- WG-UMA - mailman.kantarainitiative.org

[legal] New thoughts on "Grantee" vs. "Requesting Party"
by Eve Maler 03 Apr '16

03 Apr '16

After doing a bunch of somewhat related work having to do with consent, and working with the word Grantee in the "requesting party" slot, I came to really appreciate it for its brevity, and believe that it could suffice for our model definition purposes. The definition might turn into something like this. Thoughts? A {Person} to whom a {Grantor} may grant access to a digital data resource, and who, if granted access, uses a {Client} to achieve that access. In any one case a {Grantee} may be the same as, or different from, the {Grantor} or {Resource Subject}. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 5

[legal] Please invite your favorite external legal reviewer to our April 15 session
by Eve Maler 01 Apr '16

01 Apr '16

In our call today, we said we'd invite external reviewers to our April 15 session and show them our model text work. Please spread the word. - You can point them to this page: http://tinyurl.com/umalegal - Our dial-in information is here: http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes - Do please let them know that they will be invited guests for this one call only, and if they would like to attend on an ongoing basis, they are encouraged to join as participants; see details on the first link above. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes of UMA legal telecon 2016-04-01
by Eve Maler 01 Apr '16

01 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-01 - Work on RSO - ASO model clauses - Decide external review strategy Attending: Eve, Andrew, Adrian, Kathleen, Thomas, Jim We discussed the candidate model clauses for RSO - ASO. What is a resource set description vs. a scope description vs. a resource vs. a scope etc.? Should we be really specific, the way a technical spec – or legal document – would expect, and define every little term? A resource set description being registered is a set of metadata about an *actual* digital data resource of Alice's that is being put under the AS's protection (in other words, the data itself is not uploaded), and the scope description(s) that are part of that metadata are descriptors of the *potential* extents of access that are possible to be performed over that resource – not *actual* entitlements that some requesting party has "won". One metaphor is that a resource set is a "noun" and a scope is a "verb" (among some set of verbs) that is possible as an action on that noun. Another metaphor is that the scopes are the definition of the contract, or interface, for that resource. In effect, the scopes define the "API" for the resource. Note that since RS gets to choose how to split up its design of resources and scopes, and the design line between them is moveable. subj - verb - object (crude representation of an authorization policy) RO - RSO - RSO (who's authoritative for each piece) ASO (authoritative for executing the whole thing) Adrian's concept of "I split, you choose" means that the RSO gets to be authoritative for that digital data resources and the APIs presented for exposing them. UMA has innovated around enabling the RS outsourcing the function of letting the RO be authoritative for associating the "verb and object" part of a policy with the desired subject, and then letting the AS execute the RO's wishes. This is through a combination of resource set registration and then the rest of the UMA flow. Do we have a chicken/egg problem in terms of the relationships? What if there are two independent relationship streams leading up to the three-way PAT relationship? - Trust relationship 1: Grantor - RSO (no technical artifact) - Trust relationship 2: Grantor - ASO (no technical artifact) - Trust relationship 3: RSO - ASO (technical artifact is OAuth client credentials for the RS) - Trust relationship 4, dependent on the previous three: Grantor - RSO - ASO (technical artifact is a PAT, carrying user consent) (The numbers where there are no preconditions are arbitrary – they're just for easy reference.) There may be cases where the conditions are variable. Eve was concerned about our two-party "atomic" approach previously because a PAT inherently has three entities involved, and it naturally maps to three parties; likewise, an AAT. Her suspicion is that some of our duties may have to "go there" in mentioning three parties, and that this isn't a variable thing: the clauses will have to do that. Adrian asks: Is it valuable for trust relationships 3 and 4 to have different model clauses? In other words, would the RSO and ASO ever want to contract with each other separate from the context of any specific individual? Eve made the case that some sort of blanket protection against liability, in both directions, makes sense regardless of the particular resource owner. Kathleen mentions market forces as pressuring ASOs and RSOs variously on this point. Also, regarding #ROctrl, that's going to have to be fought out in trust relationship #1, not trust relationship #3; the ASO is more likely going to want to say "Listen, I'm going to put stuff in the token, and if you do something else, I wash my hands of you." Regarding external review, Andrew would like to point some DIACC members to our model definitions. *AI:* Everyone: Reach out to external reviewers and offer to hold a live review session on Apr 15 and see who can attend. Eve to send a reminder of what this is all about in email. Let's also plan a live review at IIW, by which time we'll have more model text. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-01
by Eve Maler 01 Apr '16

