- WG-UMA - mailman.kantarainitiative.org

Facebook launches privacy design lab to create awareness about data sharing
by Maciej Machulak 12 Jun '18

12 Jun '18

https://www.business-standard.com/article/companies/facebook-launches-priva…

1 0

Re: [WG-UMA] Feedback on CIBA
by Mike Schwartz 07 Jun '18

07 Jun '18

MODRNA Group, CIBA was discussed on the UMA WG call today. Eve has been working on a compare/contrast analysis between UMA and CIBA. And this discussion got me thinking a little more... One point from Justin Richer was that you are sending tokens back to the Client Notification Endpoint. This is risky, as you are trusting DNS. UMA makes the client authenticate at the token endpoint to obtain the tokens. Pushing tokens was discussed and dismissed as lacking security. I'm surprised the Open Banking group was ok with this. I also wonder if the response from the bc_authorize should include an id_token--I think it should be some other signed JWT assertion (with many of the claims present in an id_token). It seems weird to me to return an id_token to a client when the subject is not the person connected to the user agent. IMHO, CIBA could be accomplished using UMA as the security mechanism, with bc_authorize as the RS (protected endpoint on the OP). Its request and response would be defined much as you did. If you are starting from scratch, is it easier to implement CIBA with UMA for security, or CIBA plus it's one-off security model? Personally, I think UMA would be cheaper because we'd get more re-use. If I get some time in the next week, I'll try to write up a draft of CIBA using UMA. HEART also uses UMA, so it's not unheard of for an OpenID WG to use it as part of a solution. I know everyone wants to ship ASAP, so it's probably too late to bring this stuff up. - Mike

1 0

Draft minutes of UMA telecon 2018-06-07
by Eve Maler 07 Jun '18

07 Jun '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-05-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31>: APPROVED by unanimous consent. Decoupled flow: continue discussion - "Force authentication"? - Poll with interval vs. use a notification endpoint? The CIBA spec has both a polling mechanism and a client notification endpoint <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>. Mike is concerned that the token passed here is duplicating the function of the state parameter. When the client calls the notification endpoint, it gets back the equivalent of a permission ticket. Then it can present that ticket at the equivalent of the token endpoint and get back a token, or register a callback URL and say it authenticated the person. But isn't this "backwards UMA", because it would say it authenticated Alice vs. Bob? Mike also has a concern about the /bc-authorize endpoint <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…> defined in the CIBA spec, which is basically a new API but not pulled out as a proper API definition. UMA has a claims redirect URI. But it doesn't have any other redirect/callback URI. CIBA suggests another callback URI, that for us might be called an "RPT grant": You get a ticket, you present it at the AS, it returns "OK", and then sometime later, the AS says "I have your RPT" and it sends it back to the client. The comment Mike sent to the MODRNA list about CIBA was: *"In section 6.4. "Token Error Response", There is no way for the user to fix the error if the back channel communication fails. Although you are kicking off the authentication via backchannel, if the user can switch to front channel, she may be able to resolve a problem. For this reason, I would suggest you define a "claims_gathering_endpoint" which can be returned to the client, and in which the user could then interact with the AS. Your claims gathering endpoint could be like an airline quickcode. For example, if I'm working with airline ABC, then the agent could tell me to direct my browser to https://abc.com/ciba/G5JQ2 <https://abc.com/ciba/G5JQ2> Then you have a lot more options to fix the problem (especially if this claims gathering endpoint is on the OP, and you could put the subject through a multi-step authentication workflow)."* Justin notes that CIBA gets that it's not a complete solution. It's identity-focused. UMA is also not complete; it's authorization-focused, and runs in the other direction (Alice to Bob). So the two hurdles to applying UMA-as-it-exists-today to decoupled are a) it runs "backwards" (a big challenge, presumably) and b) it doesn't have a notification endpoint (a smaller challenge, presumably). Justin has been collecting "what do you hate about OAuth2" items. In the chat, Cigdem noted that currently the RO authenticates to the AS for permission purposes and the RS for resource management purposes separately; these are outside UMA's scope. What decoupled seems to look for is authentication of the RO by the AS. Maybe someday there would be a "grand unified theory" version of various specs (OAuth, OIDC, UMA...) that would offer some kind of complete solution for the requirements of decoupled, but today they don't seem to. Mike imagines UMA-protecting the bc-authorize endpoint (effectively the RS role). What would happen? It's an API. It has parameters. They define a permission ticket equivalent (the identifier for the session), and what happens if the person doesn't authorize (similar to UMA's error responses). Part of what they did was needed. What they made up that isn't as "well made up" as UMA, in Mike's estimation, is what happens if the access token is not issued: the authentication error response <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>. UMA allows both back-channel and front-channel loops (this is with the RqP, not the RO, though). Mike is thinking of proposing a "revised CIBA" that uses UMA. To do that, he may need to solve the "backwards" problem! But it would be very interesting to see such a proposal. Enterprise use cases and Gluu Gateway Deferred to next week! Identiverse Justin, Eve, Thomas, Mike, Maciej, Sal, Mark, Colin, and likely other UMAnitarians and Kantarans will be there. 2000 people are expected. They target CxOs and identity architect types. Mark, Sal, and Eve are doing a Privacy 2.0 masterclass. Mike and Eve are doing an UMA2 masterclass. Ping Identity runs it but it's very "ecumenical" in terms of sponsorship. It's in Boston this year. It moves around every year. ZZ Auth and the Love Tokens (featuring Eve, Justin, and others you may know this year [image: (smile)] ) are playing at the closing party. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Andi 3. Maciej 4. Eve 5. Mike 6. Cigdem Non-voting participants: - Justin - Nancy - Thomas - Colin - Tim Regrets: - Sal - Adrian *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: Re: Feedback on CIBA
by Mike Schwartz 07 Jun '18

