- WG-UMA - mailman.kantarainitiative.org

Agenda for UMA telecon 2018-04-12
by Eve Maler 11 Apr '18

11 Apr '18

Lots happened at IIW 26, so we'll be reviewing that and deepening the formal model work. Let me know if you want to bring up extensions or other items as well. https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29> - IIW report - Legal formal model - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-03-29
by Eve Maler 29 Mar '18

29 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>: Deferred. Legal formal model The "UMA Legal role definitions" slide deck is here <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>. Eve will give access to any UMA WG participant. Discussion about the parties, especially the agents: Are we factoring in the question of the sources of identity? UMA at the technical layer is agnostic as to the source: local, federated, whatever. It could be self-sovereign, as HIE of One does. But what about the quality of the identity? Shouldn't that be a matter for the business layer? Yes; each deployment should be able to build on our "meta-layer" to specify its requirements in order to manage liability. The Origo implementation uses identity assurance in exactly this manner. So could an organization be the Data Subject Agent for an individual Data Subject? In the NZ case, that's how the "headless user" worked. In fact, if a human administrator for the government agency creates the account and policy for elderly citizen Aroha, then they could be an Agent for the Data Subject Agent, but presumably at some point that's out of the view of the original Data Subject. Can the government be an RSO? In the Origo case, they are one of them. Additional scenarios: 1. ASO acts as an RSO and runs all rs == OAuth-ish 2. ASO acts as a CO and runs all c == no 3rd party client ecosystem 3. DS/DSA is an I, AAA ASO, and as dedicated to that single ro (“personal as”) 4. (Could add many others here to account for federated identity) In the chat: - in the real world today, at which point does Mom/Dad become a Data Subject Agent to child? Is it at the point where they exit the hospital or registers the baby? - Is EquiFax my Data-Subject-Agent? - So the NZ Gov becomes the RO, ASO, Data-Subject0-Agent - This almost means that there will never be Data-Subject-Agent because all the current holders of my data will say they are the RO. - @Tim: would it be useful to try map the UMA Legal entities with the Uniform Fiduciary Access entities? They call RO as "Person". Person" means an individual, estate, business or nonprofit entity, public corporation, government or governmental subdivision, agency, instrumentality, or other legal entity... - @Adrian: you can always extract potions of the UMA legal whitepaper for your use-case. - What law have some states passed? States as in EU, UK or as in U.S. States? - The RUFADA law IIW session ideas Thomas plans to convene a session on his decentralized OAuth I-D. This also relates to the topic above, which perhaps deserves a dedicated session. Upcoming schedule The Friday legal meeting schedule is on hold for now. We won't meet on Thu Apr 5 because of IIW, nor Thu Apr 19 because of RSA. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Eve 4. Mike Non-voting participants: - Thomas - Justin - Tim - Adrian Regrets: - Maciej Guests: - Brad Arlen (CEO of OneMe, privacy-as-a-service startup) - James Willett (of OneMe) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-03-29
by Eve Maler 27 Mar '18

27 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01> - Legal formal model - IIW session ideas - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

For this week's WG call: draft formal legal model
by Eve Maler 27 Mar '18

27 Mar '18

I'd like to start "crossing the streams" between our typical WG work and the legal (business model) work because the latter has critical dependencies on UMA technical artifacts and machine readability and auditability of the flows. To that end, I'm going to put "UMA legal" topics on the regular Thursday call agenda. *We'll pause the Friday meetings for now.* There are some new diagrams at the end of the "UMA Legal role definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>" slide deck that essay a draft formal graph-like model for the legal parties and technical entities. I'll try and enhance it further before the call. (Please visit that link and request access if you don't already have it -- sorry, that's the only way I can manage access to that particular doc...) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

The Nightmare GDPR Letter
by Adrian Gropper 19 Mar '18

19 Mar '18

This letter seems like a nice way to sell UMA to industry as core to both compliance and customer satisfaction. How many of the issues raised in this letter would be solved by outsourcing to a patient-controlled authorization server? https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-unde… -- Adrian

1 0

No meeting tomorrow / Other schedule notes
by Eve Maler 07 Mar '18

07 Mar '18

Last week we said “Unless a request for an extension erupts, let's not meet next week.” There has been no such eruption. Reminder: There is already no Legal call on Friday. Please note: I’ll be traveling the following TWO WEEKS and will need to cancel the March 15-16 and 22-23 calls. This is a good chance for those wanting to propose extensions, profiles, and/or security considerations to write them up in easily consumable fashion for discussion in later calls. As I had noted, I do plan to push forward on already-mentioned Legal deliverables in the meantime by reaching out to some of you in email for review. Finally, if anyone approximately London-based wants to get together at/near IETF 101, let me know! Eve Maler (sent from my iPad) | cell +1 425 345 6756

2 1

No Legal call on Friday of this week
by Eve Maler 05 Mar '18

05 Mar '18

Unfortunately I'm unavailable at that time. I'll try and send some ad hoc thoughts on the "formal model" topic in the meantime. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2018-03-02
by Eve Maler 02 Mar '18

