- WG-UMA - mailman.kantarainitiative.org

Reminder: UMA business-legal telecon tomorrow
by Eve Maler 24 Sep '19

24 Sep '19

We meet *8am PT* on Tuesday at https://global.gotomeeting.com/join/857787301 -- see our calendar here <https://kantarainitiative.org/confluence/display/uma/Calendar>. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>, our "business model: mapping graphics" deck is here <https://drive.google.com/open?id=1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BBjBB7xG…>, our full/older Legal Role Definitions deck is here <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>, and our fledgling draft doc is here <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…>. Trying to access these links will send me a notification to share the docs with you with your preferred ID, if I haven't already given you access. Agenda item: - Document the full value and structure of a final WG draft report/spec deliverable. (I think Tim was going to share notes from last week's call that I couldn't join.) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2019-09-19
by Eve Maler 19 Sep '19

19 Sep '19

Here is an informal agenda for tomorrow’s telecon at 6am PT: https://kantarainitiative.org/confluence/display/uma/Calendar https://global.gotomeeting.com/join/857787301 We will work on documenting the UMA-related use cases enumerated in the last meeting. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Our Legal Editor Tim Reiniger in the Information Law Journal
by Eve Maler 17 Sep '19

17 Sep '19

Check out the Autumn 2019 issue of the Information Law Journal: http://www.tshawlaw.com/images/INFORMATION_LAW_JOURNAL_-_volume_10_issue_4.… ...where Tim Reiniger writes, with Stephen Mason, on the important topic of "Human Rights, the United Nations, and Digital Technologies: Configuring Human Rights in Software Code" and makes a connection with several modern technologies you will be familiar with, including User-Managed Access. Please help get the word out! Look for a mention from the @UMAWG Twitter handle. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Re: [WG-UMA] Eve can't make tomorrow's biz-legal call
by Colin Wallis Kantara 17 Sep '19