01 Apr '16

http://kantarainitiative.org/confluence/pages/editpage.action?pageId=773001… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-01 - Work on RSO - ASO model clauses [stay tuned for drafts!] - Decide external review strategy *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2016-03-31
by Eve Maler 31 Mar '16

31 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31 MinutesRoll call Quorum was reached. AI: Eve: Check the rolls and reach out to Ran at a minimum. Approve minutes tbs Publication of new spec The extension spec is here <https://docs.kantarainitiative.org/uma/draft-uma-claims-sec-ext-v1_0.html> (versioned) and here <https://docs.kantarainitiative.org/uma/draft-uma-claims-sec-ext.html> (symbolic link to "latest draft"). Wide ecosystem analyses and solution proposals Let's try and analyze the problem space thoroughly enough to collect solutions and match them all up. Eve presented a new document, UMA wide ecosystem challenge analysis <https://docs.google.com/document/d/1lJXDFzlq8j-m0f8mELjqYcX6PPcYSjOuxiGHzwU…>, that walks through thoughts on how trust elevation will likely be done in narrow, medium, and wide ecosystems and what the practical challenges are with the latter. We looked at Domenico's excellent diagram (produced in 2011!). We worked on "trusted claims" a lot in the past; it falls in an area that could be broader than UMA's scope, meaning that others might find it interesting to work on and use as well, so we had put it aside. The diagram shows, roughly, a kind of "UMA-protected requesting party claims" picture. Mike observes that having the "OpenID Connect AS" entity request a token from the "resource owner's AS" might be another solution. Adrian asks: Is a certificate helpful for solving this problem? A policy condition could require Bob to authenticate strongly in a certificate-based way. We're not sure this particular type of policy is relevant to the wide ecosystem question. Mike notes: "Not to be overly negative... but the wide ecosystem use case is really a long shot for adoption. Its really hard to get network economies of scale." Adrian has previously talked about how an AS could usefully accept federated logins by its ROs from an RS. The medium ecosystem diagram shows a similar example, only on the client side – the AS accepts federated logins from the identity ecosystem of the service that the client participates in. Justin describes FHIR as a common/universal API that should be heading to universal acceptability, and thus ultimately totally open acceptability for, say, every conforming client. The current world is more like static onboarding, a la Microsoft HealthVault <https://account.healthvault.com/us/en-US/Directory> with its ~400 clients. Adrian says the Mass. Medical Society is looking at such a thing, but there's no evidence of any move to support the wide ecosystem approach yet, despite a strong wish by some for this type of disintermediation. The example of a Volvo app that unlocks the engine shows that you may also want to grant access to a friend or family member. This is a valet key for real. [image: (smile)] Attendees As of 20 Feb 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah, Ran) 1. Domenico 2. Kathleen 3. Andi 4. Maciej 5. Eve 6. Mike 7. Sarah Non-voting participants: - Mary - Jin - Mark - Adrian - James - Scott - Justin Regrets: - Sal - Robert *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-03-31
by Eve Maler 31 Mar '16

31 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31 Date and Time - *Thu Mar 31,* 9-10am PT (*N.B.:* SUMMERTIME SKEW IS REALLY OVER THIS TIME) - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Publication of new spec - Approve minutes of UMA telecon 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> - Wide ecosystem analyses and solution proposals - Roadmap checkin - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Oauth2 to UMA material
by Arlene Mordeno 28 Mar '16

28 Mar '16

Hello, Would anyone have any material on how an enterprise can transition from using Oauth into UMA, say a year from now? I am looking for infrastructure considerations when doing an enterprise IAM strategy. Thanks, Arlene

