- WG-UMA - mailman.kantarainitiative.org

Reminder: Special APAC-friendly UMA sync 2015-09-24
by Eve Maler 22 Sep '15

22 Sep '15

Thu Sep 24 at APAC-friendly times — this meeting is on an off-week due to a cancelled call last week Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-09-23): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. NOTE: Let’s cancel next week’s sync (making our schedule be effectively “every three weeks" for a little while); no sense stacking them up too close. I will be attending the IAPP Privacy Security Risk conference and can’t attend anyway... Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Re: [WG-UMA] Trust Framework non profits: Notes from APAC-friendly UMA WG sync 2015-09-02
by Colin Wallis 21 Sep '15

21 Sep '15

Thanks Eve Indeed, a great quick rundown. But with a number of us on this list pretty deeply involved in IDESG, I guess we are honour-bound to slightly correct you there.. :) << IDESG is the private-sector-led steering committee overseeing the US public-sector NSTIC initiative. I don't think it has a specific focus on trust frameworks vs. other various elements that are thought to be valuable for making privacy-sensitive federated identity successful.>> Actually it does have a very specific focus on a Trust Framework, the IDEF (IDentity Ecosystem Framework) based on the NSTIC Guiding Principles. The (soon to be announced) IDEF consists of a Functional Model from which Baseline Requirements and Supplemental Guidance are drawn, which has a major focus on Privacy along with UX, Interop, Security etc. A Self Attested Listing Service (SALS) will initially indicate relative compliance level of the applicable players, and in the fullness of time, a TrustMark or similar may emerge to 'brand' that compliance level. Cheers Colin From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Eve Maler Sent: Thursday, 3 September 2015 4:30 p.m. To: Adrian Gropper; Paul Templeman Cc: wg-uma(a)kantarainitiative.org UMA Subject: Re: [WG-UMA] Notes from APAC-friendly UMA WG sync 2015-09-02 Here's an attempt at a quick (?) rundown. An identity federation trust framework is a set of federated identity "rules and tools" identified by a set of policymakers representing a community of interest, which may be vertical/sectoral or horizontal in nature. Here's a white paper<http://openidentityexchange.org/wp-content/uploads/the-open-identity-trust-…> from 2010 that presents what is intended to be a model for open identity trust frameworks. The community could run/use cloud identity services, or just be a bunch of companies or organizations that want to be able to single sign-in to each other's stuff, or whatever. As noted below, Kantara does the care and feeding of a specific identity federation trust framework, including "assessing the assessors" for it. That trust framework has a FICAM heritage; FICAM is a US gov-specific trust framework. OIX is becoming capable of hosting listings of the members of multiple trust frameworks, and doesn't itself offer one and is agnostic as to the types. What OTA published is very cool; I don't know if I'd call it a trust framework; more a set of best practices (ymmv). The Federal Bridge is a PKI-based trust framework. PKI predates the cross-domain federated identity protocols such as SAML and OpenID connect, and the Federal Bridge has been around a long time. Connect.gov<http://Connect.gov> is a service that offers brokered federated identity services; parties involved in it have to be FICAM-accredited. IDESG is the private-sector-led steering committee overseeing the US public-sector NSTIC initiative. I don't think it has a specific focus on trust frameworks vs. other various elements that are thought to be valuable for making privacy-sensitive federated identity successful. (This isn't a complete list of federations, identity trust frameworks, or initiatives!) My take on why this is all relevant to UMA is that, where identity federations deal with "rules and tools" for IdPs and relying parties and users, UMA is a different beast and needs "rules and tools" for its own involved parties: resource owners, requesting parties, resource servers, and the like. The name we've given to UMA deployment ecosystems with a formal organizational principle is "access federations", and we believe they would benefit from trust frameworks too. The main reason why we have the legal subgroup is to develop some starter (and/or meta?) "rules and tools" to encourage UMA deployment ecosystems to flourish, while staying true to UMA's design principles. (I welcome corrections...) Eve On 2 Sep 2015, at 7:47 PM, Paul Templeman <paul(a)templeman.co<mailto:paul@templeman.co>> wrote: Thanks Adrian Appreciate the list. The discussion was as a result of a newby question asked by myself, whilst there were only a few people to annoy. :-) Still on a learning curve ... Regards Paul... ________________________________ Date: Wed, 2 Sep 2015 22:17:17 -0400 From: