- WG-UMA - mailman.kantarainitiative.org

Notes from UMA telecon 2015-07-01
by Eve Maler 02 Jul '15

02 Jul '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01> Minutes Roll call Quorum was not reached (not that it is generally expected in this specially scheduled call). Minutes approval Deferred. Logistics It was noted that join.me has grown in functionality since we started using Thomas's paid account, and there is now a dial-in number displayed that we are not using; instead we use Kantara's "line C", which comes with a Skype option. Should we continue splitting up the screenshare and the dial-in (and warn people to try and avoid confusion), which has the advantage of offering the Skype option, or align the two so as to fully avoid any confusion? Eve will ask on the list and we will decide by next time. Upcoming event in Singapore and UMA-XACML interest Kuppinger Cole conference in Singapore in November: Gil proposes a panel that freshens up the discussion about XACML. E.g., how does XACML plug into UMA? Could it be part of the panel, or maybe be a separate session? And relatedly, might there be interest in developing a profile of XACML for UMA, a profile of UMA for XACML, or both? Eve had written some thoughts following on to Hal Lockhart’s white paper on an XACML profile for OAuth policies, which could provide some food for thought. Eve will ping her colleague Allan Foster, who is Singapore-based, for interest in co-presenting. Colin is interested in the topic; he probably can’t attend if not speaking. Justin would be interested to attend the conference if someone is willing to send him! Gil’s conclusion with his colleague was that XACML policy, or even portions of it, in combination with UMA is a good idea. How would an OASIS/Kantara split of activity work? An active liaison would probably be a good idea. As long as text isn’t quoted, and “incorporating by reference” is okay, then a profile on either end is probably acceptable. The REST profile for XACML was published about six months ago. The UMA FAQ mentions it. Justin’s demo at the HIMSS conference protected XACML policy as an UMA resource! That’s a nice new one. UMA issue backlog Justin has been implementing UMA against an existing OAuth and OpenID Connect server and has been collecting ideas for things that could be optimized or fixed or cleaned up. He’s been sitting on them so far, partly to be sure he understands them fully, and partly not to upset the V1.0 apple cart. His items/ideas include, for example (he has 16): “dynamic endpoint” config data naming (vs. “registration endpoint”) “rpt endpoint” being separate from the ordinary OAuth token endpoint doing an ordinary OAuth token grant, which would allow the client to specify the scopes it wants, which it can’t do now Eve has been thinking about one, which is: Letting an RS register more than one requested permission rather than a single one Binding Obligations Sociotechnical Systems conversation, commitments, and obligations: Eve, Tim, and others are meeting with Professor Munindar Singh and his colleagues on July 10 at 9am PT. If anyone is interested to join the call, drop Eve a line. Eve will send a link to Prof. Singh’s extended abstract and other papers to the list. NZ government POC Colin describes the ongoing NZ government POC. The first sprint is to stand up an UMA out-of-the-box scenario. Governments, like any large enterprise, have issues with delegations: a user wants to delegate access to others out of their account, and there are also “headless” use cases where the user is not present. Colin is not directly involved, but is observing from the side. He’ll give updates as he can. AIs AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Tim: Expound on the licensing idea in email. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. Update: Will try to do this weekend. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Rework UIG section on organizations as ROs and RqPs. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 1 Jul 2015 (pre-meeting), quorum is 7 of 13. (François, Domenico, Sal, Mark, Thomas, Andi, Ishan, Robert, Maciej, Eve, Arlene, Mike, Jin) Eve Sal Thomas Non-voting participants: Gil Justin Dave Adrian Colin Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Reminder: "APAC-friendly" UMA call in less than an hour, for those able to join
by Eve Maler 01 Jul '15

01 Jul '15

Calendar here: http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01 Agenda here: http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01 Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Few clarifications for UMA implementation
by Farazath Ahamed 30 Jun '15