07 Jun '18

I sent this comment to MODERNA: 2. In section 6.4. "Token Error Response", There is no way for the user to fix the error if the back channel communication fails. Although you are kicking off the authentication via backchannel, if the user can switch to front channel, she may be able to resolve a problem. For this reason, I would suggest you define a "claims_gathering_endpoint" which can be returned to the client, and in which the user could then interact with the AS. Your claims gathering endpoint could be like an airline quickcode. For example, if I'm working with airline ABC, then the agent could tell me to direct my browser to https://abc.com/ciba/G5JQ2 Then you have a lot more options to fix the problem (especially if this claims gathering endpoint is on the OP, and you could put the subject through a multi-step authentication workflow).

1 0

I may be a couple of minutes late opening the bridge today
by Eve Maler 07 Jun '18

07 Jun '18

</eom> Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Did some cleanup work on the business model diagrams/mappings
by Eve Maler 06 Jun '18

06 Jun '18

Not sure we'll work on this at all in tomorrow's call, but I did want to finally clean this up. Please see slides 9-12 <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…> in particular. (Remember, if you haven't accessed the deck before, I'll need to give you permission.) Basically what I've done is convert from a table/matrix approach to keeping the "spaghetti"/visual approach when delving into the particulars of the legal device-to-technical artifact mappings. A sample is below. Jim has mentioned to me that he has a good candidate use case we could POC, and I hope to see him end of next week to work on this a bit. Building up a realistic set of agreements/licenses/resulting artifacts/flows is key. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-06-07
by Eve Maler 06 Jun '18

06 Jun '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-05-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31> - Decoupled flow: continue discussion - "Force authentication"? - Poll with interval vs. use a notification endpoint? - Enterprise use cases and Gluu Gateway - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-05-31
by Eve Maler 31 May '18

