- WG-UMA - mailman.kantarainitiative.org

Handling spec writing process @ GitHub
by Maciej Machulak 02 Sep '15

02 Sep '15

Hi, It was discussed today how the current process of spec editing looks like on GitHub (currently the spec is here: https://github.com/KantaraInitiative/wg-uma) All the changes are done on this repository, some via branches and some directly to the master branch. It was suggested that maybe we could use distributed repos (each editor would have a fork of the repo) and changes to the main repo would be done via pull requests. While I agree that using pull requests is best practice, I think we could do without this for UMA spec editing. The current setup which we have is pretty low overhead and sufficient for our needs (we could probably improve on using branches but that's also not something we have to strictly stick to). However, I'd like to hear the opinion of others. Let me know so that we can act accordingly. Maciej -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

4 8

Associating the Requesting Party/Authorization client with the permission ticket.
by Farazath Ahamed 02 Sep '15

02 Sep '15

Hi, First of all thanks everyone for helping me out in this mailing list answering my questions that helped me a lot in getting through my GSoC. However, I am yet to complete my implementation. Therefore i will keep on pestering you with questions :) Getting to the question, We use the PAT to register permissions using the Permission Registration endpoint of the Protection API, do we have a standard way of associating the client who requests for access from the UMA protected resource server? Thanks -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

3 3

Drafts of Core and RSR specs for your immediate review
by Eve Maler 02 Sep '15

02 Sep '15

I have attached HTML versions of the specs for you review. (I’m not posting them on the site, so that nobody gets the idea they’re finished/vetted.) Many thanks to Maciej for working on a fresh Kantara-specific XSLT transformation! His work isn’t complete, so there are a few formatting/front page things yet to do; don’t worry about those. Everybody please review these formatted specs carefully for ALL the issues you care about, and report any new issues in GitHub <https://github.com/KantaraInitiative/wg-uma/issues> Or feel free to send notes to the list or to me privately if you like, and I can collate them. We will discuss everything this Thursday. I think we should probably take the time to continue our review through to Sep 10 if we feel at all rushed, or want to see complete new renditions. This is because, once we exit the 45-day Public Review period, we can no longer make technical changes without going back to square 1. We should be quite sure we’re happy with these drafts when they go into review. (Luckily, I no longer have a conflict with our Sep 10 meeting.) Here are some items that we already know need editing, discussion, or review: Don’t forget that there is new wording for permission ticket lifecycle management as discussed last week, which needs your review. See Core Sec 3.2.2. Our new wording in response to #161, Protocol assumes one resource owner per URL <https://github.com/KantaraInitiative/wg-uma/issues/161>, says “When a client attempts access to a presumptively protected resource without an RPT,...”. This appears one place in RSR, where I changed “an RPT” to “an access token” and added an [UMA] cross-reference. But in the Core spec, should it say “an access token” generically? Maciej and I discussed some questions he had around the RSR security considerations, in RSR Sec 4. What does a “valid web page” (a phrase that came from OAuth’s version) mean? I also recently added a new issue #185, RSR user_access_policy_uri: security considerations <https://github.com/KantaraInitiative/wg-uma/issues/185>, that may have us tweak that section a little further if we think it has merit. I actually implemented issue #179, Use OIDC specification style of providing a subsection for every type of response <https://github.com/KantaraInitiative/wg-uma/issues/179> and restructured Core so that every request and response has its own subsection — couldn't resist. :-) Of course, this meant major structural changes! Mostly I rearranged existing text, but I did end up having to rewrite section introductions and invent new introductions. And because Section 3 has a flow to it, I redid how the “flow chart” feel of the entire section works. Now the organization is a bit flatter (there is one bug I’d like to fix, which is that Core Sec 3.3-3.5 should actually be subsections in a single Sec 3.3), and each main subsection contains a consistent “how you got here” intro (and no outro). E.g.: “If the client's request at the protected resource has no RPT, or an invalid RPT or insufficient authorization data associated with the RPT as determined through RPT status checking (see Section 3.6), then assuming the resource server chooses to respond to the client,…” Thanks in advance, all, for your review and attention. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 5

All the latest on UMA on Wikipedia, in Italian
by Eve Maler 02 Sep '15

02 Sep '15

http://it.wikipedia.org/wiki/User-Managed_Access Thanks, Domenico! Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: APAC-friendly UMA sync 2015-09-03
by Eve Maler 01 Sep '15

01 Sep '15

Thu Aug 27 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-09-02): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Alice's "term sheet", as envisioned by the VRM folks [legal]
by Eve Maler 30 Aug '15

30 Aug '15

http://blogs.law.harvard.edu/vrm/2015/08/29/vrm-day-lets-talk-uma-and-terms/ They’re talking “Party” language there... Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UMA legal subgroup notes for telecon 2015-08-28
by Dazza Greenwood 28 Aug '15