agropper(a)healthurl.com<mailto:agropper@healthurl.com> To: eve(a)xmlgrrl.com<mailto:eve@xmlgrrl.com> CC: wg-uma(a)kantarainitiative.org<mailto:wg-uma@kantarainitiative.org> Subject: Re: [WG-UMA] Notes from APAC-friendly UMA WG sync 2015-09-02 I have the following list of overlapping trust framework non-profits: OTA - https://otalliance.org/iot-trust-framework-submission Kantara - http://kantarainitiative.org/ FICAM - https://www.ise.gov/federal-identity-credential-and-access-management-ficam Federal Bridge - http://www.idmanagement.gov/fbca-certificate-policy-page Connect.gov<http://Connect.gov> - http://www.connect.gov/ OIX - http://openidentityexchange.org/ IDESG - https://www.idecosystem.org/ I can't tell them apart. Some of them depend on the others to some extent. How does any of this affect UMA? Adrian On Wed, Sep 2, 2015 at 7:57 PM, Eve Maler <eve(a)xmlgrrl.com<mailto:eve@xmlgrrl.com>> wrote: Attending: Eve, Paul, Allan Agenda bashing: - Looking at UMA in the context of sport (Australian Digital Transformation Office has an interest) There are similarities to health, and there are customer relationships as well. An under-6 soccer game involves two teams, two clubs, a competition organizer, a venue manager, and a referees' organization. There are different legal entities, and a lot of personal data flying between them. This is what makes it a little similar to health. "Children checks" involves officials who are members of sport organizations that cross state-level jurisdictions. And a lot of people involved are volunteers. If a dad is a volunteer coach, he still has to go through the check. If one person is a coach for two different teams/kids/sports, the person may have to go through the check multiple times. Paper forms are often still involved in this world. There are also sport associations at local, state, national, and international levels, responsible for different parts of the process. The vision would be, e.g., that a volunteer coach could go through a single check and have it be valid for other activities as long as it's fresh enough. Along with underage child regulations, there are also anti-doping regulations to think about. There's an interest in trust frameworks around this. What's the relationship between UMA trust framework opportunities and the Kantara and OIX work on trust frameworks and the UMA legal subgroup work? The Kantara trust framework came out of the US FICAM and NIST SP 800-63 material, but is not US-specific. Kantara has approved assessors that approve organizations under that trust framework. A key motivation for doing this is actual FICAM acceptance, which is valuable for (likely) being accepted sight unseen by the US General Services Administration. There's work ongoing to map US and UK trust frameworks. OIX runs a registry that can hold registrations, for communities of interest that have a trust framework, of members in good standing in that framework. Right now it only holds one set of entries, for a technical-level community run by OpenID Foundation recording self-certified conformance to the specs. So Kantara sort of specializes in "config-time" and OIX sort of specializes in "run-time". Some other identity federations in higher education and research have their own trust frameworks. What is the UMA legal subgroup doing? The mission of record is: "Develop recommendations about resource owner-and-requesting party [Alice-and-Bob], resource server-and-authorization server [service-and-hub], and any other transactional relationships in the UMA environment, keeping in mind international jurisdictional friendliness; applicability to many different vertical and horizontal use cases, including health; and support of higher-level access federation trust frameworks and similar efforts." The parallels between health and sport are actually pretty strong, as long as we stay away from only government, only health, only US, etc. One difference is that the people and even some of the organizations involved are at a small, non- or under-funded scale. It's mom-and-pop a lot of times, and volunteers can't deploy IT infrastructure. AI: Paul: Follow up on these notes with some specifics on "legal use cases" that arise out of the sport scenario. Who would be the Principal of interest in each? Etc. - V1.0.1 status update? We should close the specs for 45-day public review as of next Thursday or earlier. That would mean it's effectively stable at that point, modulo public review period comments. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com<mailto:xmlgrrl@gmail.com> _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org<mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma -- Adrian Gropper MD RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/ _______________________________________________ WG-UMA mailing list WG-UMA(a)kantarainitiative.org<mailto:WG-UMA@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/wg-uma Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com<mailto:xmlgrrl@gmail.com>

