- WG-UMA - mailman.kantarainitiative.org

Reminder: UMA legal subgroup telecon 2015-12-04
by Eve Maler 04 Dec '15

04 Dec '15

Please see the Meetings and Minutes page or the UMA calendar linked from http://tinyurl.com/umawg to find dial-in information. The basic goal for the rest of December is to flesh out UMA-specific "model clauses" for for the required functions of party roles, some of which would be required (axiomatic?) and some of which might be optional. By hook or by crook, I will send some simple examples as warmups before this meeting -- but won't be attending as I'll be on a plane. Adrian has offered to facilitate. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
by Mike Schwartz 01 Dec '15

01 Dec '15

UMA WG, This draft for proof of possesion is getting pretty far along: https://datatracker.ietf.org/doc/draft-ietf-oauth-proof-of-possession/ Justin did this nice web sequence diagram: http://gluu.co/oauth-pop-websequence My question is... do you think we should recommend proof of possesion tokens for the RPT? - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

3 4

URGENT: Opportunity to request 2016 funding, with a proposal for a "legal subgroup" project
by Eve Maler 30 Nov '15

30 Nov '15

Hi folks— In conversation with SteveO and Robin W from ISOC, I learned they would be willing to support the UMA WG with some directed funding to Kantara to the tune of US$10K, to arrive by 31 Dec 2015 and to be spent in 2016. (Thanks, SteveO/Robin/ISOC, for your support!) I thought it would be a good idea to treat this as a matching funds opportunity in addition to a (required) formal writeup of what I have already described to them as a good target for development. The target: A user interface/environment for enabling the convenient creation of a variant UMA-specific set of contract clauses that could be used in real business settings, such as Adrian brought up in a legal subgroup meeting a few weeks ago. As research, I just spent the last hour meeting with Jim Hazard, and we worked out the following draft budget proposal with which we feel pretty comfortable: https://docs.google.com/document/d/1DFFwU_7EmXVtpTb0s7SZVkQ4NFOC6oi4uNInLDq… There is a DEADLINE OF TODAY for getting 2016 budget proposals in. Can I ask people to review this proposal and weigh in on a) the idea of submitting the proposal at all, and b) the text of the proposal if they think the submission is a good idea? To be clear, ISOC has guaranteed its contribution already; we are asking for Kantara funding over and above this in order to ensure we can do a really good job (so perhaps, in a sense, we’re asking Kantara to match ISOC’s funding!). If you have any questions, of course, please let me know. If I don’t hear any strenuous objections by 10pm CET (where I currently am) / 4pm ET / 1pm PT (sorry for the early hour on the west coast), I will send in the proposal. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 4

Reminder: no WG call on Thu and no legal subgroup call on Fri due to the US holiday
by Eve Maler 24 Nov '15

24 Nov '15

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: APAC-friendly UMA sync 2015-11-26 (see note at end)
by Eve Maler 24 Nov '15

24 Nov '15

Thu Nov 26 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: none for this meeting as I’ll be joining by phone (normally http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line)) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-11-25): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. NOTE: I have a dentist’s appointment just prior, and there’s a not-entirely-insignificant chance that I might be a bit delayed. If so, I’ll send a note to the UMA Chat Skype group. If you are not in that group, please send me a note to add you. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

OAuth Identity Federation
by Mike Schwartz 20 Nov '15

20 Nov '15

UMAtarians, I have finally caught up to all of you founders, and I am seeing the benefit of using UMA for federated identity (not just federated authorization). I've created a new project to just sketch out some of my ideas: http://www.gluu.co/oauth-identity I'm trying to gather feedback to see if this idea has any merit or would be worth the effort to undertake... Please send me email directly unless you think it would relevant for the whole list. thx, Mike

