- WG-UMA - mailman.kantarainitiative.org

The shape of UMA legal draft deliverables
by Eve Maler 10 Dec '15

10 Dec '15

Jim and I have been meeting frequently (Andrew and I a bit less so) and working on some homework to show y'all. Here is a description of the deliverables we're working on, which we'll be asking you to review -- and Andrew with his "business owner" hat on to review in more depth come January, if it passes muster in the group: - Model clauses for the various UMA role functions, both at a granular level and in the context of some templated agreements (think up-front "terms of service" in many cases) - Supported by all the necessary term definitions - As a sub-use case of this, templated "consent receipts" for a variety of cases when the party expecting some other party to function in an UMA role is themselves in an UMA Authorizing Party or UMA Requesting Party role - For example, instances where the Authorizing Party has created a policy for delating a right of access to a Requesting Party (there are others...) Some technical considerations of the CommonAccord (CmA) mechanism -- which we know our "first customer", Andrew, can't directly consume but will have to translate into something like MSFT Word for actual consumption -- that we would like to work on (but likely won't have ready immediately) include: - A round-trip CmA format<->JSON mapping - A lightweight mechanism for technical integrity, so that the web location where an entire agreement gets saved off to contains within its URL a hash of the agreement itself *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA legal subgroup telecon 2015-12-11 (penultimate meeting of the year!)
by Eve Maler 10 Dec '15

10 Dec '15

- *Fri Dec 11* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma /Calendar - Interest in a bit longer session this and/or next week? - Review of the list of draft deliverables to be produced (see forthcoming separate email) - Review of Jim/Eve's candidate text and structures - Status of our budget proposal - How to take our work forward? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Action requested: Getting out the vote just from among WG participants!
by Eve Maler 10 Dec '15

10 Dec '15

The following WG participants can directly help with GOTV activities by going to this link and filling out the survey (in the positive...): https://www.surveymonkey.com/r/737G5MJ *Colin* for the NZ DIA (or whoever your organization representative is, if you're not) *Allan* for ForgeRock *Ishan* for UnboundID (or whoever your company representative is, if you're not) *Sal* for himself *Andrew H* for himself *Mark L* for himself *Mike S* for himself Can you all please take this action and let me know when you have done so? Thank you! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2015-12-10
by Eve Maler 10 Dec '15

10 Dec '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-12-10 MinutesRoll call Quorum was not reached. Approve minutes Deferred Kantara All-Member Ballot is open till Dec 23 The staff is broadcasting the survey <https://www.surveymonkey.com/r/737G5MJ>, and making sure that any non-member who participates in the survey will be removed from the totals. It's great to do get-out-the-vote activities! The list of members <https://kantarainitiative.org/members/> is here. *AI:* Eve: Reach out to past and potential volunteers to contact Kantara members to ask them to vote in favor of passage. NZ case study availability Colin W has provided a version of the NZ Ministry of Education's Delegations POC closure report that can be published. Exciting stuff! Everyone is encouraged to read, discuss, and publicize the report. Adrian is currently working with the US government on delegation matters. He is looking into the question of delegation to the *agent* of a patient, in the form of the authorization server. The US feds have formed an API task force that is issuing recommendations next year (N.B.: not legal guidance). *AI:* Eve: Publish the NZ report on the Case Studies <http://kantarainitiative.org/confluence/display/uma/Case+Studies> page. Holiday greetings on the home page Thanks, Domenico! Status of budget request The board is considering all the requests as part of 2016 planning. They are considering time-sensitive ones first, and ours doesn't fall under this category. So we can expect news probably mid-January. The timeline we identified in the request would be pushed out accordingly. CIS and the UMA masterclass CIS is 6-9 June 2016 in New Orleans. The CfP is opening next week. Please pay attention and consider submitting. What were "workshops" are now "masterclasses". Eve has taken on the duty of delivering – or finding someone to deliver – an UMA masterclass. It's made of three 45-minute sections. *AI:* All: If anyone is interested to deliver the masterclass, drop Eve a note. Further discussion of IETF interest related to UMA (and I-D publishing interest?) Justin notes that the OAuth list hasn't seen any "API security/UMA/RSR" discussion since the Japan meeting. The cultural dynamic of IETF is to spend a lot of face time at meetings to see progress, and there may be a "spec penalty" in terms of incompatible changes. Mike would like to see UMA go to IETF because of IETF's larger community. Justin agrees with the size of community, but doesn't agree with moving UMA. Eve sees UMA's natural constituency more aligned with the Kantaras, OIDFs, and OIXes of the world. Is it a question of getting OAuth developers to "accept UMA"? If the current WG works, then Justin suggests: Keep it where it is! Then perhaps the only question is about the expired I-Ds. Eve asked Hannes about Justin's innovative solution to that (switch the I-Ds to information, remove the content, and replace it with links out to the current content). *AI:* Editors: Refresh the I-Ds (at least the two technical specs and not Binding Obs?) with Justin's innovative solution. Permission registration extension spec review and discussion We need to rev this up again. Kick off roadmap and charter refresh discussions Our current charter is here <http://kantarainitiative.org/confluence/display/uma/Charter>. We know that use cases of interest include: - Local token introspection (interesting for IoT and more) - Permission registration extension - Wide ecosystems and how the AAT and identity claims tie in - (Add your own in the coming weeks) Let's also pump up the UIG. *AI:* Eve: Extend the meeting calendar invitations through 2016. Attendees As of 9 Dec 2015, quorum is 8 of 14. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Søren, Sourav, Lisa, Arlene, Mike) 1. Eve 2. Andi 3. Domenico 4. Maciej 5. Mike 6. Sal Non-voting participants: - Katie - Sarah - Adrian - Justin - Joni - John - Ishan - Jin Regrets: - Arlene - James *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2015-12-10
by Eve Maler 09 Dec '15

