- WG-UMA - mailman.kantarainitiative.org

Notes from UMA telecon 2015-07-16
by Eve Maler 16 Jul '15

16 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16> Minutes Roll call Quorum was not reached. Minutes approval Deferred. New UMA Developer Resources WG Is this way of doing open source going to work? It seems worth a try. Mike points out his experience of writing an Apache module, which took longer than expected. Libraries might be valuable, but he points out that how-to recipes for building, e.g., smart clients might be even more valuable. Examples of how to apply the components could be valuable. "Client" means a lot things. Sorting that out would be super-helpful. And maybe that group wants to expand its charter to include, if not specs, then non-code deliverables. Maybe this WG will want to remand the UIG to that WG for completion! The implementations that exist are, Mike believes, are AS-heavy and Java-heavy. His implementation protects SCIM deployments. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. License/contract/Binding Obs next steps Adrian wants to solve the problem of making the entire system more user-centric. What are the properties of a license model vs. a contract model wrt this problem? For example, in health, resource servers tend to err on the side of security over privacy, and thus don't want to allow dynamic client registration. He's looking to provide a safe harbor to them, to allow Alice to achieve what she wants. The transference of responsibility is valuable for his ends. Adrian believes the biggest hurdle is getting the RS to sign on with the AS, not between the RO and RqP. Let's take this up next time. The license model we discussed last time could be extended with the machine-readable license language Tim brought up if we bake the language into the scope (or even resource set?) descriptions; this is an idea Dazza had a long time ago. Eve calls this a "notice model" because the act of using the scopes (exercising the license?) binds the RqP. Jon would say, rather that the RO is the licensor and has issued the license; it's the opposite of a notice model. You can have choice exercised through the issuance of multiple different licenses. Eve's attempt at a dialogue that achieves Bob's consent need not be mapped to contract; licensure could work as a model too, says Jon. The time seems to be right to start having legal subgroup meetings to come to recommendations about RO-RqP, RS-AS, and any other transactional relationships in the UMA environment. Adrian suggests inviting Jim Hazard as well. The goals might be: Jurisdictional friendliness internationally Applicability to many different vertical and horizontal use cases, including health Support of higher-level access federation trust frameworks and similar efforts Issue backlog next steps What do people think about breaking changes? Mike is okay with them. Justin feels it's important to consider the changes. He doesn't care what the version number is. MIT is only tracking a released version of the protocol, vs. drafts. We need to discuss timelines for any revision considerations, and also our plans for the Informational RFC submission process. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. Treat this as a reminder! AI: Eve: Review Marcelo Wikipedia comments and take next actions. AI: Tim: Expound on the licensing idea in email. DONE. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. Let's discuss this at the next LC call. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. PROGRESSING. There are multiple steps. He has gone through the process with OAuth and OIDC already. AI: Mike: Rework UIG section on organizations as ROs and RqPs. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 1 Jul 2015 (pre-meeting), quorum is 7 of 13. (François, Domenico, Sal, Mark, Thomas, Andi, Ishan, Robert, Maciej, Eve, Arlene, Mike, Jin) Eve Andi Arlene Thomas Robert Non-voting participants: Justin Adrian Abhi George Colin Marcelo Regrets: Domenico Guest: Jon Neiditz - intended participant - lawyer - consenting adult - leads a practice focused on privacy, consent, cybersecurity Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Possible mistake in the OAuth Resource Set Registration Spec Example
by Farazath Ahamed 16 Jul '15

16 Jul '15

Hi, I think there might be a small error in the example[1]. When creating the resource set description the HTTP PUT method is used instead of the HTTP POST method as described in the spec. I am not sure whether this has already been noticed/reported and being corrected. Please ignore if so. [1] https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg.html#resour… Thanks, -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