17 Sep '19

Programs Manager Ruth will open the call for y'all. Thanks Colin On Mon, Sep 16, 2019 at 11:02 PM David J. Thelander < dthelander(a)gravelshea.com> wrote: > That makes good sense Colin. Cheers, D. > > > > > > <http://www.gravelshea.com> > *David J. Thelander* | *Special Counsel* > *Gravel and Shea* > > 76 St. Paul Street, 7th Floor | P. O. Box 369 | Burlington, VT 05401 > T: 802-658-0220 | F: 802-658-1456| M: 415-608-7418 > dthelander(a)gravelshea.com | www.gravelshea.com > Biography > <https://www.gravelshea.com/our-team/special-counsel/David-Thelander> | Download > vCard > <https://www.gravelshea.com/wp-content/uploads/David-Thelander-vCard.vcf> | > @davidthelander > > Click here to check out our “Blockchain Technology” blog > <http://vtblockchainlawblog.com> > The information contained in this transmission may contain privileged and > confidential information. It is intended only for the use of the person(s) > named above. If you are not the intended recipient, you are hereby notified > that any review, dissemination, distribution or duplication of this > communication is strictly prohibited. If you are not the intended > recipient, please contact the sender by reply e-mail and destroy all copies > of the original message. > > > On Sep 16, 2019, at 2:58 PM, Colin Wallis Kantara < > colin(a)kantarainitiative.org> wrote: > > Thanks Tim and David > > It would be preferable to keep the same cadence on the dial in details to > save potential confusion. > > I hope to be able confirm Staff to open the call by time you awaken in the > morning. > > Kind regards > Colin > > > On Mon, Sep 16, 2019 at 10:22 PM David J. Thelander < > dthelander(a)gravelshea.com> wrote: > >> I can make it and can ask my EA to circulate a dial in if that helps. >> >> Sent from my iPhone >> >> >> >> >> <https://www.gravelshea.com/wp-content/uploads/GS-Logo-for-Signature-Block.j…> >> <http://www.gravelshea.com> David J. Thelander | Special Counsel >> Gravel and Shea >> >> 76 St. Paul Street, 7th Floor | P. O. Box 369 | Burlington, VT 05401 >> T: 802-658-0220 | F: 802-658-1456| M: 415-608-7418 >> dthelander(a)gravelshea.com | www.gravelshea.com >> Biography >> <https://www.gravelshea.com/our-team/special-counsel/David-Thelander> | Download >> vCard >> <https://www.gravelshea.com/wp-content/uploads/David-Thelander-vCard.vcf> | >> @davidthelander >> Click here to check out our “Blockchain Technology” blog >> <http://vtblockchainlawblog.com> >> The information contained in this transmission may contain privileged and >> confidential information. It is intended only for the use of the person(s) >> named above. If you are not the intended recipient, you are hereby notified >> that any review, dissemination, distribution or duplication of this >> communication is strictly prohibited. If you are not the intended >> recipient, please contact the sender by reply e-mail and destroy all copies >> of the original message. >> >> >> On Sep 16, 2019, at 2:06 PM, Tim Reiniger <tsreiniger(a)gmail.com> wrote: >> >> I’ll be happy to help with the meeting if Colin finds someone to start >> it! Tim >> >> Sent from my iPhone >> >> On Sep 16, 2019, at 4:00 PM, Colin Wallis Kantara < >> colin(a)kantarainitiative.org> wrote: >> >> Thanks for the heads-up Eve. >> No chance for me to open it on this occasion. >> Sorry folks, but I have a Board Officers meeting right across that time. >> I can ask another Staff member to open it if folks want to proceed with >> the call. >> Cheers >> Colin >> >> >> On Mon, Sep 16, 2019 at 5:29 PM Eve Maler <eve(a)xmlgrrl.com> wrote: >> >>> Apologies. Would others want to carry on during the slot, or should I >>> cancel? Current status is here: >>> >>> >>> https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… >>> >>> I had an action as follows: "Start a skeleton draft doc for next time." >>> (With detail: "Let's start drafting collaboratively. A GDoc is a great way >>> to start, following the (Kantara-inflected) RFC style.") Others offered to >>> help edit collaboratively. >>> >>> We already had a skeleton draft doc following more of a Report style >>> here >>> <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> and >>> it had some old title stuff in it ("business model" language), so I have >>> converted it over in minor fashion. Most of the (placeholder) content is >>> still there, but the skeleton is ready to receive text along the lines that >>> we've been documenting (voluminously) in our notes, slides, etc. Andi, Tim, >>> and Domenico were already added to this doc and I just added Nancy and >>> Cigdem. Others please let me know if you need access! >>> >>> >>> *Eve Maler *Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: >>> @xmlgrrl >>> >>> _______________________________________________ >>> WG-UMA mailing list >>> WG-UMA(a)kantarainitiative.org >>> https://kantarainitiative.org/mailman/listinfo/wg-uma >>> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> https://kantarainitiative.org/mailman/listinfo/wg-uma >> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> https://kantarainitiative.org/mailman/listinfo/wg-uma >> >> >

2 1

Re: [WG-UMA] Eve can't make tomorrow's biz-legal call
by Colin Wallis Kantara 16 Sep '19