30 Jun '15

Hi All, I am in the middle of implementing the UMA 1.0 core specification for WSO2 Identity Server. I would be grateful if someone could clarify the below points. 1. How do we relate the user consent types with each protected resource when validating in Authorization API? By user consent type what i mean is how the user would give his consent for access( policy, SMS, email etc.). Do we need to sort of maintain a mapping somewhere during implementation? 2. The spec says the on the wire RPT is an opaque string which resolves to an extended JWT. During implementation I am confused whether to maintain a mapping between a unique string to a JWT containing RPT details or to encrypt the RPT(extended JWT) and send it to the client as the RPT string. What would a good approach? -- *A.Farasath Ahamed* Undergraduate | Department of Computer Science and Engineering,University of Moratuwa Article Writer | MoraSpirit Mobile: +94 777 603 866 Blog: http://thepseudocode.blogspot.com E-Mail: mefarazath(a)gmail.com

2 2

Agenda for UMA telecon 2015-07-01 - Wednesday for most, Thursday at an "APAC-friendly" time for others
by Eve Maler 29 Jun '15

29 Jun '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-07-01> Date and Time Wed Jul 01 2-3pm Pacific / Thu Jul 02 "APAC-friendly" Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-06-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25>. Quick hits: AI status August meeting plans? Binding Obs AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

1 0

Draft minutes of UMA telecon 2015-06-25 (call next week is at APAC-friendly time -- see calendar!)
by Eve Maler 27 Jun '15

27 Jun '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25 Minutes Our next call will be at the APAC-friendly time. Roll call Quorum was reached. Minutes approval MOTION: Andi moves: Approve the minutes of UMA telecon 2015-05-28 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-05-28> and UMA telecon 2015-06-04 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-04>, and read into the minutes the notes of UMA telecon 2015-06-11 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-11>. APPROVED by unanimous consent. Plenary report Kantara's work streams are increasingly significant. The two streams are Connected Life (where UMA sits), and Trust Services. The IRM and Identities of Things work streams are very cool, and Consent Receipts has major synergies with our work. The presentations were of high quality. Links to materials are coming soon. Eve gave an UMA wireframe demo using a "connected car" use case. The Twitter stream from the plenary is here <https://twitter.com/search?q=%23trustkantara&src=typd>. Interop tests Since the last time we talked about this, the OIDC test suite actually launched. Thinking in terms of all of UMA, OIDC, SAML, and OAuth, it's useful to come up with a lowest common denominator. Roland has in mind a common platform, with branches that are specific to each of the four. In the last week, he's been preparing a new version of the OIDC suite – "V2.0". He'll be ready to move to the other protocols soon. A SAML project is getting going, with Internet2, the Austrian government, and others contributing to the costs. The actual writing of the test suite is less work than test design and result interpretation. Rushing to implementation may almost work against our goals. Since a standard is written in natural language, a test suite "of record" ultimately becomes kind of a harder-edged version of the spec because it's machine-readable. It's "the spec" as far as implementers using the spec are concerned. Our goal is not to do what the OIDC conformance test suite developers did in a few cases, which was to make the test suite tighter than the specs. If we find any deltas in interpretation that require changes to the spec, we will go through the appropriate process to change it. But our goal is consistency. How should we prioritize? What entity/ies should we test first? The AS is the target Roland and Eve were thinking of first. The RS is perhaps another candidate since it's server-side, though it shares the problem that OAuth has always had regarding interop testing, in that most of its interface is entirely unstandardized. The earliest stuff in the spec is the "least interesting" from an UMA perspective. But the most core UMA stuff needs tester intervention. This actually gets into the question of natural variability of use cases that exercise different options in the spec, such as claims-gathering from human requesting parties vs. autonomous web service clients. Could we use "profiles" to distinguish these for testing purposes? Justin suggests standard sets of attributes a la OIDC for UMA. Mike points out that the OIDC claims are LDAP-unfriendly due to their use of underscores. Eve points out that OIDC claims are available for standardized exchange in UMA today. So are we interested in a interop testing profile so we can just "get on with it" as an interop simplifying assumption? It sounds like that's where our heads are at for now. Does it make sense to bat around a single test (or test of related tests) on email? There are no juicy in-person opportunities coming up until IIW, by which time we hope to have a test suite ready to try out. Here's <https://rp.certification.openid.net:8080/test_list> how spec references might look, in the form of the emerging OIDC RP test suite. (The OP tests didn't have this, and it led to endless queries.) August/September will be the active test suite development period for the WG. Outstanding AIs AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Marcelo: Review the Wikipedia page(s) for potential revision (multiple languages). DONE. Eve can take the comments and revise the English, from which others can revise the other language. AI: Tim: Expound on the licensing idea in email. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Rework UIG section on organizations as ROs and RqPs. AI: Eve: Update GitHub. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 11 Jun 2015, quorum is 8 of 14. Eve Arlene Mordeno - attended CIS UMA preso - involved in CSA and IAM generally Sal Mark D Domenico Marcelo Andi Mike Maciej Thomas François Ishan Non-voting participants: Sarah Justin Roland Abhi - now based in the US! Katie Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 2