2 2

Fwd: A New Model for Consent
by Eve Maler 15 Jul '15

15 Jul '15

I got the opportunity to write a post that was published in the IAPP News blog — then found out they decided to feature it in their widely read Daily Dashboard. A good day for UMA visibility! If you like, you can also RT one (or both :-) of their tweets… https://twitter.com/dailydashboard/status/621195250799783936 <https://twitter.com/dailydashboard/status/621195250799783936> https://twitter.com/dailydashboard/status/621013389914021889 <https://twitter.com/dailydashboard/status/621013389914021889> > Begin forwarded message: > > From: "IAPP Daily Dashboard" <publications(a)iapp-email.com <mailto:publications@iapp-email.com>> > Subject: A New Model for Consent > Date: 14 July 2015 at 6:44:48 PM GMT+1 > To: <eve(a)xmlgrrl.com <mailto:eve@xmlgrrl.com>> > Reply-To: "IAPP Daily Dashboard" <reply-fe9115747360017577-1775_HTML-5175062-7000677-0(a)iapp-email.com <mailto:reply-fe9115747360017577-1775_HTML-5175062-7000677-0@iapp-email.com>> > > To view this e-mail as a web page, go here. <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9c3f840221f37c48400044ca06b7…> > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb997fdb8c6cdc3df69f6436370760…> > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb995a51ec9a26bc8c318596b0f0e5…> > <> > Build your privacy skills > TRAIN IN SAN FRANCISCO > Just announced! Registration is now open for privacy training classes headed to San Francisco. Your class includes everything you need to get started. And if you decide to aim for a credential, you'll have a head start. > October 14-15 > > > Register Now <http://click.iapp-email.com/?qs=605a6ac0ec6aadb98548e42ca90849f77913cfdf1f2…> > INTERNET OF THINGS > A New Model for Consent > With the traditional consent model under threat from the rise of Internet-of-Things (IoT) technology, there may be new and viable consent tools that provide users with control over how their personal data is shared. "A new wave of companies developed two new kinds of consent tools to meet the needs of emerging data-sharing requirements—OAuth and the 'Share' button—and go beyond the minimums required by certain regulators," writes ForgeRock Innovation and Emerging Technology VP Eve Maler in this post for Privacy Tech. Maler delves into these alternative models to demonstrate the potential for real-world practical application for users and businesses in the IoT economy. > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb94fe1214d53be88d91cd8ef03baa…> > PRIVACY BUSINESS > Start-Up Launches Campaign To Boost Two-Factor Authentication > In June, mobile identity company TeleSign commissioned a study on consumers' concerns about online security and their exposure to breaches. It found that, amidst increasing breach reports, 80 percent of consumers are worried about their online security and 40 percent have experienced a security incident within the past year. It also found, however, that 73 percent of online accounts use duplicated passwords and more than half of consumers use five or fewer passwords across their entire online life. Given statistics like those, TeleSign has launched a campaign aimed at educating consumers on what it says is the future of mobile identity: two-factor authentication. In this exclusive for The Privacy Advisor, Angelique Carson, CIPP/US, talks to TeleSign CPO Stephen Bolinger, CIPP/E, CIPP/G, CIPP/US, CIPM, about the initiative. > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9f31a121a3a0799b672de6f1d142…> > PRIVACY LAW—EU > Unraveling the Mysteries of the Trilogue > The trilogue process for the proposed EU General Data Protection Regulation continues this week with the co-legislative bodies of the EU—the Commission, the Parliament and the Council—meeting to discuss Article 3 on the territorial scope of the regulation and Chapter 5 on international data transfers. Still hazy on how the trilogue works? Olivier Proust, CIPP/E, of counsel at Fieldfisher, explains it all in layman's terms in this post for Privacy Tracker. (IAPP member login required.) > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb95366ec92db0bbf227494beabfa8…> > Advertisement > > Case Study: The Business Associate's Guide to Breach Response > Data breaches affect all types and sizes of healthcare organizations. Managing a caring, compliant breach response is no easy feat-especially for business associates with multiple covered entity clients. Here's a scenario of a breach, which affected approximately 338,000 California residents and involved multiple covered-entity clients, and the resulting best practices learned that can help business associates navigate the complexities