31 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-05-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24>: APPROVED by unanimous consent. Pass-downs from the LC - ID Pro memberships available; let the staff know if you're interested - North America member plenary idea: 3 hours or more on Fri Oct 26 after IIW 27 in SF; potential inter-WG efforts? Early thoughts on the plenary: Mike can't make it. Decoupled flow walkthrough Client-initiated backchannel authentication (CIBA <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>) was invented by the MODRNA group. Mike observes that the OAuth password credentials grant, currently being discussed again, is sort of similar. Usage of it is discouraged but it's often a pattern of last resort. Why is it there? To provide a less-completely-horrible way to do what people would do anyway. Really? Harrumph. The grant lets you throw out the password and just deal with the token. And it lets you standardize on OAuth vs. also doing real screen-scraping. The idea in CIBA is that Bob (a call center agent or similar) wants to send a notification to the AS to authenticate Alice out of band. The phishability of both is still a big security consideration. In George's environment, the challenge is to complete the authentication loop without the call center worker party ("Bob") seeing the code or whatever. "Proof of presence" by the user seeking service ("Alice") is insufficient. A fake person pretending to be Alice shouldn't be able just to hit an Approve button. Eve has done an analysis <https://www.websequencediagrams.com/files/render?link=BKzJljUfSJShB3_no57b> attempting to map UMA to the decoupled requirements. We could dictate that request_submitted be used (See Grant Sec 3.3.6 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html#auth…>) and that could trigger a notification flow that requires a specific kind of authentication. Could this be done as a profile? Talking about "sessions" is weird, especially because it may not be about a browser at all, but a mobile authenticator app. What if the Bob side wanted to collect a set of claims? Could the UMA infrastructure for claims collection be leveraged, only in the other direction (by some AS acting on behalf of the RqP)? We're given to understand that polling is considered harmful by OB. CIBA has both polling and notification <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>. Since UMA is so asynchronous in its outlook, would it want to make use a notification endpoint on the Bob side for the Alice side to use? Do we think this approach is interesting to keep analyzing? There's interest among Mike, Bjorn, and Maciej so far. It seems to meet the " *potentially* fit for purpose" bar if we think about request_submitted. Business model device/artifact mapping Eve reviewed the current state. Enterprise use case collection Some thoughts variously from Mike and Eve: UMA and XACML are not necessarily mutually exclusive. However, organizations are struggling to avoid vendor lock-in with XACML and some are looking for new ways to scale better; XACML has challenges with that while the OAuth architecture does better. It can be valuable to do analytics over a standard policy format. David B mentioned OpenPolicyAgent.org <http://openpolicyagent.org/> at EIC, which is a policy engine framework with a policy expression format. ANSI RBAC is a standard, whereas ABAC is not a standard. Justin says, "Yes, let's kill XACML." [image: (smile)] Mike should be ready to demo the Gluu Gateway next week. Let's continue the enterprise discussion next time. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Maciej 3. Eve 4. Mike 5. Cigdem Non-voting participants: - Adrian - George - Mark - Bjorn - Nancy Lush - Lush Group - is on the HEART WG - welcome to the group! - Justin Regrets: - Tim - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-05-31
by Eve Maler 30 May '18

30 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-31 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-05-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24> - Decoupled flow walkthrough - Business model device/artifact mapping - Gluu Gateway demo and enterprise use case collection - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

UMA-related EIC presentations uploaded
by Eve Maler 25 May '18

25 May '18

Hi folks-- You can find my EIC presentations on the wiki: - Kantara pre-conference showcase WG update <https://kantarainitiative.org/confluence/download/attachments/17760302/UMA%…> - Leveraging UMA's Power for Compliance and User Control <https://kantarainitiative.org/confluence/download/attachments/17760302/EIC1…> (this was the one requested during today's call) Both are currently highlighted on the wiki home page. Please feel free to use them and to spread the word. (If you need original PowerPoint versions for some reason, please get in touch with me -- however, I have tried to eliminate fancy animations so that they're easy to print.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1