1 0

Notes from UMA legal subgroup telecon 2015-11-20
by Eve Maler 20 Nov '15

20 Nov '15

Exciting progress today! Attending: Andrew, Ann, Jon, Adrian, Steve, Jeff, Adrian, Scott Andrew still needs to keep some project details under wraps, but he notes that any provider whatsoever in that project needs to have SLAs etc., and for each of the identity roles, he’s created a list of archetypes for, e.g., IdPs and such. He’s also set out UMA archetypes — this is where the Binding Obs come in. If you have an UMA authorization server defined and built as such, what are its proper functions? He has a notion of this, but he just needs the text. Being a framework, it can handle both an AS that serves multiple ROs, and an AS that serves a single RO. When you downselect the rules you want, that gives shape to your deployment. Is it also interesting to attach the proper functions of the roles in terms of protocol state changes? Andrew is not so sure, for the work he’s doing right now in making a framework. Eve notes that it may simply have relevance only when it gets to “receipt” time, that is, when a particular norm gets executed by a particular role. Andrew’s analysis tool is designed to be able to record that if someone is a signatory to an agreement, then they commit to being in a certain role. So: Click the box to be in a role. He needs the role definition. We can write the latter. Scott asks: Have we talked about standards of care? Adopting a role in the real world comes with standards of care that are affected by statutes and/or contracts. Here’s where the CommonAccord approach could come in, with a flexible normative cross-reference. Andrew is planning to handle this in the base layer. Andrew made a matrix of expectations and commitments. Contracts are just exchanges of promises! Say what you’re going to do, and then doing what you said you were going to do. This is the Invisible Hand model. Offer and acceptance of a contract has a notion of the time of acceptance. This again suggests recording/logging as an important function. (Hence the blockchain mention as a ledger…) In legal parlance, a “prohibition” is a "condition subsequent”. This is a way to effect the “chain-link confidentiality” effect Domenico has drawn our attention to. It’s useful for real estate, but people bristle at it when used for intellectual property. Think of software licensing. But then again, it’s used for NDAs, embargoes, etc. It’s tricky. How different are “power” and “authorization”? This is the central preoccupation of Steve’s adult life. :-) ==== Can we draft statements of UMA role functions with required parts (clauses?) and optional parts (clauses?)? Should the latter include something about consent receipt/audit log entry generation, where appropriate? Andrew says this fits in pretty well with his goals. Obviously we’re not thinking about producing these statements in Word! They’d hopefully be in CommonAccord, and ultimately be available in a cool online tool with dropdowns and such. :-) Who is interested to actively take part in the action item? Eve, Andrew, Steve, Ann… Scott is happy to do intense kibbitzing! Eve and Andrew are meeting in depth later today, and will try and sketch a draft skeleton to help push things forward. Eve will round up those who are/may be interested to work together in the interim. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Follow-up to the UMA Legal call and FutureCommerce hackathon planning
by Adrian Gropper 19 Nov '15

19 Nov '15

The legal call today had a clear focus at the junction of CommonAccord, blockchain, and UMA. The use-case was negotiation of a Non-Disclosure Agreement between two parties using CommonAccord as a structure for the changes that each of the parties would make as they passed the drafts back and forth. Blockchain was introduced as the non-repudiation mechanism to track the intermediate and final version of the NDA contract. UMA was not central to the discussion on the legal call today but was tacked on vaguely as the means to control access to the final contract by unspecified parties. It was not clear to me who the Resource Owner would be in the use-case we discussed. For the FutureCommerce hackathon, I'm hoping to gather a team to hack a personal UMA authorization server. This server, which I'm calling HIE of One http://hieofone.org/ could be linked to the CommonAccord project we discussed today to the extent there was a Resource Owner to associate with the contract being negotiated. At this point, instead of an NDA, the contract being negotiated in HIE of One is a Release of Information policy that establishes what requesting parties and clients can access the protected resource. An NDA is, in some sense, the opposite of a release of information agreement. An NDA is often mutual and therefore does not have a clear resource owner. This may not be a problem for some applications of UMA but it doesn't seem to work well for a personal authorization server linked to a personal resource. I'm hoping we could coordinate some of the FutureCommerce hacks over the coming week. Ideally, the CommonAccord hack and the personal AS hack would complement each other around the same type of contract and we could even try to demo some interaction between them. Please let us know your thoughts and consider joining FutureCommerce http://futurecommerce.civics.com/index.html online Nov 20-22. Anyone specifically interested in working on the personal AS hack should email me and I will invite you to the GitHub project. Adrian <http://patientprivacyrights.org/donate-2/>

