines Is it realistic to invite anyone to our Apr 15 call? Are we ready with text? There are two parts to this: Can external parties attend, and do we have enough text/materials? Adrian proposes that Kathleen is on the critical path here. Kathleen just wants to run a FHIR pilot based on our clauses! And doesn't see Andrew's use case as incompatible. What's most practical? Kathleen suggests that getting to the point of real clauses is really the most practical. Let's work hard to continue putting our model clauses together, and reassess just before the IIW timeframe as well as think about a June forum for external review. Model definition and clause work The FHIR connectathon is in May. She would like to "XMLize" the clauses for that target. What actual language is being executed here (since XML is just the "punctuation", if you will), if FHIR has a place in the code for a Grantor etc.? It sounds like they are using UMA authorization servers to consume standardized policy expressions in XML (if not necessarily XACML) format, and this would map to the Grantor's wishes for sharing. This could come down to a particular set of trust relationships, and the question of whether it splits into "active" policies vs. things like consent receipts. Our Grantor - RqP (Grantee?) trust relationship already mentions consent receipts, and we've already discussed how CRs need to be part of a workflow that shows the Grantor what it is they're consenting to (or proactively sharing/delegating or whatever, i.e. setting a policy/sharing preference), so we could already be in the ballpark here. FHIR is using its audit logging framework for this workflow. Adrian had made a generic "NPE Release of Information Form 1" sample form <https://docs.google.com/forms/d/1A43_OrXPIe26IaE4AVBgaRR7wXacWIGXX36X1D1LHB…> a few months ago, and Kathleen observes that with a few additions this could be something like what FHIR needs. Adrian is intending this to be used by the RS/RSO for setting up phase 1 (that is perhaps a rathole for our purposes for today's agenda; Eve suggests that Adrian and Kathleen discuss offline as appropriate). Eve shared a slide deck <http://kantarainitiative.org/confluence/download/attachments/17760302/UMA%2…> that runs through various design patterns for splitting the technical resource subject and legal Grantee roles. This deck now has some explanation on the first slide about how the technical UMA flow can stay the same, while the trust relationships and legal/contractual backing might vary significantly. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

UMA Video at IIW in April?
by William Lowe 08 Apr '16

08 Apr '16

Hi UMA WG, A professional film crew will be at the the upcoming Internet Identity Workshop (http://www.internetidentityworkshop.com/) in April to film an IIW related video. They have extended the offer to shoot other "special interest" videos while they are there. There have been discussions about getting an UMA-centric video created. It would likely consist of interviews with UMAnitarians discussing the challenges UMA is helping solve, background on the problem, etc. It could be a nice marketing asset to have... The total cost to create the video would be $1,500. Mike Schwartz (mike(a)gluu.org) and I thought it might be something that UMA enthusiasts would want to crowdfund. We put together a poll to see who is interested in chipping in $100 to get the video created: http://www.gluu.co/iiw-uma-video-poll We (Gluu) provided the first answer of "yes" :) Google Forms doesn't allow me to see who has responded to the poll and how they responded, so if you are interested in contributing please fill in the second question on the form with your name, company (if applicable), and email address. If you are not interested in seeing a video created just leave that field blank. Let us know if you have any questions. And thanks in advance for your participation in the poll! Will -- ------------ William Lowe Gluu, Inc. 925.389.7426 http://gluu.org http://linkedin.com/in/whaven

1 0

Agenda for UMA legal telecon 2016-04-08 (would love to have good representation on the call tomorrow!)
by Eve Maler 08 Apr '16

08 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 2016-04-08 - Our budget request was accepted! Let's work out a timeline - Work on RSO - ASO model clauses more – can we get to "beta" quality today? - How are invitations to our April 15 meeting going? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2016-04-07
by Eve Maler 07 Apr '16

07 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 MinutesQ2 is conference season – meeting series to get some interruptions General logistics note: We meet next week, but not April 21 or 28. We'll also miss May 12 for EIC, and some random other Thursdays and Fridays; keep an eye on the online calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> and your inboxes if you subscribe. (Let Eve know if you want invitations.) Roll call Quorum was not reached. Approve minutes Deferred. UMA video Mike is motivated to put together a Doodle poll to see who's interested to throw $100 into a pot to jointly sponsor (as the UMA WG) a 1-minute video. "Why UMA" check-in Eve is waiting to hear from Pedro about a Red Hat case study. Wide ecosystem We reviewed the paragraph called "*The role of the AAT*" in the challenge analysis document. George notes that the AAT is supposed to be a tuple of Bob, the client, and the AS, but what is the "Bob" we're talking about here – what identity in particular are we talking about? Is it really true that Bob needs to create an account at the AS? It's not strictly true that an account is needed, in fact. Could it all just be transient? The AAT, at least, needs to live long enough for the client to use it when making RPT endpoint calls etc. Some AS's might have a business model that prefers creating lots of accounts, but others might not. Is "session" a better way to describe the AAT requirement than "account"? Alice says that "the entity that controls this identifier can do this thing with my resources". The canonical scenario's policy condition given in the document is roughly in identifier-based form (unless the email address in question is shared). Is there an identifier vs. authenticator distinction? How philosophical is this? How would any of Bob's claims get persisted across his sessions at a single AS if he wants access to multiple RS's, potentially for resources controlled by multiple RO's? (Note that regardless of these conditions, the persistence would still be tied to a single client; an AAT would be client-specific, being an OAuth access token.) Having an account at the AS doesn't make his claims any more fresh. If you look at different kinds of clients (mobile, IoT, etc.), Ishan suspects that since different AS's left to their own devices would have made different choices about an AAT, clients would prefer different choices themselves. But isn't an AAT tantamount to a session cookie? Yes, but they're not identical. A thermostat itself doesn't maintain a session itself; its gateway proxy does. Ishan notes that since data goes stale, the AS may always want to grab the latest data. It could evaluate a freshness metadata field, of course, but it's going to want to mitigate risk by grabbing the latest. *AI:* Eve: Add a #trust issue about liability for claim staleness. We agreed that the various solution possibilities for #wideeco may not be mutually exclusive, and also that we shouldn't nail down final choices of solutions till we analyze additional relevant use case buckets in our roadmap. We'll ask champions for the various solutions to present in future weeks. The challenge document should now be open for everyone to comment (you probably need to reload it). Here's more information about the IETF ACE group and its documents <https://datatracker.ietf.org/wg/ace/documents/>. See also this older (now-expired) spec <https://tools.ietf.org/html/draft-maler-ace-oauth-uma-00> about ACE for OAuth and UMA. Attendees As of 20 Feb 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah, Ran) 1. Kathleen 2. Robert 3. Eve 4. Mike Non-voting participants: - Andrew - Adrian - George - Ishan *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-04-06
by Eve Maler 06 Apr '16

06 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-07 Date and Time - *Thu Apr 7,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31> - IIW roundup - UMA video opportunity - Session ideas and plans - "Why UMA" check-in - Content and case study progress - Examining solutions for wide ecosystem challenges (Eve's challenge analysis doc <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>) – look at: - UMA-protected UserInfo? (various) - Different patterns of Alice's AS and RS's accepting and providing federated logins? (Adrian) - "Multi-party" proposal? (Justin) (engages with #APIsec and #simplify use case buckets too) - AS requests claims and client does act_as Bob to send them? (Mike, James) - Alice's AS dynamically gets client credentials to Bob's claim sources? (various) - Meta-suggestion: Should trust elevation methods be modularized? (James) - Others? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0