of such a breach and launch a successful response. > > Read About These Eight Steps <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9250d78dcafd5a18fd361442e073…> > CYBERSECURITY—U.S. > DHS Secretary: Federal Cybersecurity Needs Improvement > In a column for POLITICO, Department of Homeland Security (DHS) Secretary Jeh Johnson updates the public on the current state of cybersecurity efforts within the federal government, noting while much is being done to bolster the nation's cyber framework, more is needed. Johnson writes that information sharing is "fundamental to cybersecurity" and calls on Congress to "expressly authorize the EINSTEIN program" and "eliminate any remaining legal obstacles to its deployment across the federal government." Johnson notes that, "we must incentivize the private sector to share cyber-threat indicators with the federal government ... in a manner that protects privacy and provides protection from civil and criminal liability" and highlights the need for a national breach reporting system and "enhanced criminal penalties for cybercrime." > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb96b6a8ed26f2aaf284f4233a26e9…> > PRIVACY—CANADA > Video: Frank Work on Deconstructing Privacy > Former Alberta Information and Privacy Commissioner Frank Work spoke in his keynote address at the IAPP 2015 Canada Privacy Symposium about the past 35 years of privacy and its evolution. In this IAPP video from his talk, Work, who is now a privacy consultant, tells attendees at this year's Symposium that while he is not going to declare privacy is dead, "I would like to leave you with an understanding of the social forces that I think shape any current view of privacy." > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb90061a673066bf246a5d2ab86c04…> > PRIVACY ENFORCEMENT—U.S. > Cooper: FTC Overreached in Nomi Case > The Federal Trade Commission (FTC) case against Nomi Technologies is based on presumption and apples-to-oranges reasoning, George Mason University School of Law's James Cooper writes for The Hill. After Nomi failed to ensure that the tenets of its privacy policy and in-store marketing campaigns extended to its retailers, the FTC stepped in, using its "Policy Statement on Deception" (PSD) as its legislative rationalization, Cooper explains, writing, "Unfortunately ... the commission appears to assume away the PSD's strictures. It had zero evidence that the ability to opt out of Nomi's encrypted in-store tracking was important to consumers' decisions to frequent stores." Cooper questions, "How did the commission get around the facts? By presuming the materiality of Nomi's promise to provide an in-store opt-out." > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb980364505b250caf34cde3785124…> > Advertisement > > Incident Response Workbook: Prepare Your Incident Response Plan Today > In today's age of shifting cyber risk and large data breaches, the consequences of a poor breach response have never been higher: Sales, company reputation, stock prices, job retention and customer loyalty all hang in the balance. Organizations that are prepared to successfully execute a data breach response plan are able to respond quickly and effectively to the inevitable cyber-breach event, minimizing errors and reducing costs along the way. This workbook <http://click.iapp-email.com/?qs=605a6ac0ec6aadb98a8338e708c45a362679b9db12a…> will help you get started on a custom incident response plan by providing an outline and recommendations for planning a well-orchestrated response to a data breach that includes key considerations for breach preparation and notification. > > Download the Incident Response Workbook <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9ac2b8ec9b5179aed6deef868a7e…> > PRIVACY LAW—U.S. > Recover Act Aims To Assist OPM Breach Victims > Nine House Democrats have unveiled the Recover Act, a bill that would provide "lifetime identify-theft monitoring" for the millions of victims of the recent Office of Personnel Management (OPM) breaches, The Hill reports. "Much of the OPM data is lifetime and permanent background information that cannot be changed like a credit card number," said Rep. Eleanor Holmes Norton (D-DC), whose bill is a companion to one from Sen. Ben Cardin (D-MD). The bill has support from National Treasury Employees Union President Colleen Kelly, who said it "will go a long way toward protecting individuals from ID theft problems stemming from these devastating data breaches." > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb94f90261164928b0e72f438b5698…> > SURVEILLANCE—U.S. > Advocates Cynical as NTIA Drone Talks Approach > On August 