- WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] Human Agency has a Standard
by Adrian Gropper 17 Jun '19

17 Jun '19

of course... On Tue, Jun 11, 2019 at 3:29 AM Eve Maler <eve(a)xmlgrrl.com> wrote: > Hi Adrian — I’ve left just Justin on here for the moment (since he’s on > the UMA WG), and added Tim (as our Legal Editor). Your writeup is > interesting. Would you be willing to send it to the UMA WG for comment > before final publication? > > My only comment for now is that I’m unclear on the first delegation and > which spec/relationship it refers to. It would be great to be able to point > to the specific one(s) we mean in our spaghetti diagram. > > Eve Maler (sent from my iPad) | cell +1 425 345 6756 > > On Jun 10, 2019, at 9:13 PM, Adrian Gropper <agropper(a)gmail.com> wrote: > > I've been asked to explain, in non-technical language, what the UMA > standard is and why it's essential to many of the the conversations related > to privacy that I'm involved in. > > > https://docs.google.com/document/d/112GrR_i7HgstckRSiamlpu6scLV4dqroImFAjwD… > tries to do that. I am cross-posting in the hope that comments either on > the doc or on the specific discussion lists will improve this doc prior to > public posting. > > TIA, > Adrian > > -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: https://patientprivacyrights.org/donate-3/

3 3

Draft minutes of UMA telecon 2019-05-30
by Eve Maler 30 May '19

30 May '19

(The agenda/minutes page will be updated when I'm able to log in to Confluence.) *Agenda* - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28>, 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04>, 2019-04-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18>, 2019-05-23 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23> - Meeting times and upcoming schedule - UMA interop results session at Identiverse - Continue IETF 105 and OAuth.XYZ/transactional authorization discussion - Business-legal framework (was business model) update - AOB *Minutes* *Roll call* Quorum was reached. *Approve minutes* - - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28>, 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04>, 2019-04-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18>, 2019-05-23 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23> MOTION: Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28>, 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04>, 2019-04-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18>, 2019-05-23 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23>. APPROVED by acclamation. *Meeting times and upcoming schedule* Peter can't make our Thursday call times, nor even Tuesdays. Dare we renegotiate? Q2 has been especially bad for others as well (Andi for Identiverse, Mike for the “world tour”, identity conferences generally). Peter’s standing conflicts are unfortunate but there will always be someone. Eve could offer occasional ad hoc catchups (perhaps using the Friday 7am slot, particularly if that already works for Peter) for those who persistently can’t make (intended to be) quorate meetings, though it may mean Peter might need to step back from his voting status if we keep the meetings where they are. Let’s see if a second voting participant starts having problems with the current Thursday slot and only reassess then. We're off both *Jun 6* (chair unavailable) and also *Jun 13* (Identity Week in London). We do have a meeting on *Jun 20*, before Identiverse. *UMA interop results session at Identiverse* Gluu has started to collect interop results on this page <https://github.com/GluuFederation/UMA-interop/blob/master/interop_results.md>, against their endpoints. So far there are results from Keycloak and Identos, and results from WSO2 are coming. Mike reports that Identos did a great job, even submitting PRs against the Gluu code, and not needing any direction. Right now Gluu’s test code doesn’t have a developer on it, but Mike is happy to have someone take over maintenance. Alec explains that the PRs he submitted reflected “client differences”, but he hasn’t yet deployed Gluu Gateway to test against it. There is a hosted version of the GG that would assist in testing, so Mike is thinking about making that available. Then we could just point people to the endpoints. Andi is working on trying to find us an interop results report-out session. It could be just a “BOF” type of session over lunch or something. Alec/Identos will be at Identiverse, and could run such a session. (Yay!) We’ll have to see how formal or informal the session might end up being, but at least now we could say that there are some substantial results to report, and this would stimulate more interest, more results to be reported, and more implementations to come out of the woodwork. Mike notes that GG is going to be re-licensed, such that it will have a free tier in a transaction volume pricing model. *UMA on Facebook* FYI, we’re shutting down the UserManagedAccess Facebook page due to lack of interest (and Eve leaving Facebook!). Should we create some sort of LinkedIn page for UMA? It could be an organization. Kantara <https://www.linkedin.com/company/kantara-initiative/> has a LinkedIn page. Mike mentions that he is an UMA WG member, and can’t link that mention to the organization. Also, any tweets from the UMAWG handle could be posted automatically to LinkedIn as well. Things like a mention of Mike’s blog post that he’s about to put up (about his demo of UMA+Axiomatics XACML policies) could be on both Twitter and LI. *AI:* Eve: Consult with Colin on the idea of making the UMA WG a LinkedIn “company” that people can link to when they say they’re a member of it in their profiles. *Continue IETF 105 and OAuth.XYZ/transactional authorization discussion* See our notes <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23> from last week. Eve reached out to both Justin and Hannes regarding our new inclination to change what we recommended to the OAuth WG. Thomas thinks “informational” is good because the specs would remain the most stable, if we continue down the new path we’re thinking of. So that would mean we would file the two UMA2 specs as informational RFCs. Mike would prefer that any version of UMA that starts being unstable again not be called “UMA”. Nancy comments on the amazing collaboration of subject matter experts in the venues she has experienced. Work at the OAuth WG level wouldn’t reflect the collaboration we’ve had here. If we don’t see interest in adoption from the OAuth WG, on the other hand, we might not want to stimulate too much demand in the sense that it stimulates desire to change UMA in backwards-incompatible ways. *AI:* Eve and Thomas: Send info to the list on what next steps would be in turning the UMA specs into informational RFCs, especially given our already-done contributions. Rich mentions that there needs to be higher awareness of UMA among other Kantara WGs. Eve points to lots of material on our wiki home page, including “UMA 101” slide decks. Eve is willing to join WG meetings to walk through that material as interest arises. Rich will be a liaison! *Business-legal framework (was business model) update* There's a new spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> reflecting our use cases work. Our notes are kept here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Please ask to be added to the calendar invitation if you're not on it. There are some new and interesting topics of a technical nature coming up there. *Attendees* As of 28 May 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Rich, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Rich Furr - new voting participant - coming out of (boring) retirement to join us for pro bono work - 20-year career Air Force, signals intel, biopharma (SAFE), Kantara’s birth, IAWG, HIAWG 3. Maciej 4. Eve 5. Mike Non-voting participants: - Adrian - Alec - Mark - Nancy - Thomas Regrets: - Lisa - Cigdem *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Agenda for UMA telecon 2019-05-30
by Eve Maler 29 May '19