3 3

Notes from UMA legal telecon 2016-03-25
by Eve Maler 26 Mar '16

26 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-03-25 - Review current set of model definitions - Choose first trust relationship to work on for model clauses - Identify any model definition areas that need work given our choice - Decide/confirm our plan for first round of external review Attending: Eve, Paul, Kathleen, Adrian, Jon N, Ann, Jim We reviewed our model text <http://www.commonaccord.org/index.php?action=list&file=GH/KantaraInitiative…> with model definitions <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>, with recent changes. What's the deal with the "D word" – delegation? If we qualify "delegation of *what*", then we can observe that there are several types, and we can map them to different trust relationships we have identified: - Resource Subject - Grantor (not in scope): This enables a "resource owner" to find someone else to actively manage resource access for them at an AS. - Grantor - ASO: This enables an always-on AS to be available to execute the wishes (policy conditions) of the Grantor. - RqP - Client Operator (not in scope; also not previously discussed as a model definition...) - Grantor - RqP Discussion about Grantor - RqP: Adrian doesn't think this is an appropriate use of the word "delegation". Eve believes "that train has sailed". [image: (smile)] See, e.g., the NZ POC <http://kantarainitiative.org/confluence/display/uma/Case+Study%3A+Users+Man…> . Regarding Adrian likes the distinction of "If you have a privacy policy, then there's an Operator involved; if you don't have a privacy policy, then you own it/wrote it." (It's personal to you and there's a 1:1 relationship between you and the software/service.) We have a new party with responsibilities now in scope! It's the Client Operator. Also, we're likely going to have to change references in the bodies of various model clauses from the Grantor to the Resource Subject, since the duty will be owed to the Resource Subject instead in a lot of cases. Which trust relationship should we dig into first? For reasons of our #RSctrl/#ROctrl use case <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> tension, and because it's the most "upstream" (no dependencies) trust relationship, let's start from RSO - ASO (see the clauses that start ASO... here <http://www.commonaccord.org/index.php?action=list&file=GH/KantaraInitiative…> and the clause that starts with RSO here <http://www.commonaccord.org/index.php?action=list&file=GH/KantaraInitiative…> – however, these are old and almost certainly don't reflect our latest discussion). There's a use case that could help us interestingly when we get to working on Resource Subject- and Grantor-involved model clauses, but will need to take into account some out-of-band machinations because it engages precisely the Resource Subject - Grantor relationship: a "digital death" use case. Alice (as her own Grantor) shares some digital data resources with Bob. She wants to arrange for her lawyer to become her Grantor when she dies, so that Bob can continue to get access to those resources. In practice, because of what are known (really) as "time-to-live" strategies around credentials, tokens, and permissions inside tokens, the access that Bob enjoys to those resources is certain to get cut off at some point after Alice dies. Using a combination of business, legal, and (non-UMA – including digital contract) technical approaches, Alice's lawyer can replace Alice as the owner of those resources and ensure through the AS that Bob's access can continue or be restarted. *AI:* Jim and Eve: Extract the two-party reworkings of the old model clauses for at least RSO - ASO and prepare for group review next week. *AI:* Everyone: Think about and approach candidate external reviewers by next week. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 2

Agenda for UMA legal telecon 2016-03-25
by Eve Maler 25 Mar '16

25 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes 2016-03-25 - Review current set of model definitions - Choose first trust relationship to work on for model clauses - Identify any model definition areas that need work given our choice - Decide/confirm our plan for first round of external review *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 2

Draft minutes of UMA telecon 2016-03-24
by Eve Maler 25 Mar '16

25 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2016-03-17 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-17>: APPROVED. Issue 239 materials We agreed to remove "as the sole means of trust elevation" because SHOULD is the operative instruction regardless. Discussion of the new security considerations: We're not allowing both endpoints because it's a big mess to have to deal with "old" clients along with "new" clients. You'd have to flag clients in some fashion. So this section is something of a rationale for the endpoint swap. Eve suggested a slight wording change to give it this flavor. *MOTION:* Moved by Sarah. Seconded by Sal: Approve the "UMA Claims-Gathering Extension for Enhanced Security" specification, as to be amended, as a draft Technical Specification. APPROVED by unanimous consent. *AI:* Maciej and Eve (with Oliver): Publish the new extension spec. What to do with "progressing" this spec? Let's let it lie for now, and think about changes in "batch" with other 2016 roadmap work on the other specs. What sort of publicity should we do around this? Mention on wiki, on FB, etc. Talk about it at an UMA Update session at IIW? *AI:* Eve: Create an issue for the next minor rev of UMA (if there is one) to point back to the extension spec in some fashion and either deprecate it or absorb it, whatever is appropriate. Wide ecosystem We reviewed some previously discussed topics about wide ecosystem challenges. What value does the AAT bring? Based on current implementation and usage, it seems valuable for at least narrow and medium ecosystems, but in Justin's experimental work for wide ecosystem purposes he has done away with it entirely. Does a wide ecosystem actually require removing it if it turns out to be valuable for others? Sal points out that some IoT use cases also bring in special circumstances such as disconnection from the network. *AI:* Eve: Send wide ecosystem doc and graphics. Attendees As of 20 Feb 2016, quorum is 7 of 12. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah, Ran) 1. Domenico 2. Kathleen 3. Sal 4. Thomas 5. Maciej 6. Eve 7. Mike 8. Sarah Non-voting participants: - Adrian - Justin - Arlene - Jin - John *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0