16 Sep '19

Thanks Tim and David It would be preferable to keep the same cadence on the dial in details to save potential confusion. I hope to be able confirm Staff to open the call by time you awaken in the morning. Kind regards Colin On Mon, Sep 16, 2019 at 10:22 PM David J. Thelander < dthelander(a)gravelshea.com> wrote: > I can make it and can ask my EA to circulate a dial in if that helps. > > Sent from my iPhone > > > > > <https://www.gravelshea.com/wp-content/uploads/GS-Logo-for-Signature-Block.j…> > <http://www.gravelshea.com> David J. Thelander | Special Counsel > Gravel and Shea > > 76 St. Paul Street, 7th Floor | P. O. Box 369 | Burlington, VT 05401 > T: 802-658-0220 | F: 802-658-1456| M: 415-608-7418 > dthelander(a)gravelshea.com | www.gravelshea.com > Biography > <https://www.gravelshea.com/our-team/special-counsel/David-Thelander> | Download > vCard > <https://www.gravelshea.com/wp-content/uploads/David-Thelander-vCard.vcf> | > @davidthelander > Click here to check out our “Blockchain Technology” blog > <http://vtblockchainlawblog.com> > The information contained in this transmission may contain privileged and > confidential information. It is intended only for the use of the person(s) > named above. If you are not the intended recipient, you are hereby notified > that any review, dissemination, distribution or duplication of this > communication is strictly prohibited. If you are not the intended > recipient, please contact the sender by reply e-mail and destroy all copies > of the original message. > > > On Sep 16, 2019, at 2:06 PM, Tim Reiniger <tsreiniger(a)gmail.com> wrote: > > I’ll be happy to help with the meeting if Colin finds someone to start it! > Tim > > Sent from my iPhone > > On Sep 16, 2019, at 4:00 PM, Colin Wallis Kantara < > colin(a)kantarainitiative.org> wrote: > > Thanks for the heads-up Eve. > No chance for me to open it on this occasion. > Sorry folks, but I have a Board Officers meeting right across that time. > I can ask another Staff member to open it if folks want to proceed with > the call. > Cheers > Colin > > > On Mon, Sep 16, 2019 at 5:29 PM Eve Maler <eve(a)xmlgrrl.com> wrote: > >> Apologies. Would others want to carry on during the slot, or should I >> cancel? Current status is here: >> >> >> https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… >> >> I had an action as follows: "Start a skeleton draft doc for next time." >> (With detail: "Let's start drafting collaboratively. A GDoc is a great way >> to start, following the (Kantara-inflected) RFC style.") Others offered to >> help edit collaboratively. >> >> We already had a skeleton draft doc following more of a Report style here >> <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> and >> it had some old title stuff in it ("business model" language), so I have >> converted it over in minor fashion. Most of the (placeholder) content is >> still there, but the skeleton is ready to receive text along the lines that >> we've been documenting (voluminously) in our notes, slides, etc. Andi, Tim, >> and Domenico were already added to this doc and I just added Nancy and >> Cigdem. Others please let me know if you need access! >> >> >> *Eve Maler *Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: >> @xmlgrrl >> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> https://kantarainitiative.org/mailman/listinfo/wg-uma >> > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma > >

1 0

Eve can't make tomorrow's biz-legal call
by Eve Maler 16 Sep '19

16 Sep '19

Apologies. Would others want to carry on during the slot, or should I cancel? Current status is here: https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… I had an action as follows: "Start a skeleton draft doc for next time." (With detail: "Let's start drafting collaboratively. A GDoc is a great way to start, following the (Kantara-inflected) RFC style.") Others offered to help edit collaboratively. We already had a skeleton draft doc following more of a Report style here <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> and it had some old title stuff in it ("business model" language), so I have converted it over in minor fashion. Most of the (placeholder) content is still there, but the skeleton is ready to receive text along the lines that we've been documenting (voluminously) in our notes, slides, etc. Andi, Tim, and Domenico were already added to this doc and I just added Nancy and Cigdem. Others please let me know if you need access! *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

3 2

Let's cancel our WG call tomorrow
by Eve Maler 11 Sep '19

11 Sep '19

Thomas and I will shortly (over the weekend) be brushing up those 2.0.1 items we spoke about last week, and I've got an unrelated deadline looming, so it seems to make sense to postpone our next WG Thursday call till Sep 19. Thanks. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from 2019-09-10 UMA business-legal telecon
by Eve Maler 10 Sep '19