3, the National Telecommunication and Information Administration (NTIA) will meet with privacy groups in an effort to understand the regulatory privacy measures necessary for drones, PCWorld reports. This is the third iteration of talks of this nature, which thus far have ended without consensus and with privacy groups leaving frustrated. "Consumer and privacy groups don't have confidence in the process," said Center for Digital Democracy Executive Director Jeffrey Chester. "Protecting privacy from the use of drones requires a serious effort that the NTIA has so far failed to demonstrate." Editor's Note: Joseph Jerome, CIPP/US, recently wrote a piece for Privacy Perspectives <http://click.iapp-email.com/?qs=605a6ac0ec6aadb91a213a9edcdd84591b4360fe471…> on why privacy pros need to be engaged with drone regulations. > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb96f91ee85029101fe7c97778bf3e…> > HEALTHCARE PRIVACY—U.S. > DHHS Settles With Hospital Over HIPAA Violation > After an information-sharing incident gone awry and a data breach, St. Elizabeth's Medical Center faces a $218,400 settlement with the Department of Health and Human Services (DHHS) for failing to comply with the Health Insurance Portability and Accountability Act (HIPAA), The Boston Globe reports. "Organizations must pay particular attention to HIPAA's requirements when using Internet-based document sharing applications," said DHHS Office for Civil Rights Director Jocelyn Samuels, adding, "In order to reduce potential risks ... all workforce members must follow all policies and procedures." A hospital spokesperson said, "St. Elizabeth's has taken steps to ensure this will not happen again." > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb934efc4d442f7617a20390e49ab7…> > Advertisement > > Available Now: Privacy Laws in Asia > With its critical impact on the world economy and global trade, privacy legislation in Asia has been extremely active in the last several years. Get complimentary access to a recently released report, Privacy Laws in Asia <http://click.iapp-email.com/?qs=605a6ac0ec6aadb99e55e3ca11c324bce23627280df…>, written by Cynthia Rich of Morrison & Foerster LLP for Bloomberg BNA. The report provides detailed analysis of the commonalities and differences in the privacy and data security requirements in countries including Australia, India, Hong Kong and more. > > Download Now <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9d5e1af5b34a41dd82e4227971dc…> > INFORMATION ACCESS—U.S. > Poitras Suing Over Unanswered FOIA Requests > Filmmaker Laura Poitras is suing the U.S. government after receiving no response to her Freedom of Information Act requests for documents pertaining to the government's targeting of Poitras at U.S. and foreign airports, The Intercept reports. Poitras was searched, interrogated and detained more than 50 times over six years. Officials seized her notebooks, laptop, cell phone and other personal items. "I'm filing this lawsuit because the government uses the U.S. border to bypass the rule of law," said Poitras in a statement. The filmmaker, who won an Oscar for Citizenfour, said she hopes the suit will also bring attention to those who are less well known but are also harassed at the border. > Full Story <http://click.iapp-email.com/?qs=605a6ac0ec6aadb970fcc853c0573583d4de42882e5…> > <> <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9ec4213c68eaf05f19ffc5f53cb2…> > All Current Job Listings <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9ec4213c68eaf05f19ffc5f53cb2…> > <> > NEW WEB CONFERENCE—MODERN ONLINE AUTHENTICIATION > Thursday, July 16, 1 - 2:30 p.m. EDT > Join us as experienced privacy and security professionals share new and better methods beyond the password. Learn the latest developments in authentication and identity management methods. > > Register Now <http://click.iapp-email.com/?qs=605a6ac0ec6aadb92618ca958ca5b7cbe4173c22465…> > July 14, 2015 > QUICK LINKS > Career Central <x-msg://28/#job> > IAPP Web Conferences <x-msg://28/#wc> > Find Us on Twitter <http://click.iapp-email.com/?qs=605a6ac0ec6aadb99d4f904da51ad0d47a71d7c5a05…> > Resource Center <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9d37bafa241fca2630e44b183f9d…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb971602b9ea73067530bf53f5a6d7…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9b2533f8db351da6fe52cffc9afc…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9e9f62d7de53442a553830d62f6a…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb970252fc8f70eac2bca32588d744…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb933a289ee4aa80eed943b64aff62…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb99e55e3ca11c324bce23627280df…> > > <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9deb4ec4cd96a881da3fdf435e6c…> > > PLATINUM