- WG-UMA - mailman.kantarainitiative.org

Summertime Skew this week
by Eve Maler 28 Oct '19

28 Oct '19

Just a reminder that while the UK (and elsewhere) have “fallen back” in terms of the clock already, the US (and elsewhere) will not for another week. Per tradition we use US time as our anchor. So our UMA calls will appear to shift if you’re in the UK. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

The ACCESS Act could be called the UMA Act
by Adrian Gropper 24 Oct '19

24 Oct '19

Check out https://www.warner.senate.gov/public/index.cfm/2019/10/senators-introduce-b… Especially Section 5: Delegation. (There's a link <https://www.scribd.com/document/431507476/ACCESS-Act-Section-by-Section-FIN…> to a nice summary at the very end of the page.) It calls for a right to specify a fiduciary agent, hopefully one that I can compile and own myself. I can imagine a law like this applying to all of our service providers above a certain size, like say 50 employees. -- Adrian

3 6

Call for agenda items for Thursday Oct 24
by Eve Maler 23 Oct '19

23 Oct '19

This is our "technical" meeting series. Please respond here ASAP if you have completed an action item or would like to bring up a topic or extension draft for discussion. I may cancel if we're not seeing agenda item proposals. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Notes from 2019-10-22 UMA business-legal framework telecon
by Eve Maler 22 Oct '19

22 Oct '19

Current documents being worked on (WG participants will receive edit access for the asking; others may receive view access): - Business-Legal Framework and Use Cases <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> (GDoc) - Mapping Graphics <https://docs.google.com/presentation/d/1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BB…> (GSlides) - Legal Role Definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…> (GSlides) - Definitions and Use Cases Spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> (GSheet) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-10-22 Attending: Eve, Colin, Nancy, Andi, Domenico We worked directly in the document, accepting suggestions and editing the results. We discussed whether we should keep "Alice" for consistency as the resource owner name, vs. use variety (e.g. the "Jane" example as in Andi's new "simple example up top). *AI:* Domenico: In the Mapping Graphics <https://docs.google.com/presentation/d/1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BB…> slide 19 graphic, can he please ensure that the "technical terms" (currently with no-color background outside the legal terms) be distinguished somehow (maybe with italic or with a color background) and be all lowercase? In the Typical Use Case section, let's try telling a brief narrative story about the life insurance use case, either before or after the technical definitions, so as to make it easy for nontechnical readers to understand those definitions. We do need the technical definitions – otherwise we can't delve into the permission token/license work that the paper needs to do. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business-legal framework telecon tomorrow
by Eve Maler 22 Oct '19

22 Oct '19

We’re meeting tomorrow, Tuesday, at 8am PT. Many thanks to those who contributed to document edits last week! Please see previous weekly reminders for relevant links. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Reminder: UMA business-legal framework telecon 2019-10-15
by Eve Maler 15 Oct '19

15 Oct '19

I can't attend myself tomorrow, but Ruth Puente has kindly agreed to open the bridge for this call. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>, our "business model: mapping graphics" deck is here <https://drive.google.com/open?id=1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BBjBB7xG…>, our full/older Legal Role Definitions deck is here <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>, and our draft doc is here <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…>. Trying to access these links will send me a notification to share the docs with you with your preferred ID, if I haven't already given you access. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 3

Call for feedback: meeting schedules and Thursday agenda items
by Eve Maler 10 Oct '19

10 Oct '19

Apologies for the disruptions to my availability of late. I've had some extra travel demands, and Q4 continues in the same vein. Currently, the Tuesday 8am PT meeting series (business-legal framework, goal: draft second report) looks like this: - Oct 15: *meeting sans me, Ruth will open the bridge* - Oct 22: *meeting* - Oct 29: *meeting* - Nov 5: *meeting sans me, or I can cancel -- let me know* - Nov 12: *meeting sans me, or I can cancel -- let me know* - Nov 19: *meeting* - Nov 26: *will cancel due to US holiday* The Thursday 6am PT meeting series (technical, main goals: extension/XYZ use case collection, charter refresh) looks like this: - Oct 17:* need to cancel* - Oct 24: *meeting* - Oct 31: *meeting* - Nov 7: *need to cancel* - Nov 14: *need to cancel* - Nov 21: *meeting* - Nov 28: *will cancel due to US holiday* Note that it's past time for our charter refresh. If people have other thoughts on work items we should attend to in the "Thursday stream", or on meeting schedules generally, then let's please discuss here. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-10-03
by Eve Maler 03 Oct '19