10 Sep '19

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-09-10 Attending: Eve, Andi, Nancy, Domenico, Vlad, Cigdem Our agenda for today: "Start to document the full value and structure of a final "WG draft report" (or is it a spec?) deliverable that we can put together with all this fodder based on our work over the last several months. We had said our deliverable timing would be September... :)" The value-add of "UMA-biz-legal-relationships" above and beyond "UMA-technical", we think, is that (e.g.) the operator of a service or client, or the RRA or requesting party, can auditably prove what another party needs it to prove regarding a commitment or promise it has made to the other party. And if necessary, if enforcement can't take place at a technical level, it can take place in a court of law as required (because you have audit logs and non-repudiable artifacts to point to). All of these loosely coupled parties need to cooperate and have their interests sufficiently aligned to have selective sharing work. See examples listed in the Sources of liability tension section on the UMA Legal page here <https://kantarainitiative.org/confluence/display/uma/UMA+Legal>. Which party cares most about changes, additions, and subtractions in the RRA role? The ASO. The PAT is the "thin reed" of technology (a technical artifact) that binds the ro, as, and rs. Is it enough to give us a technical means of controlling lots of biz-legal-relationships scenarios? We have several sets of scenarios. One is the ro/RRA state diagram. A second could be a rqp/Requesting Agent/Requesting Party state diagram (that doesn't exist yet). A third that doesn't have a diagram yet is where only policies (a non-UMA artifact) change in response to the ro/RRA sharing on the basis of a relationship. Example: Alice wants to share a set of resources with "whoever is in the 'spouse' relationship" with her. If she indicates that no one is now in that relationship, her policies reconfigure and sharing ends. What's attractive is that both Alice and the ASO and RSO(s), by extension, can all know that sharing ended even if it's a big complicated set of resources that was shared. In this third case, is it really in our scope to be talking about these policies? We could say they're out of scope, but some "consent" (could be described as authorization policy and sometimes is) data formats are standardized, e.g. in HL7 (a Consent record) and XACML, and it is sometimes desired to "federate" consent servers, and even though UMA doesn't standardize policy data formats, it's sort of an adjacent use case. It exists on a continuum with UMA use cases. Plus, all three sets of scenarios seem to end up needing to be combinatorial at the end of the day. Note that HL7 federated consent implies that you have a federated consent server that you can read and interpret. Consent itself is PHI (personal health information). While UMA technically doesn't require policy conditions to be stored at an AS (this is deployment-specific), it does assume policy-setting can happen at the AS; there are numerous examples in the specs throughout. And the privacy considerations in UMA FedAuthz <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0…> talk about PII involved in resource registration and policy-setting only implicitly ("the authorization server may come to learn a great deal of detail about Alice's health information just so that she can control access by others to that information"). For example, if Alice tells her AS to share all her data except HIV-related data, that exposes that she may have HIV-related data. The HEART profile for OAuth/FHIR <https://openid.net/specs/openid-heart-fhir-oauth2-1_0.html#rfc.section.8> tries to protect against assumptions about existence of confidentiality/sensitivity scopes, but it's still hard not to make assumptions. Just because you *can* separate the AS and RS, it doesn't mean they're necessarily in separate organizations/domains. Some privacy considerations may not apply in cases where they are run by the same organization. Let's start drafting collaboratively. A GDoc is a great way to start, following the (Kantara-inflected) RFC style. Andi and Cigdem are willing to jump in on co-authoring with Eve. Nancy is willing to be backup [image: (smile)] after the next two weeks. AI: Eve: Start a skeleton draft doc for next time. AI: All: Sort through the next two batches of scenarios and work on the wording we're using in the second scenario batch in our next meeting. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business-legal telecon tomorrow (30min earlier than usual)
by Eve Maler 09 Sep '19

09 Sep '19

We meet *7:30am PT* on Tuesday at https://global.gotomeeting.com/join/857787301 -- see our calendar here <https://kantarainitiative.org/confluence/display/uma/Calendar>. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> and some new diagrams are in our "business model: mapping graphics" deck <https://drive.google.com/open?id=1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BBjBB7xG…>. Trying to access these links will send me a notification to share the docs with you with your preferred ID, if I haven't already given you access. Agenda items: - Start to document the full value and structure of a final "WG draft report" (or is it a spec?) deliverable that we can put together with all this fodder based on our work over the last several months. We had said our deliverable timing would be September... :) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-09-05
by Eve Maler 05 Sep '19