PLUS MEMBERS > » Accenture <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9ec7e280dbc089e0bf3c31e7da9a…> > » Booz Allen Hamilton <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9fc8b84e14fe778602490cf648a6…> > » Capital One <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9ad9b584afcbebb928369d24c109…> > » CVS Caremark <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9b3b1883dc84697d85f2ce76a31d…> > » Deloitte & Touche <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9c17ff9657bec1335d2c9a9f827f…> > » Ernst & Young <http://click.iapp-email.com/?qs=605a6ac0ec6aadb919479d9ca2d9329df7d381a6ab5…> > » Google <http://click.iapp-email.com/?qs=605a6ac0ec6aadb908b17a2772a57a3e37bc7d76ee3…> > » Hewlett-Packard Company <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9dea02aa8aea11a1069a7108c166…> > » Intel Corporation <http://click.iapp-email.com/?qs=605a6ac0ec6aadb97b84c17663b12559eda12b95304…> > » KPMG LLP <http://click.iapp-email.com/?qs=605a6ac0ec6aadb9af6a4a1678d6bb99c146f7c5a4a…> > » Lockheed Martin Corporation <http://click.iapp-email.com/?qs=31418d6a32195a452bb17e84af6fcfe7c3f7e16c9c0…> > » Merck & Co., Inc. <http://click.iapp-email.com/?qs=31418d6a32195a45be9094feef215f36ba17abe5644…> > » Microsoft Corporation <http://click.iapp-email.com/?qs=31418d6a32195a45666de7d5d1adc12ec6f2cde52d2…> > » Oracle <http://click.iapp-email.com/?qs=31418d6a32195a45f3a8af5b9627044f705593cec2d…> > » Pricewaterhouse Coopers LLP <http://click.iapp-email.com/?qs=31418d6a32195a45ca5e94186b041bb58f019cc267b…> > » Promontory <http://click.iapp-email.com/?qs=31418d6a32195a45790bebb468c044fe5e537a6beb8…> > » Teleperformance Group <http://click.iapp-email.com/?qs=31418d6a32195a45dde153352f7504ee90510e778a4…> > PLATINUM MEMBERS > » American Express <http://click.iapp-email.com/?qs=31418d6a32195a455b5266ba184883310c0edb7f2a5…> > » AstraZeneca <http://click.iapp-email.com/?qs=31418d6a32195a4500586a331efa148ed5c9139d93a…> > » AT&T <http://click.iapp-email.com/?qs=31418d6a32195a456d7840fe9b14e68ee03698a8e18…> > » AvePoint <http://click.iapp-email.com/?qs=31418d6a32195a4535a59ce41453effecfa3ea771d3…> > » Baker & McKenzie <http://click.iapp-email.com/?qs=31418d6a32195a456b10c8e9f7d466bce5b4d58af76…> > » Edelman <http://click.iapp-email.com/?qs=31418d6a32195a4581b4d0632b02d9ac468d67076a9…> > » Facebook, Inc. <http://click.iapp-email.com/?qs=31418d6a32195a45a533a3bde0cdcac5ad2edcce1d7…> > » The Nielsen Company <http://click.iapp-email.com/?qs=31418d6a32195a45744f28e88a398b6c74c219a6afa…> > » Ponemon Institute, LLC <http://click.iapp-email.com/?qs=31418d6a32195a45161732a7b036b1df1b76a82d9e8…> > » Reed Elsevier <http://click.iapp-email.com/?qs=31418d6a32195a45e82c6b75c734367606d7e9649d5…> > » Wal-Mart <http://click.iapp-email.com/?qs=31418d6a32195a45a50031a783e1cdabdfb2544f179…> > GOLD MEMBERS > » Amgen Inc. > » Apple Inc. > » Automatic Data Processing > » Bank of America > » Beijing Sogou Technology Development Co, Ltd > » Citigroup > » Hogan Lovells > » Holland & Knight > » Intuit > » Jones Day > » Kroll > » McKesson Corporation > » MetLife > » Protiviti > » Prudential > » Staples, Inc. > » Target > » TD Bank > » TRUSTe > » UnitedHealth Group > » Vodafone Group Services Limited > » Yahoo! Inc. > > SILVER MEMBERS <http://click.iapp-email.com/?qs=31418d6a32195a45b8b9fa1088946928e26c0bdc56b…> > CORPORATE MEMBERS <http://click.iapp-email.com/?qs=31418d6a32195a45b8b9fa1088946928e26c0bdc56b…> > Copyright© 2000–2015 International Association of Privacy Professionals. > The views in this eNewsletter, if any, are those of the authors and are not necessarily those of the IAPP. > > This email was sent to: eve(a)xmlgrrl.com <mailto:eve@xmlgrrl.com> > This email was sent by: INTERNATIONAL ASSOCIATION OF PRIVACY PROFESSIONALS > 75 Rochester Ave., Suite 4, Portsmouth, NH 03801 USA +1 603.427.9200 <http://click.iapp-email.com/?qs=31418d6a32195a455c65fdeb1af9428f7be52dfc3d5…> > We respect your right to privacy - view our statement <http://click.iapp-email.com/?qs=31418d6a32195a4502dd0ffa1d5618447f3d5e417c6…> - view the ExactTarget statement <http://click.iapp-email.com/?qs=31418d6a32195a451fc7f2163a19a1b2c1000be5aa0…> > Manage Subscriptions <http://click.iapp-email.com/?qs=31418d6a32195a45bb9f937f73ade346dc4b1865d0f…> > > Update Profile <http://click.iapp-email.com/?qs=31418d6a32195a45066fde48c2eb4c717d03a7e7ddf…> | One-Click Unsubscribe <http://click.iapp-email.com/?qs=31418d6a32195a4569ef5a72d1e6e4c8742551e2394…> Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