02 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-03-02 Attending: Eve, Colin, John, Kathleen, Mark, Tim, Thomas, Bjorn Status update on the publication of the business model doc: It is finally posted! The listing on the Reports & Recommendations page needs to be fixed, but you can point people directly here <https://kantarainitiative.org/file-downloads/uma-business-model-0-7e-2018-0…> . We kind of need a UML diagram (or some kind of graph that lets us label the arcs) to express our delegation and licensing relationships more clearly, and we may need more role names for clarity as well. For example, a Resource Owner "is-a" Data Subject Representative (or whatever we want to call it – that's what GDPR calls it) but we have gone directly from DS to RO in our delegation mapping step. It would be clearer if we had a formal model that went: - DS delegates-X-rights-to DSR (the mechanism for this might be law, by contract – e.g. a will...) - DSR is-a RO - RO delegates-X-rights-to ASO - etc. Can we get hold of a UML modeling expert to ensure we don't miss any of the relationships and roles? In terms of finding one – or multiple – use cases to map onto the model, Eve is talking to 2-3 candidates about this. The complete list of agreements that seem to be possible in our model so far (the purple ones weren't mentioned in the business model paper yet): - Agreement that turns a service provider into an RSO (wasn't included in business model report) - Agreement that turns a service (or app) provider into a CO (wasn't included in business model report) - Agreement that enables a Person to act on behalf of a Data Subject [which puts them into position to act as a Resource Owner -- otherwise RO=DS] - Agreement(s) that delegates authorization for an ASO to grant access permissions on behalf of an RO (typically Ts & Cs, privacy notice, EULA...) - Agreement(s) that delegates authorization for an RSO to manage resources on behalf of an RO (typically Ts & Cs, privacy notice, EULA...) - Agreement that enables a Person to act on behalf of a Requesting Party [which puts them into position to act as a Requesting Party Agent -- otherwise RqPA=RqP] - Agreement that delegates access seeking to a CO on behalf of a Requesting Party - Agreement that delegates permission to know and persist personal data to an ASO on behalf of a Requesting Party It sounds like we need to do this for the POC: 1. Complete the formal model (and likely express it in a formal way) 2. Construct the set of agreements and licenses (or whatever the latter end up being in the case of individual permissions?) in a skeletal CmA format 3. Use the CmA format to invite UMA deployers to work with us on testing the format by applying their use cases A central element of our proposal is that licenses have the right design characteristics to give ROs (acting on behalf of whoever the DS is) to enable the autonomy, reciprocity, and objectivity needed above and beyond contracts. Regs variously require policy elements of the contracts to enable the individual to have certain rights. "Right of action" in healthcare is one. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

We really do have a Legal call tomorrow
by Eve Maler 02 Mar '18

02 Mar '18

...to flesh out the POC planning. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-03-01
by Eve Maler 01 Mar '18

01 Mar '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-02-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-22>: APPROVED. Report on number of downloads Downloads of the PDF versions of the Recommendations on the increase, seemingly because of the press release that was put out. Call for interest in RS/C open source Eve is increasingly asked about libraries for RS's and clients. Gluu's OXD has a lot of language support. Its approach is to have a middleware service, with connectors. They're working on a Kong proxy that acts as an UMA RS. It swaps the contents of the authorization header for an RPT. Mike thinks the barrier to writing UMA client software is pretty high; the same is sort of true for OIDC, as demonstrated by the sheer number of libraries. So maybe with UMA a "clean slate" approach could be taken vs. just making random libraries. The demand surely seems to be there. Might this an IIW topic? Who is attending in the spring (Apr 3-5)? Mike, Eve, Sal possible, Thomas hopefully. Scope expression extension discussion Mike's email proposal is here <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/ESSwRI7B-…>. The idea is that it wasn't clear whether somebody meant "this scope AND this scope" or "this scope OR this scope" in selecting scopes in a policy-setting interface. He came across JSON Logic, a standard format for expressing Boolean expressions in JSON. There are some GUI tools out there with the ability to take JSON Logic and do something with it. He proposes extending the resource description with a scope_expressions parameter, which adds relationships of the scopes provided in the resource_scopes parameter. Example: An RS admin configures a /profile path into their API gateway; in order to do a GET on that endpoint, you need either a Customer or Partner scope and must have the 2Factor and FraudOk scopes. This drives resource registration. (The Gluu Gateway, coming out in roughly early April, will be MIT-license open source, but OXD will be a licensed solution, Mike says.) In FedAuthz Sec 3.1 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0…>, notice that we've been somewhat ambiguous about whether any resource_scopes are required to be supplied: "resource_scopes: REQUIRED. An array of strings..." Conclusion for now: There's no particular urgency around this. It would be good if Gluu writes up a "clean' extension document that could enable others to interoperate on the basis of this extension parameter and its operating rules. If there ends up being a community of interest around the extension, then that suggests it's worth taking up as a work item in the WG. Upcoming work Unless a request for an extension erupts, let's not meet next week. Note that gathering new security considerations also counts as "enhancing the current specs" for purposes of the fresh roadmap/charter we just hammered out. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Yuriy - Thomas *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2