09 Dec '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-12-10 Date and Time - *Thu Dec 10,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2015-09-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-09-24> and UMA telecon 2015-11-05 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-05> - Holiday greetings on the home page - Kantara All-Member Ballot is open till Dec 23 - GOTV activities - Status of budget request - Further discussion of IETF interest related to UMA (and I-D publishing interest?) - Permission registration extension spec review and discussion - Kick off roadmap and charter refresh discussions - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: APAC-friendly UMA sync 2015-12-10
by Eve Maler 08 Dec '15

08 Dec '15

- *Thu Dec 10* at APAC-friendly times - Voice: Skype: +99051000000481, room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-12-09): http://kantarainitiative.org/confluence/display/uma/Calendar If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Thoughts on model clauses that describes proper functions of parties serving in UMA roles
by Eve Maler 08 Dec '15

08 Dec '15

The Binding Obligations <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> draft factors out descriptions of such functions first according to the party serving in the role and then according to the party to whom those functions are “owed”. For example, Section 2.4 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor16> contains the “obligations” of the Authorization Server Operator (the party operating the software service that performs the function of the UMA authorization server); Section 2.4.1 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor17> contains an “obligation” to the Authorizing Party (the party corresponding to the UMA resource owner), Section 2.4.2 <https://docs.kantarainitiative.org/uma/draft-uma-trust.html#anchor18> contains an “obligation” to the Resource Server Operator (an party operating a software service that performs the function of an UMA resource server), and so on. If you look in Sec 2.4.1, you’ll see text like this: “When the Authorization Server issues a PAT to the Resource Server and as long as the PAT is valid, the Authorization Server Operator gains an obligation to the Authorizing Party to adhere to the Authorizing Party's policies accurately and timely in granting permissions.” For now, we can put aside the “When…, the [party] gains” construction, and save it as an idea for an optional model clause that could come into play if some legal team or individual wants to create an audit log entry/consent receipt requirement. Also note that what is called an “obligation”, I think may want to be a “commitment” or “prohibition” or “sanction” (or one of the other two norms coming from the sociotechnical norm <http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/TIST-13-governance.pdf> work). This would be more precise, and we could define those norm terms up front. Does this give a good direction for how we could “CommonAccordionify” our work?? :-) All this said, I don’t know if the Binding Obs set of “obligations” is the right set, inadequate, overstated, or legally wrongheaded! I’m sort of hoping that if we can make a run at accordionifying it, then the legal minds can really stare at it in familiar contract form and see what they think. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 6

HEART Profiles - HEART AS Key Rotation
by Adrian Gropper 07 Dec '15

07 Dec '15

I section 4.1 of http://openid.bitbucket.org/HEART/openid-heart-oauth2.html, we have : "jwks_uriThe fully qualified URI of the server's public key in JWK Set <http://openid.bitbucket.org/HEART/openid-heart-oauth2.html#RFC7517> [RFC7517] format" One of the reasons for this is to facilitate key rotation by the AS. Do we have or need a profile for how key rotation would be done with the RS? Thanks, Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 2

Email troubles
by Eve Maler 06 Dec '15

06 Dec '15

Folks-- If you sent me any off-list email in the last few weeks and have been waiting (im)patiently for a response or wanted to be sure I kept whatever it was in my archives, I have to ask you to re-send. I've had some kind of server crash and lost a bunch of email, some of which is definitely unrecoverable. Thanks/sorry in advance... Eve (from my iPad)

1 0

Reminder: UMA legal subgroup telecon 2015-12-4
by Adrian Gropper 04 Dec '15

04 Dec '15

- *Fri Dec 4* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar - Limits of delegation: Breach liability "safe harbor", audit, and notice when resource servers accept dynamic registration of a resource-owner specified authorization server. - AOB -- Adrian <http://patientprivacyrights.org/donate-2/>

2 2