1 0

UMA Issues
by Justin Richer 15 Jul '15

15 Jul '15

As promised, I’ve documented and filed the various bugs in the UMA spec that I’ve found while trying to implement it: https://github.com/xmlgrrl/UMA-Specifications/issues/created_by/jricher <https://github.com/xmlgrrl/UMA-Specifications/issues/created_by/jricher> Most of these would require breaking changes to fix properly, so they’re not really targeted at UMA 1.0 errata in my personal opinion. Several of the issues cascade on one another: for example, fixing #153 as suggested in the ticket would solve a number of other issues simultaneously. — Justin

3 2

Agenda for UMA telecon 2015-07-16
by Eve Maler 14 Jul '15

14 Jul '15

This week we’ll range all around the “BLT sandwich" — first B&L (biz/legal), then spending some time on T (tech). If you have UMA issues you’ve been hanging on to, I encourage you to put them in GitHub <https://github.com/xmlgrrl/UMA-Specifications/issues>. ***IGNORE the dial-in line displayed by join.me <http://join.me/> in favor of the dial-in info shown below (Kantara "line C" and the Skype line)*** http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-16> Date and Time Thu Jul 16 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25> and read into today's minutes the notes of UMA telecon 2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01> and UMA telecon 2015-07-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09>. Quick hits: AI status License/contract/Binding Obs next steps Issue backlog next steps AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