Re: [WG-UMA] Agenda for UMA telecon 2015-06-11 - special 90-minute meeting with Roland
by Abhimanyu Yadav 25 Jun '15

25 Jun '15

Dear all, After a bit of a hiatus, while I was taking a break to relocate from the UK to San Francisco in the US, I am excited to be able to rejoin our regular calls, and this working group as a non-voting but participating member. While I have met some of you in person, I see there are new members in the group as well. So therefore for a quick intro: I lead the services group at Simeio and I have several years experience in customer facing roles, assisting clients in multiple verticals define IAM strategies and deliver solutions. I hope I can contribute to this group in a meaningful way, and look forward to the opportunity to working with you all. Regards, -Abhi -- *Abhimanyu Yadav **| Vice President* (m) +1 512 771 8659 Identity: Secure, Intelligent, Managed www.simeiosolutions.com On Tue, Jun 23, 2015 at 8:23 AM, Eve Maler <eve(a)xmlgrrl.com> wrote: > http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-25 > Date and Time > > - *Thu Jun 11* 9-10:30am PT - *special extra-long meeting* > - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international > dial-in lines <https://www.turbobridge.com/join.html>), room code > 178-2540# > - Screen sharing: http://join.me/findthomas > - UMA calendar: > http://kantarainitiative.org/confluence/display/uma/Calendar > > Agenda > > - Roll call > - Minutes approval > - Sample motion: Approve the minutes of UMA telecon 2015-05-28 > <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-05-28> > and UMA telecon 2015-06-04 > <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-04>, > and read into the minutes the notes of UMA telecon 2015-06-11 > <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-06-11> > . > - Quick hits: > - Kantara virtual plenary report > - AI status > - Interop testing - create single Platonic ideal test writeup > - AOB > - > > > Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | > Calendar: xmlgrrl(a)gmail.com > > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/wg-uma > > -- The information in this message may contain confidential information and may be legally privileged. It is intended solely for the individual(s) named. Access to this email by anyone else is unauthorized. Please notify the sender immediately if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Email transmission cannot be guaranteed to be secure or error-free, as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. When addressed to our clients any decisions or recommendations contained in this email are subject to the terms and conditions expressed our contract and related statement of work letter(s)

1 0

FYI, the UMA-dev list has now been removed
by Eve Maler 24 Jun '15

24 Jun '15

…as was previously announced. Here was the note sent to that list on June 8: "As this list doesn’t receive any legitimate traffic, and (lately) quite a lot of illegitimate traffic, and as it has never really seen the traffic we anticipated, we’ve decided to shut it down. We encourage interested parties to join the wg-uma list (http://kantarainitiative.org/mailman/listinfo/wg-uma/) either as lurkers or as full participants (http://signup.kantarainitiative.org/?selectedGroup=11) We may revisit this decision if circumstances change in future. If you have any questions, please let me know." Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0