05 Sep '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-05 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019- <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-06-20> 08-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-08-08> Deferred. Status on UMA2 IETF I-Ds Our I-Ds have expired. Even though we (meaning Eve) didn't minute it very thoroughly, we did conclude (didn't we?) that we wanted to go the independent/individual submission route. We would need to resubmit the drafts and change the tag to Informational. Then we'd have to get in touch with the area directors. There are two formatting issues created in making the I-Ds – these are totally I-D artifacts: - The UMAGrant link in the references section of FedAuthz is broken. - In the UMAGrant spec, the union/intersection set math symbols didn't come out right. In addition, we may want to consider absorbing a couple of GitHub issues that would make this turn into an UMA 2.0.1 because of our semantic versioning commitment: - 362 <https://github.com/KantaraInitiative/wg-uma/issues/362> (IANA registration of "UMA" scheme) - #362 takes an email and some time for registration (assuming they accept it). Our argument for inventing the scheme was that a client playing in both UMA-grant and other-OAuth-grant ecosystems would need to get the "UMA" scheme signal in order to know how to respond, so it's needed for interoperability. We would like to *register the scheme*. - 361 <https://github.com/KantaraInitiative/wg-uma/issues/361> if it's a non-normative change to metadata) - #361 needs investigation on our part. Are we compatible with the constraints on the .well-known path? We say in UMAGrant Sec 2 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html#as-c…> that "The discovery document MUST be available at an endpoint formed by concatenating the string /.well-known/uma2-configuration to the issuer metadata value defined in [OAuthMeta]". So if the issuer has a path in it, our language might break. In principle, most people don't use paths unless they deploy a multi-tenant platform, and that's when they run into issues with our now-OBE language. Some options: 1) We could put in non-normative language that warns people that, say, they could run into problems with multi-tenant path use cases or something given that we're not pointing to the final metadata RFC and this could be changed in a future version. Or 2) We could just not do anything for now. The sentiment is to choose *option 2*: Don't do anything for now. - 360 <https://github.com/KantaraInitiative/wg-uma/issues/360> (typo) - #360 is easy to decide. *Fix the typo.* An UMA 2.0.1 is still "UMA2". It's a patch release that fixes a couple of unimportant bugs. George and Thomas speak in favor. We had looked up whether Kantara has an errata process and it sort of may, but this should be better since most people, especially devs, have a strong expectation of what patch numbering means. We should publish any patch spec versions (on the KI site) in the same place as the original version, such that if you expected to get "UMA 2.0.0" but there is, say, an "UMA 2.0.2" available, you get that in the same location. An "UMA 2.1" would be in a different location because semantically that's significant. Nancy notes that a use case where the AS is not the IdP is something she's running into now. Eve is finding that this is where deployments might typically choose interactive claims gathering, PCT usage, etc. Contributing to XYZ use cases Justin sent this compendium of use cases for XYZ <https://mailarchive.ietf.org/arch/msg/oauth/v8TdkruCzwH43FMKS598IC2Sheo> to the OAuth list. OAuth2 had baked into it the concept of "grants", and that meant a lot of things got squished into grants. Extensibility is in XYZ, but it comes in different ways. Might this mean there won't be an explosion of specs over time, the way OAuth2 was susceptible to? Weirdly, client IDs aren't there, error messages on the front channel... They're not there because you don't need them. We should be sure to capture, not just use cases that OAuth is struggling with, and use cases that UMA solved because OAuth couldn't do them on its own, and use cases that UMA is struggling with, but also use cases that people have pressed OAuth and UMA into service for "just fine" as far as they are concerned but they're not at all sure how XYZ would solve. George would like to be able to define and name an extension with a clear set of functionality. UMA-related use cases Eve would like us to write up: - Alice-to-Alice sharing (RO-to-self) - Proactive Alice-to-org sharing (RO-to-client developer, so to speak) - Bob is assured to a certain level that Alice is who she says she is (strong Alice-to-AS binding or "CIBA-like") - Transactional and long-term management of sharing of preferences with service providers She would be grateful for volunteers to help draft some of these for next week. IETF 106 is in November in Singapore. Justin will be there in person. He's working on hopefully having them hold a BOF on XYZ there. Thomas advocates for a new WG. Nominations for chair and vice-chair Voting deferred. We do have a meeting next week. Attendees As of 16 Jul 2019, quorum is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Thomas 4. Maciej 5. Eve 6. Cigdem Non-voting participants: - Pete Palmer - George - Justin - Nancy - Lisa - Vlad *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0