1 0

Draft minutes of UMA telecon 2015-07-09
by Eve Maler 09 Jul '15

09 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09> Minutes Roll call Quorum was reached. Minutes approval MOTION: Robert moves and Sal seconds: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25> and read into today's minutes the notes of UMA telecon 2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01>. APPROVED by unanimous consent. Call logistics Let's stick with our Skype-providing option and Eve will try and remember (everyone please help her) to put something in the join.me chat at the beginning of every call to remind join.me joiners to use the alternate dial-in, not the join.me dial. DONE! Obligations UMA trust, obligations, commitments, transactions, receipts, contracts, licenses... Most important use cases Prepare thoughts and questions for the meeting with Prof. Singh et al. the following day The question arose: How to bind UMA to existing legal structures. "Licensing" is the dominant approach used by lawyers. Does it work in UMA? Prof. Singh introduced some alternate terminology. DRM approaches are another approach. authorization (could be can or can't?) commitment (UMA obligation) prohibition sanction (like a fine) power Eve propose that a "license" model within UMA could look like this: (With some preconditions having been satisfied, such as client credentials being issued, etc.) RO authorizes RqP to access Resource Set(s) to use Scope(s) by adding authorization data to RqP’s Client’s RPT RqP exercises license by having Client access Resource Set(s) using Scope(s) RO is able to withdraw the license by revoking the authorization A challenge with the license model is active revocation. If it appears to be a license for five days, but then the RO revokes the license after two days, what happens? There are technical implications around caching vs. token introspection, checking of expiration periods, and so on (time-to-live management), and also business implications of RqP and client expectations. It could be the case that an access federation trust framework specifies both levels of expectations. If the RO suspects malfeasance, maybe all bets are off and then can revoke immediately. Tim has sent a document called "The New Ontologies - The Effect of Copyright Protection on Public Scientific Data Sharing Using Semantic Web Ontologies" to the list. The attraction here was the notion of machine-readable license language. By contrast, if Alice presents Bob with terms he has to agree to, she could point him to machine-readable terms (which could be the ontology content above), and a "contract" model could look like this: AS, on behalf of RO, offers RqP valuable (this is important) access under terms expressed by policy (the terms are going to result in, e.g., authentication, claims, and any other trust elevation parameters able to be supplied by the RqP) RqP accepts RO’s terms by conveying trust elevation parameters that meet policy — environmental, contextual, and heuristic factors are insufficient to indicate acceptance, while AAT acceptance may be a good indicator of pre-willingness to accept terms later on even when supplying claims implicitly through a client that pushes them silently AS, on behalf of RO, provides consideration by adding authorization data to RqP’s Client’s RPT If you standardize the claims, e.g. for the HIPAA-type "purpose of use", and especially if you standards resource types, the terms would be pretty clear in this case. But it's definitely a more complicated model. If you throw events that are machine-readable during the course of the protocol running, that starts to look like "consent receipts" or similar. Who's interested to meet with the researchers tomorrow? Eve will add Robert to the invite. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Eve: Review Marcelo Wikipedia comments and take next actions. AI: Tim: Expound on the licensing idea in email. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. Let's discuss this at the next LC call. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. PROGRESSING. There are multiple steps. He has gone through the process with OAuth and OIDC already. AI: Mike: Rework UIG section on organizations as ROs and RqPs. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 1 Jul 2015 (pre-meeting), quorum is 7 of 13. (François, Domenico, Sal, Mark, Thomas, Andi, Ishan, Robert, Maciej, Eve, Arlene, Mike, Jin) Eve Arlene Robert Mike Sal George Jin Non-voting participants: Adrian Sarah Scott Fehrman – ForgeRock – pre-sales, former Oracle, former Sun – in identity for 10-12 years Abhi Regrets: Maciej Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 1

Agenda for UMA telecon 2015-07-09
by Eve Maler 07 Jul '15

07 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-09> Date and Time Thu Jul 9 9-10am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: Ignore the join.me dial-in line shown in favor of Kantara line "C" and the Skype line UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25> and read into today's minutes the notes of UMA telecon 2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01>. Quick hits: AI status Summer meeting plans - change anything? UMA trust, obligations, commitments, transactions, receipts, contracts, licenses... Most important use cases Prepare thoughts and questions for the meeting with Prof. Singh et al. the following day AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

join.me dial-in vs. Kantara "line C" and Skype for our meetings
by Eve Maler 02 Jul '15

02 Jul '15

It was noted on the recent call join.me has grown in functionality since we started using Thomas's paid account, and there is now a dial-in number displayed that we are not using; instead we use Kantara's "line C", which comes with a Skype option. Should we continue splitting up the screenshare and the dial-in (and warn people to try and avoid confusion), which has the advantage of offering the Skype option, or align the two so as to fully avoid any confusion? Please express your opinion here (and Thomas, please let us know if this impacts the costs associated with your account), and we will decide on next week’s call. (Please note the potential confusion when dialing in to the normal number next time!) Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 2