03 Oct '19

(Apologies for having gotten the date wrong in the link before.) https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-10-03 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-09-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19> MOTION: - Minutes of UMA telecon 2019-09-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19> APPROVED. XYZ use cases Eve suggests that, for at least the use cases that UMA doesn't cover today, we should be putting them in our GitHub issues. We can tag them with "extension" and "XYZ", and this allows lookup for anyone who might be interested to create an UMA extension, as well as for anyone interested to see UMA-related use cases that have arisen in the XYZ context and applicable to the universe. As well, if someone is solving such a use case in some other manner, through (say) profiling existing technologies (Sal mentioned signed claims with an expiration date and AS signatures for the *offline RS* use case, along with a smarter client), those could be explored too. So GitHub recording gives us an "all of the above" strategy for solving use cases. Discussing that use case: Cigdem discovered that the ace-actors draft had gotten archived. The "client AS" (CAS) concept was only in that draft. We had thought that this document was key in the thinking of the ACE group (e.g. to recognize "requesting parties"), but they've now backed off of all of that. Sal will help with more offline/IoT use cases. In UMA2 we achieved more IoT friendliness, mainly through explicitly allowing local RS validation of a self-contained RPT (access token) vs. strongly requiring token introspection as in UMA1. Discussing the *Alice-to-Alice* use case: Eve and Justin have had further discussion about whether UMA's method of using the UMA claims collection methods (whether pushing or interaction) for both Alice-to-Alice sharing and Alice-to-Bob sharing is appropriate. Her thinking is that using UMA's method in all cases is appropriate because the RqP's identity isn't known until you collect the claims, and in fact, it's not really an identity at all, it's "some claims" that satisfy policy (or don't). In the Pensions Dashboard use case, it's "little Alice" (lower assurance) using a special account aggregation client vs. the "big Alice" that is highly assured on the resource owner side. And in the case of HEART-style use cases like "btg" (break the glass), it's a lot more like role-based access based on claims sought in policy/supplied. Finally, we found usage of the OAuth authorization endpoint troublesome when used on the requesting side for the AAT because it required early and strong identity-based binding of Bob to the AS, and we could see this getting in our way when use on the owner side if we were to do more work around the Alice-to-AS relationship in future for getting visibility into Alice's assurance level (currently the "AS app" is outside UMA's scope). All this is to say that UMA had its reasons for aligning on its own mechanism for treating all requesting parties alike, and we expect that surely XYZ will too. Peter will attend to his use case on his return. Nominations for chair and vice-chair MOTION: Sal moves and Thomas seconds: Nominate Eve for UMA WG chair and Maciej for WG vice-chair for a new annual term. Motion PASSES by ACCLAMATION. MOTION: Andi moves and Sal seconds: To formally thank our chairs for their service and exemplary leadership on an ongoing basis. [image: (smile)] Motion PASSES by ACCLAMATION. (Eve says thanks!) Attendees As of 16 Jul 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Thomas 4. Andi 5. Eve 6. Cigdem Non-voting participants: - Nancy Regrets: - Maciej - Peter *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-09-19
by Eve Maler 03 Oct '19