4 3

New OAuth book (and UMA gets a mention!)
by Justin Richer 20 Sep '15

20 Sep '15

Hi all, First, apologies for the cross-posting while we’re trying to get the word out today. Antonio Sanso and I are writing a book about OAuth 2, and it’s just gone up for pre-order on the publisher’s website: https://www.manning.com/books/OAuth-2-in-Action <https://www.manning.com/books/OAuth-2-in-Action> You can download the first chapter for free, and if you pre-order you’ll get the first three chapters immediately and more as they get finished. You’ll also be able to give us feedback on the book that we can incorporate into the final publication, so it’s a great way to help make sure this reference is the best it can be. Plus, they’ve given us a discount code that gets you half off for the next couple days: mloauth2 We cover UMA in one of the later chapters of the book, talking about how it uses OAuth to solve a more advanced use case, and the kinds of things that it has added to OAuth in order to do that. We also cover two things that were originally born of UMA, dynamic client registration and token introspection, in depth in their own chapters. So, sorry for the commercial message, I’m just very excited that this is finally getting out there. Thanks, — Justin

2 2

New document, UMA Release Notes, now complete (for some definition)
by Eve Maler 20 Sep '15

20 Sep '15

http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes Please feel free to comment. I’ve also updated the UMA wiki home page to help everyone get the word out, as they see fit, during the comment period: http://kantarainitiative.org/confluence/display/uma/Home Oh, and I also did a bit of housekeeping in other parts of the UMA wiki — changing the name of the “UMA 1.0 Core Protocol” page to “UMA Protocol”, updating its content, and changing the name of the “Working Drafts” page to “Specifications and Auxiliary Documents”. Thanks, all! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

No legal subgroup meeting this week -- make sure not to miss next week
by Eve Maler 17 Sep '15

17 Sep '15

I’ve been talking to several subgroup contributors offline, and received some great feedback and suggestions about next steps. Unfortunately, I can’t make the call this Friday, and the timing isn’t great for some others either. So let’s take a cue from the larger WG and “take the week off”. I’ll send a followup note next week summarizing those suggestions. (And if I haven’t spoken to you yet and you’ve got feedback and suggestions too, hey, reach out and let’s chat.) Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Public Review status; release notes
by Eve Maler 16 Sep '15

16 Sep '15

We’re really close to getting the Public Review notification out. The online comment form has been changed in anticipation, and Oliver helped us solve what turned out to be a charset mystery, so the odd characters in the HTML specs are now gone. I’m hoping it will launch tomorrow, which means (I think...carry the one...:-) that we should close it on Monday November 2, the Monday just after IIW. In other news, I’ve created a draft set of release notes. Please take a look and give me any comments... http://kantarainitiative.org/confluence/display/uma/UMA+Release+Notes Thanks! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: No WG meeting this Thursday
by Eve Maler 15 Sep '15

15 Sep '15

<eom/> Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

IIW week in October -- who's going to what?
by Eve Maler 12 Sep '15

12 Sep '15

Who is attending any of the following activities that week? Please send me a private email (don’t spam the list). Thanks! ___ VRM Day http://www.eventbrite.com/e/vrm-day-2015b-tickets-18263887780 ___ OpenID Foundation workshop http://www.eventbrite.com/e/openid-foundation-workshop-before-fall-2015-iiw… ___ IIW Which days? ___ Tue ___ Wed ___ Thu https://www.eventbrite.com/e/internet-identity-workshop-xxi-21-2015b-ticket… ___ Any local activities on Friday Anything you want to advertise to the rest of us? ________________ For new UMAnitarians, Internet Identity Workshop week, twice a year in Mountain View, CA, is a nexus of a lot of identity-related activities. A fair amount of UMA work has been done at IIWs past; it actually got its name at one. We haven’t talked about it much of late, but our plan has been to conduct some interop activities at this coming IIW, which is XXI (#21). Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