Readings on Sociotechnical Systems and Commitments
by Eve Maler 02 Jul '15

02 Jul '15

Readings sent by Professor Munindar Singh: - [Basic: if you have time for one paper] Norms as a Basis for Governing Sociotechnical Systems. This is a five-page extended abstract of a longer journal article. http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/IJCAI-15-TIST.pdf - [Computational mapping to data stores; short but somewhat technical] Cupid: Commitments in Relational Algebra. http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/AAAI-15-Cupid.pdf - [More on the conception of commitments; easy read] Commitments in Multiagent Systems: Some History, Some Confusions, Some Controversies, Some Prospects. http://www.csc.ncsu.edu/faculty/mpsingh/papers/mas/Commitments-for-MAS.pdf Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Notes from UMA telecon 2015-07-01
by Eve Maler 02 Jul '15

02 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01> Minutes Roll call Quorum was not reached (not that it is generally expected in this specially scheduled call). Minutes approval Deferred. Logistics It was noted that join.me has grown in functionality since we started using Thomas's paid account, and there is now a dial-in number displayed that we are not using; instead we use Kantara's "line C", which comes with a Skype option. Should we continue splitting up the screenshare and the dial-in (and warn people to try and avoid confusion), which has the advantage of offering the Skype option, or align the two so as to fully avoid any confusion? Eve will ask on the list and we will decide by next time. Upcoming event in Singapore and UMA-XACML interest Kuppinger Cole conference in Singapore in November: Gil proposes a panel that freshens up the discussion about XACML. E.g., how does XACML plug into UMA? Could it be part of the panel, or maybe be a separate session? And relatedly, might there be interest in developing a profile of XACML for UMA, a profile of UMA for XACML, or both? Eve had written some thoughts following on to Hal Lockhart’s white paper on an XACML profile for OAuth policies, which could provide some food for thought. Eve will ping her colleague Allan Foster, who is Singapore-based, for interest in co-presenting. Colin is interested in the topic; he probably can’t attend if not speaking. Justin would be interested to attend the conference if someone is willing to send him! Gil’s conclusion with his colleague was that XACML policy, or even portions of it, in combination with UMA is a good idea. How would an OASIS/Kantara split of activity work? An active liaison would probably be a good idea. As long as text isn’t quoted, and “incorporating by reference” is okay, then a profile on either end is probably acceptable. The REST profile for XACML was published about six months ago. The UMA FAQ mentions it. Justin’s demo at the HIMSS conference protected XACML policy as an UMA resource! That’s a nice new one. UMA issue backlog Justin has been implementing UMA against an existing OAuth and OpenID Connect server and has been collecting ideas for things that could be optimized or fixed or cleaned up. He’s been sitting on them so far, partly to be sure he understands them fully, and partly not to upset the V1.0 apple cart. His items/ideas include, for example (he has 16): “dynamic endpoint” config data naming (vs. “registration endpoint”) “rpt endpoint” being separate from the ordinary OAuth token endpoint doing an ordinary OAuth token grant, which would allow the client to specify the scopes it wants, which it can’t do now Eve has been thinking about one, which is: Letting an RS register more than one requested permission rather than a single one Binding Obligations Sociotechnical Systems conversation, commitments, and obligations: Eve, Tim, and others are meeting with Professor Munindar Singh and his colleagues on July 10 at 9am PT. If anyone is interested to join the call, drop Eve a line. Eve will send a link to Prof. Singh’s extended abstract and other papers to the list. NZ government POC Colin describes the ongoing NZ government POC. The first sprint is to stand up an UMA out-of-the-box scenario. Governments, like any large enterprise, have issues with delegations: a user wants to delegate access to others out of their account, and there are also “headless” use cases where the user is not present. Colin is not directly involved, but is observing from the side. He’ll give updates as he can. AIs AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Tim: Expound on the licensing idea in email. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. Update: Will try to do this weekend. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Rework UIG section on organizations as ROs and RqPs. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 1 Jul 2015 (pre-meeting), quorum is 7 of 13. (François, Domenico, Sal, Mark, Thomas, Andi, Ishan, Robert, Maciej, Eve, Arlene, Mike, Jin) Eve Sal Thomas Non-voting participants: Gil Justin Dave Adrian Colin Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0