3 9

Notes from UMA telecon 2015-11-19
by Eve Maler 19 Nov '15

19 Nov '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-11-19 Minutes Roll call Quorum was not reached. Approve minutes tbs Upcoming meetings No meetings Thu/Fri next week (US Thanksgiving holiday) No meeting Thu the following week (Thu Dec 3) due to Eve absence (Adrian can run Fri Dec 4 legal subgroup call) No meetings Thu/Fri Christmas Eve/Day No meetings Thu/Fri New Year's Eve/Day Status of V1.0.1 process LC ballot to certify Draft Recommendations has passed Kantara All-Member Ballot process can begin shortly after a few "metadata edits"; complete by end of 2015 Maciej has made the required edits to the specs' metadata to ready them for All-Member Ballot. So now it's up to Oliver and Jane. Incidentally, the XSLT stylesheet now handles everything automatically rather than requiring manual tweaking. This means that other WGs could be using it too! AI: Maciej: Alert Jane Celusak that the stylesheet could be used as a tool by other WGs. Funding requests The main purpose of the UMA Dev WG is really seeding the ecosystem, not interop testing. And the interop test GUI he developed is separable. And Roland hasn't done much development since he started refactoring. Does this mean the job properly devolves to this group? On the other hand, software – especially if we want to ensure that it remains FOSS – does nicely go hand in hand with the Dev group. The UMA group is still working pretty hard on features and such, so spending time overseeing software development may overwhelm us. So maybe software should stick with software, and interop testing is a natural function of encouraging wide ecosystems as long as testing is made very easy. Resource servers are a policy enforcement point, so it's very important to know that they're getting it right. Adrian's new HIE of One project deals with this by saying "Here's a very simple implementation of an authorization server that can be given away (and used by a single individual)." The RO would have to do no setup; it's a "personal data store" kind of use case. Each of the existing open-source authorization servers is optimized for different use cases: API security vs. individuals, individual scale vs. whole consumer populations... AI: Eve: Report back to Jane that this WG won't be spending our budget allotment in 2015, and we're withdrawing the request. (She'll bring up the idea of doing a 2016 funding request through the UMA Dev WG.) IETF 94 news It appears there's now interest in RSR, or something like it, in OAuth now that they're rechartering. Would a general service metadata endpoint be a good idea in addition to registering the stuff that needs to be protected? Could the OTTO work be added to the mix? What are our thoughts on next steps? Mike advocates for moving everything (Core and RSR) to IETF. Eve advocates for being tactical and only working to explore "sedimenting" RSR into IETF right now. George is not in favor of moving Core. Maciej seconds George. Sal too – he notes that this could be a diversion. It's important to move ahead with deployments and use cases and proving the value. Mike's rationale: Adoption is what matters; Core could be very useful to enable a federation standard where UMA is the access token for identity information – then UMA would become a federated identity protocol. Mike feels that if we don't "move both", we shouldn't even "move RSR"! More to come on this subject. (See the Skype chat for more.) AI: All who are able and willing: Track IETF OAuth conversations about OAuth/UMA/API security more closely. Permission registration extension spec Deferred. Previous AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Maciej: Review and correct the Redirecting the Requesting Party to the Client After Claims Gathering section. AI: Maciej: Write up some recommendations for the RPT Refreshing section. AI: Maciej: Try to find Justin's old recommendations for the Permission Ticket Management section. Attendees As of 13 Oct 2015, quorum is 7 of 13. (François, Domenico, Sal, Thomas, Andi, Mary, Robert, Maciej, Eve, Sourav, Lisa, Arlene, Mike) Eve Mike Maciej Domenico Sal Non-voting participants: Katie George James Sarah Scott Adrian Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Specs certified by LC for All-Member Ballot
by Maciej Machulak 19 Nov '15

19 Nov '15

Hi all, The UMA specs, certified by LC for All-Member Ballot, are now uploaded and can be accessed at: https://docs.kantarainitiative.org/uma/draft-uma-core-v1_0_1.html https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html As you can see, the status of both specifications changed to the following: "This Draft Recommendation was developed by the User-Managed Access Work Group and has been certified by the Leadership Council to undergo a Kantara All-Member Ballot." We should be discussing these specs on today's call. Kind regards, Maciek -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

1 0