03 Oct '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-08-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-08-08> , 2019-09-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-05> MOTION: Approved. XYZ use cases UMA-related use cases collected last time: - *AI:* Eve: Alice-to-Alice sharing (RO-to-self) - In Justin's description <https://mailarchive.ietf.org/arch/msg/oauth/v8TdkruCzwH43FMKS598IC2Sheo> of the "multiple parties" use case (which is generally the "UMA use case"), he says "UMA extends this to allowing the Requesting Party to be the one using the client, but it generally doesn’t collapse cleanly into the cases where the RO *is* the party using the client since the claims gathering endpoint and the authorization endpoint aren’t quite the same in concept." - However, this doesn't seem right. What should happen is that RqP (that we happen to know, if we are outside the system, observing, that the policy happens to match Alice-again, is the RO) should be taken not to the authorization endpoint but to the claims interaction endpoint. We confirmed that Gluu's implementation, e.g., does it this way. If there is no policy whatsoever in place, then Alice-the-RqP's client might get, say, request_denied and Alice-the-RO might be given the opportunity to create a policy for the first time that *happens* to match herself. - *AI:* Eve: Reach out to Justin to discuss this use case. - *AI:* Eve: Proactive Alice-to-org sharing (RO-to-client developer, so to speak) - *AI:* Peter: Bob is assured to a certain level that Alice is who she says she is (strong Alice-to-AS binding or "CIBA-like") - Transactional and long-term management of sharing of preferences with service providers Eve had some one-on-one discussion with Justin about the intended design center of XYZ, transactions, and guessing what might be the impact on client ecosystems (e.g. reducing friction or adding friction). The big security impact is intended to be narrowing the scope and moving from bearer to sender-constrained tokens, and doing it in a simpler and consolidated way, hopefully easier for everyone, including clients. As we push the boundaries of what OAuth was intended to do, it makes sense to refactor. The rise of the Janrains and Gigyas back in the day was a response to OAuth complexity. Anything that sits in the middle that says "redirect to us" – a central session management service – is even simpler. What makes it complicated is making the client smart enough to know what profile to enact. Each profile (e.g., FAPI) has different security characteristics. A key part of the complexity is the number of specs and resulting amount of knowledge you need. This sounds a bit like the Active Directory PAC (privileged attribute certificates) structure history. Do we need one gigantic token that covers all the complexity as the solution? The way to punch out of this paper bag is to get really familiar with all the use cases and truly get experience with the solutions. - Semantics for transactional-level permissions (scope and/or resource) - This one looks covered by Justin's writeup. - *AI:* Cigdem: Disconnected RS when a "handle" for the RS can't be gotten right away - XYZ has a strawman for C-to-RS - ACE has a disconnected RS flow and doesn't use a permission ticket – the ACE model also has a "client AS" where the client itself might be offline - Liberty had a model where an offline IdP could give the client a delegatable token that would allow the client (using the PAOS profile – reverse SOAP...) to mint tokens in a disconnected manner – Thomas notes that these would be considered forwardable/proxyable tickets ACE for a time had a use case for an RS could be a proxy that could help reach an AS for a client if either the RS or client had difficulties getting online, but Hannes did a security analysis <http://st.fbk.eu/sites/st.fbk.eu/files/osw2018-ace.pdf> that seemed to cross that option off the list. Our model would seem to make this highly unlikely to be practical if the AS and RS were loosely coupled. If you have an entirely sender-constrained-token model such that the RS is just an SSL tunnel between the client and AS, only then would it be safe for the RS to proxy token issuance messages. But it seems the paper concludes this is just unwise at all. The last set of use cases to be documented aren't UMA conundrums at all but simply use cases UMA actually solves over and above OAuth today: - *AI:* Eve: Existing UMA use cases that are described in our Grant and FedAuthz spec introductions Next time, let's review people's use case write-ups, including Justin's existing ones. Nominations for chair and vice-chair Let's take up the actual ballot next week. Thursday meeting series Thoughts on making this a biweekly series in Q4? Some sentiment "for". Let's decide next week. Attendees As of 16 Jul 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Maciej 4. Eve 5. Cigdem Non-voting participants: - George - Vlad - Thomas - Colin Regrets: - Andi - Mike *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 3

Agenda for UMA telecom 2019-10-02
by Eve Maler 03 Oct '19

03 Oct '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-10-02 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-09-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19> - XYZ use cases - Nominations for chair and vice-chair - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0