29 May '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-30 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> , 2019-04-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18> , 2019-05-23 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23> - Meeting times and upcoming schedule - Continue IETF 105 and OAuth.XYZ/transactional authorization discussion - Business-legal framework (was business model) update - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

UMA business-legal framework telecon notes 2019-05-28
by Eve Maler 28 May '19

28 May '19

(Note the change to the name of this meeting series.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-05-28 Attending: Eve, Cigdem, Domenico, Lisa, Colin, Adrian, Tim Suggested agenda: - Capture additional use cases people have on their minds (up to some limit so we can get to the other items too) - Decide what to do about "Proxy" and "Org equivalent of a Data Subject" as legal roles - Start to figure out/capture technical "links-to" relationships that enable us to go from "code" to "prose" There is work going on on a protocol called ALIAS <https://github.com/progressive-identity/> that is built on OAuth/inspired by UMA. Mehdi Medjaoui is involved; Eve saw a demo. She's begun discussing with him and his colleague the potential for getting together on something like "privacy-enhanced UMA" here based on the fact that our business model work is going in this direction (sewing together the technology with the legal and business layers) and folks like Identos have been extending UMA explicitly in a similar direction. ALIAS has an artifact called a "bind token" that cryptographically binds the RRA (ro), RSO (rs), and ASO (as) (their version). Did Airside Mobile do something like that too? Adrian points out that "business model" in a business context usually means "How does this organization make money?" Other people also thought that was the meaning. That's not what we've been meaning by it – rather, we've meant the set of relationships that obtain among the parties (vs. the relationships that obtain among the technical entities as defined by the specifications). So, should we call this a "legal framework" instead? Business-legal *<something>*? Something very important hinges on the AS-RS separation, which conveys a main benefit. Let's try *business-legal framework* for now and see how it feels. Is *relationships* a word we can work with somehow? Domenico suggests *business relationships for UMA deployment*. Sometimes Eve has used "deployment use cases" to reflect the fact that they have concrete jurisdictions, people, companies, etc. Do we actually need a word for "Proxy"? Our diagrams and text use cases in the original slide deck don't seem to need it. Tim hasn't found a single word that perfectly fits the concept, and using Proxy may not even be legally accurate. Note that this sort of (Agency contract, Access contract) delegation is a delegation of management, not of ultimate sharing. It's a kind of "delegated administration for consumers". But certainly, those liable for releasing access will want proof that the licensor has delegated authority. As few words as possible between the original concept and the UMA mapping, the better! But do we still need some consistent word for the person who is the non-data subject administrator, perhaps Representative? Perhaps we simply need to recognize the patterns in play by adding their relevant relationships (e.g., the addition of the relevant parties, relationships, and legal devices). This could work elegantly. Eve will try to convert over to that. (Cigdem has also sent thoughts to Eve.) Adrian wonders if we have now collected enough use cases, since we've now sussed out whether the AS or the RS is the focus of the use case. Eve's theory is that, while there is likely a small and finite set of patterns, it's still interesting to capture further use cases as they arise, since real life is "messy" and we may learn from corner cases. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business model telecon tomorrow
by Eve Maler 28 May '19