28 Aug '15

UMA Legal Subgroup Discussion Fri Aug 28 8-9am PT/11-12 ET Bridge: (605) 475-4700 / passcode: 176720# (due to difficulty using the usual conference line, participants used or switched to this telephone bridge ) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Attending: Thomas Hardjono (first half), Scott David, Jon Neiditz, Adrian Groper, Mark Lizar, Jeff Stollman and Dazza Greenwood (who took notes and facilitated in Eve's absence). Announced agenda: * Select goal and use case(s) * Proposal: RS liability —> Alice visits PCP and introduces its EHR system (RS) to her AS. AS variations? * Data rights ownership impact? * Work through role perspective(s): * Principal/Agent/Third Party * Identify next steps Dazza took the roll, provided a quick overview of the agenda and where the group has left off the previous week, and confirmed everybody wanted to keep to the announced agenda. Dazza provided a quick overview of Adrian's contribution of scenarios in a use case table and described the intention to use these scenarios (very basic use cases) as a starting point to overlay legal roles in hopes of shedding light on what recommendations may be needed or helpful from the legal subgroup. Dazza thanked Adrian and handed him the active speaker to present a Google doc based Use Case Table of Different Healthcare related scenarios demonstrating different combinations of actors and flows. See: https://docs.google.com/document/d/1wygXX8FvHif07KA0P4IocBL-tsUGoXEFDpEwxNL… Dazza also added a link to this Google doc to the top of "UMA Legal Group 'Use Cases, Roles and Obligations/ wiki page" See: https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Use-Cases,-Role… Adrian's presentation revolved around seven scenarios organized in his use case table, each featuring variations of UMA roles. Some confusion about who was doing what in the scenarios and how the scenarios related to familiar situations. Adrian provided further context by reference to one of the links in the use case table, linking to a standard looking patient consent form for the "Release of Information" under HIPAA. See: https://docs.google.com/document/d/1biUqGwvOinf9Sj6eyh3hiiDzoccSEaz3ewOTa7W… Dazza requested at this point that Adrian step the group through each HIPAA named role (already highlighted on the consent form) and identify the corresponding roles and data in the use case table scenarios. Based on Adrian's cross-walk of HIPAA and every day business names of each party, Dazza confirmed everybody understood the same use case, thanked Adrian for providing the anchoring document and presentation and re-commenced facilitation. Given the relatively short time remaining and the priority of engaging all participants, Dazza used the remaining time soliciting feedback from each participant on 1. their broad and general estimate of the situation and 2. ideas or suggestions about more specific directions the group should consider, especially directions likely to result with timely recommendations. Scott David, among other incisive comments, incidated he agreed that it is a good idea for the subgroup to start with HIPAA because it is a good match for UMA legal evaluation. Also, the statutory duties are the right ones. Also, HIPAA use cases relate directly to contractual practices, which Scott indicated would be fundamental tools for addressing the legal issues. Scott also cautioned UMA won't be bound to healtchare or any single given scenario or field of law and legal results will vary as any particular contractual terms or specific legal measures are applies in other or more generic scenarios of use. John Neiditz indicated UMA offers an approach that starts with the patient and this is a good fit. John noted this may well change the relationship between the operator of the Resource Server and the operator of the Authorization Server. This needs to be managed carefully and well but overall offers an opportunity to improve The current state of affairs. John indicated he felt agency law analysis is a great thing to do as part of the groups work. Jeff Stolman also agrees (w/ Scott and Adrian specifically) on the direction and indicated a need to do a much deeper dive into the process diagrams in order to surface enough relevant detail for more substantive work on the issues. Jeff indicated the issues of "shared party log-in" (is that what he said? like among spouses?) will need to be dealt with either by this group or by others, soon. Jeff also indicated he agreed that it is a great idea to use agency law as part of the work of the group. Dazza raised the question: to what extent does agency law apply the same beyond the US? Scott answered that by use of contracts one can deliberately introduce agency and other relationships and that is also distorted by local law (like a situation he had with Indian law for a large ecommerce company). Mark Lizar indicated he thought we were on the right track here and looks forward to continuing to participate going forward. Adrian Groper indicated the group should watch three way relationship between individual (personal data "owner"/subject) and direct service providers and third parties. Adrian suggest it is ok not to worry so much about business associates, etc. and other flavors of resource owner in a HIPAA context. Rather, it is important to understand and work with the basic triangle use case. (presumably the basic OAuth 2 triangle of 1) the individual resource owner and provider/witholder/revoker of consent, 2) the resource/auth service provider and 3) the third-party client/app). Adrian brought up the Apple's Healthkit as an example of an alternative model of relationships and healthcare personal data and transaction flow. This example sparked a lively and creative round of discussion among several members who informally stayed on the line to continue the dialog after the call was adjournd. As with other contexts, some ambiguity arose between use of the words "Consent" and "Authorization" as well as "User Control" and "User Management". It was noteworthy that the iPhone device is at once apparently "owned" by the user while at the same time housing components and processes that are proprietary to and controlled by others parties. Presumably, further development of nomenclature for legal lawyers of UMA use cases will more quickly and clearly reflect which people, devices and processes in operate at the behest or in the interests of the individual who holds and generate personal data through systems like the Heathkit and which operate as "agent" for and in the interests of other parties. It was also noted that Apple's open source and modular componentization of an "informed consent" function was interesting and should be explored to understand how it would or could relate to OAuth 2 and UMA authorization flows. Dazza added an 8th use case to the use case table as a rough sketch / placeholder to further explore Apple Healthkit/Researchkit. Meeting Results Keyed to Agenda: > Select goal and use case(s): * Yes, start with identified health data related use cases described in use case table provided by Adrian and augmented by the group during the meeting. > Proposal: RS liability —> Alice visits PCP and introduces its EHR system (RS) to her AS. AS variations? * This was not directly addressed. > Data rights ownership impact? * This was touched upon a few times and was an explicit basis for the need to further explore how ownership, control, contractual and agency relationships play out with Apple's Healthkit/Researchkit. > Work through role perspective(s): * One level of legal roles was briefly but completely worked through by use of the HIPAA consent form for Release of Information in the context of Adrian's UMA use case table (ascribing the roles of "covered entity, patient, etc to each actor or other entity in the UMA use cases"). The group also indicated a desire to do that again more comprehensively to use cases in the table and with other use cases. > Principal/Agent/Third Party * A majority of participants voiced a strong interest to apply agency law oriented role based analysis for all UMA legal use cases. The basic formula was felt to be strong fit with the roles, relationships and rules generally intended for UMA. However, some caution was stated about limits of how far agency law may apply in the same way (especially beyond the boarders of the US) and also the potential wild-card effect of unpredictable but over-riding roles, rights and responsibilities agreed by contract. The general sense was that Princiap/Agent/Third Party triangluar analysis will be a valuable reference point to evaluate and describe intended legal context and outcomes. The idea was to use agency analysis as a benchmark to evaluate conformance or need for additional contractual or other structuring of the rules defining rights and responsibilities for roles and the networks of relationships, interactions/transactions that ensure predictable, expected legal results. > Identify next steps: The following next steps were identified: * It was confirmed that the group should continue working through the HIPAA use cases * It was evident participants want to further discuss the Apple Healthkit/Researchkit and so it will be included as a variation of the initial health information scenarios. * Dazza will work with Adrian (and anyone else so inclided) to refactor the use case table scenarios into more detailed cross-functional process diagrams (aka swim lane diagrams) including agency law overlay (and possibly a first guess as to where contracts are formed, already exist or could be monkeyed with). When ready, a link to the diagrams in the wiki will be emailed to the list for everybody to hammer at or at least view them. * Other? Thanks, - Dazza --- Note: Due to technical difficulty, the meeting did not get rolling until nearly 30 minutes after the start time, but covered a lot of ground nonetheless prior to adjournment at slightly after 12pm Eastern Time. Several participants also chose to continue a lively and topical discussion for 15-20 minutes after the meeting was formally adjourned. _ _ _ _ _ _ _ _ _ _ _ _ _ _ | Dazza Greenwood, JD | CIVICS.com, Founder & Principal | MIT Media Lab, Visiting Scientist | Vmail: 617.500.3644 | Email: dazza(a)CIVICS.com | Biz: http://CIVICS.com | MIT: https://law.MIT.edu | Me: DazzaGreenwood.com | Twitter: @DazzaGreenwood | Google+: google.com/+DazzaGreenwood | LinkedIn: linkedin.com/in/DazzaGreenwood | GitHub: github.com/DazzaGreenwood/Interface | Postal: P.O. Box 425845 Cambridge, MA 02142 | _ _ _ _ _ _ _ _ _ _ _ _ _ _