5 5

Notes from UMA legal subgroup telecon 2015-09-11
by Eve Maler 11 Sep '15

11 Sep '15

Attending: Eve, Jon, Jim, Adrian, Dazza, Jeff, Domenico, Paul Laurent Our meeting setup: ==== For this call, let us take the following “negative use case”, growing out of the agency and “RS risk” discussion we’ve been having: “I, a US hospital, have an online service that exposed a FHIR API for electronic medical records. Alice set up policies at her consumer-grade AS, and I accepted outsourcing authorization there. The token from the AS told me that it was okay to give client MobileApp and requesting party Bob access, so I did. But then Alice sued me/complained/reported me/(something else bad)”. (Adrian can comment on real-life examples somewhat analogous to this, with breaches and such.) Dazza has offered to facilitate a discussion of the following points: What are the key legal issues presented by this scenario? What legal role(s) and corresponding rules apply to the actions and data of the parties in this scenario? What are the potential or probable outcomes if things go wrong (eg: result of enforcement actions, allocation of loss or other dispute resolutions)? What advice or other resources for parties seeking to adopt UMA could help them manage legal risks and/or structure legal affairs to expand or create new value? And I will scribe. :-) To prepare for tomorrow's agenda, here is the composite list of real-life examples of negatives. Please read these in the context of a Resource Server holding records for 4.5 Million Alices and accessible to some 10,000 Bobs: Was it really Bob that accessed the resource or someone that Bob shared credentials with in his office? Why is it that the Resource Server did not implement a Bob authentication means that would mitigate sharing of credentials by Bob? Why was it that Bob's staff member, who is not an employee of the Resource Server institution, could get access even though they were not trained in security practices by the institution? Why didn't the Resource Server system notice that Bob had no prior relationship with this particular patient and kick the request out for enhanced audit? Why doesn't the Resource Server notify Alice of significant events such as a new Bob in a remote location getting access to her resource? Why does the Resource Server depend on an honor code and whistle blowers to detect breaches? Why does it take 6 months and 4.5 Million records breached to detect a breach had taken place? Why did it take a month for the Resource Server to investigate and respond to Alice's complaint (this escalates the cost of the damages caused by the breach.) Was the Resource Server following typical industry practice in managing the security of their system? - The jury said yes :-( ==== Today we are working to apply law, specifically agency law, to facts. Dazza has enhanced the relevant GitHub wiki page <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Mapping-Between…>. Eve has provided a “negative use case”, where something has gone wrong. Lawyers call this “another day at the office”. Adrian’s list of negatives is not comprehensive and fairly straightforward. The liability goes in a few different directions: is Alice at fault? is Bob at fault? is the institution (the resource server operator) at fault? Our mappings are in a new wiki page <https://github.com/KantaraInitiative/wg-uma/wiki/Legal-Analysis-of-Hypothet…>. We could have two different use cases: One where the hospital itself hosts the client app and Bob works for the hospital, and one where Bob and the client are outside (e.g. in a separate practice). Commentary: Jon: Dr. Bob is acting in the capacity of an agent, but we haven’t broken out a “sub-Bob”, with whom Bob shared credentials inappropriately. He acts outside the scope of his authority in some of his actions. Adrian: There are several agency subtleties around Bob. … Sub-Bob is an agent of Bob, but neither is an agent of Alice. We’ve started to collect an outline of a brushed-up set of facts, so the use case has gotten a little more specific. We still need to enhance it with more details. We’re now mapping the parties to UMA roles, legal roles, and privacy roles. Homework for next week: Can everyone (who’s able and interested) please comment on the details still missing from the use case that will help answer the remaining questions we might have that would be necessary to create a “case squib”? You can send email, or edit in GitHub if you like. Thanks! Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

1 0

Reminder: UMA legal subgroup telecon 2015-09-11
by Eve Maler 10 Sep '15

10 Sep '15

Fri Sep 11 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> For this call, let us take the following “negative use case”, growing out of the agency and “RS risk” discussion we’ve been having: “I, a US hospital, have an online service that exposed a FHIR API for electronic medical records. Alice set up policies at her consumer-grade AS, and I accepted outsourcing authorization there. The token from the AS told me that it was okay to give client MobileApp and requesting party Bob access, so I did. But then Alice sued me/complained/reported me/(something else bad)”. (Adrian can comment on real-life examples somewhat analogous to this, with breaches and such.) Dazza has offered to facilitate a discussion of the following points: What are the key legal issues presented by this scenario? What legal role(s) and corresponding rules apply to the actions and data of the parties in this scenario? What are the potential or probable outcomes if things go wrong (eg: result of enforcement actions, allocation of loss or other dispute resolutions)? What advice or other resources for parties seeking to adopt UMA could help them manage legal risks and/or structure legal affairs to expand or create new value? And I will scribe. :-) Talk to you soon! Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 1