28 May '19

...at 8am PT, at this GTM: https://global.gotomeeting.com/join/857787301 <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…> <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…>Last meeting notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. I've continued to fill out a lot of basic information in the Business Model Use Cases spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>. All of the terms from the first Report are now in there. Tomorrow, let's try to achieve the following: - Capture additional use cases people have on their minds (up to some limit so we can get to the other items too) - Decide what to do about "Proxy" and "Org equivalent of a Data Subject" as legal roles - Start to figure out/capture technical "links-to" relationships that enable us to go from "code" to "prose" Please note that I'll have to *cancel* the business model meetings for *June 4* and *June 11 *due to chair travel. June 18 is still on. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-05-23
by Eve Maler 23 May '19

23 May '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-05-23 MinutesRoll call Quorum was not reached. Approve minutes - - Approve minutes of UMA telecon <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28, 2019-04-04, 2019-04-18>2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28, 2019-04-04, 2019-04-18>2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28, 2019-04-04, 2019-04-18>2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> Deferred. IIW and EIC updates Eve gave HEART updates at both events, and did an UMA 101 session by request at IIW, which was well-attended. There were "cross-community" discussions at IIW. Here are the IIW 28 notes <https://iiw.idcommons.net/IIW_28_Session_Notes>. Adrian has sent some thoughts to our list. How could you accept VCs at the claims gathering (interaction) endpoint? Adrian is involved in 3-4 other projects that are trying to figure out machine-to-machine interactions in the "agent" sense. UMA and the SSI work seem complementary. George wonders if so – conceptually perhaps, but protocol-wise, perhaps no. Matt Hailstone/Nathan George/Eve had a session at IIW <https://iiw.idcommons.net/XACML_/_ABAC_/_UML_2.0_and_SSI_Policies> discussing the "policies" and "permissions" topic. Adrian observes that UMA invented an AS and SSI invented a wallet and they're 70% like each other – but George pushes back on the characterization. UMA's design center has enabled it to apply to "today's web" and the API economy directly. And it has already been applied to uPort. Does it make sense to document (profile) how it works with specific SSI-type technologies in the places where it has touchpoints with identity, including a resource owner's identity interactions with an RS, and with an AS, and an AS's claims collection methods for the requesting side? Eve's conversation with a rep for HL Indy yesterday revealed some clear deltas between UMA's capabilities/deficits and those of an Indy wallet. UMA doesn't do cryptographic proofs and proof requests around the permissioning model, but it enables asynchronous sharing (proactive and access approval options), sharing with autonomic third parties using clients (requesting parties), sharing of access to arbitrary resources behind APIs (such as control of devices, inserting data in, large volatile data sets, etc.)... A DIF identity hub is apparently a cloud agent. EIC had a lot of AI sessions this time. It's being used to detect fraud (when you're "not you"). Context is important to detecting and reducing what the user has to consent to. This perhaps connects to the "risk-based authentication" type of topic that comes up when we've discussed the Keycloak extension for fine-grained authorization. The RS passes along claims at permission request time to the AS, after having had the client attempt access to the resource. The "claims" the RS passes along could consist of observations made about the client at that time, such as apparent IP address, etc. The AS could use those as part of its later authorization assessment, e.g, comparing them to the client that shows up later at the token endpoint. That's a good chance to use "context". IETF 105 and OAuth.XYZ/transactional authorization discussion IETF 105 is coming up July 20-26 in Montreal. <https://www.ietf.org/how/meetings/105/> Eve is planning to go, and is planning to do an "UMA Q&A" with the OAuth WG there. Who else is attending? No one else currently on the call. Justin has submitted an I-D for his "XYZ" proposal <https://oauth.xyz/>, called "transactional authorization". He's been coordinating with Torsten Lodderstedt on it. This I-D is influenced by a lot of UMA ideas and other ideas; for example, the "transaction handle" is basically a permission ticket. Given that this new I-D has a lot of promise and we think there's evidence of appetite in that community to work on it (we'll know a lot more by the end of July), maybe we should change our recommendation about the UMA2 contributions to say that they should be published as-is as individual I-Ds. The upside: Stability for UMA2 with something of an IETF imprimatur. The downside: It wouldn't have gotten the total IETF workup from that community. Business model update There's a new spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> reflecting our use cases work. Upcoming meetings We're meeting next week. We're not meeting Jun 6. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Eve 3. Cigdem Non-voting participants: - Adrian - George - Nancy - Colin Regrets: - Andi *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-05-23
by Eve Maler 22 May '19