1 0

Reminder: UMA legal subgroup telecon 2015-08-28
by Eve Maler 28 Aug '15

28 Aug '15

Fri Aug 28 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Select goal and use case(s) Proposal: RS liability —> Alice visits PCP and introduces its EHR system (RS) to her AS AS variations? Data rights ownership impact? Work through role perspective(s): Principal/Agent/Third Party Identify next steps Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

4 3

update on legal subgoup
by Dazza Greenwood 28 Aug '15

28 Aug '15

2 2

Alternate legal subgroup dial-in (was Fwd: Reminder: legal subgroup meeting starts now)
by Eve Maler 28 Aug '15

28 Aug '15

Alternate number below. > Begin forwarded message: > > From: Thomas Hardjono <hardjono(a)mit.edu> > Subject: Re: [WG-UMA] Reminder: legal subgroup meeting starts now > Date: 28 August 2015 at 8:10:50 AM PDT > To: Eve Maler <eve(a)xmlgrrl.com> > Cc: "wg-uma(a)kantarainitiative.org WG" <wg-uma(a)kantarainitiative.org> > > Alternate bridge > > Bridge: (605) 475-4700 / passcode: 176720# > > > /thomas/ > > (Sent from my iPhone) > > > > >> On Aug 28, 2015, at 11:00, Eve Maler <eve(a)xmlgrrl.com> wrote: >> >> …sans me. I’ve sent the host PIN to Dazza. If you guys experience any bridge problems, feel free to ping me on Skype (“xmlgrrl”). Have fun, y’all! >> >> Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com >> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> http://kantarainitiative.org/mailman/listinfo/wg-uma Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0