22 May '19

Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> , 2019-04-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18> - IIW and EIC updates - IETF 105 and OAuth.XYZ/transactional authorization discussion - Business model update - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Business model telecon notes for 2019-05-21
by Eve Maler 21 May '19

21 May '19

(To get access to the spreadsheet linked below, please request access individually, and I will add you.) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-05-21 Attending: Eve, Nancy, Lisa, Tim, Cigdem, Adrian, Domenico, Mark Our goals in filling out the new use cases spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> are: - Make crystal-clear the legal-technical mappings - Link to definitive definitions (and figure out which concepts need new terms and better definitions, and figure out if we need to refine our definitions in a new report vs. the first report) - E.g., define a new Proxy/Agent/whatever term? Define a term for an organization that is the equivalent of a "data subject" (the information is "about it") only it's not an individual? - Get people to put their hands up in identifying which use cases they care about, and add new use cases - Figure out how to incorporate all the necessary complex information into licenses, such as covering Requesting Agents and Requesting Parties as required (Dr. Bob and the institution he works with, e.g.) Our hope is that there are some kinds of licensing that you can boilerplate, a la Creative Commons. That has been the premise behind our looking at CommonAccord.org, which literally has a GitHub system for reuse of legal text (and the Ricardian system in general: prose, code, parameters). Also, jurisdictions will suggest some similarities. (See our very early UX work <https://kantarainitiative.org/confluence/display/uma/UMA+User+Experience>.) But there is extreme variability that can arise based on things like the types of resources and scopes; for example, "getting some data" is different from "controlling a smart camera". Eve's "new permission taxonomy" lists five possible axes of control: Scope, Grantee, Environment, Usage, and Downstream. UMA as a technical layer enables three of them. Legal licensing is needed for Usage (e.g., preventing usage for marketing purposes) and Downstream (e.g., specifically, preventing sharing with a further requesting party that doesn't share the same AS as the initial requesting party). Adrian suggests following up to learn about the work of this group <https://identity.foundation/working-groups/storage-compute.html>. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 4

Reminder: UMA business model telecon tomorrow (Tue May 21)
by Eve Maler 20 May '19

20 May '19

At 8am PT, at our usual GTM: https://global.gotomeeting.com/join/857787301 In our call, I would like to propose a framework, or maybe it's a set of building blocks, for cataloguing different real-world relationships that exercise our "UMA legal party" definitions and tease apart those vs. the "UMA technical entity" definitions, to help us map use cases to them. This exercise is neutral with respect to what type of identity system any one deployment uses; we can get into that level as soon as we see how the use cases (and their "owners" in the real world) fall against the framework. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…> and our most recent email thread is here <https://kantarainitiative.org/pipermail/wg-uma/2019-May/thread.html>. (I can't seem to find our Google Groups archive; checking into that now.) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: Information about User-Managed Access (UMA)
by Colin Wallis Kantara 14 May '19

14 May '19

Folks Can we help Philip with this request? Kind regards Colin ---------- Forwarded message --------- From: Philip Kershaw - UKRI STFC <philip.kershaw(a)stfc.ac.uk> Date: Mon, May 13, 2019 at 3:29 PM Subject: Information about User-Managed Access (UMA) To: federatedIdentity-members ( federated identity system for scientific collaboration) <federatedIdentity-members(a)cern.ch> Hi all, I’m looking for practical applications of UMA in the research community. Can anyone provide me any pointers or contacts? Thanks, Phil

2 1