- WG-UMA - mailman.kantarainitiative.org

Agenda for UMA telecon 2017-11-16 (important meeting - please attend)
by Eve Maler 15 Nov '17

15 Nov '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-11-16 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-08-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03>, UMA telecon 2017-08-17 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-17>, and UMA telecon 2017-09-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-09-14> - Finalization of Draft Recommendations - Issue #358 <https://github.com/KantaraInitiative/wg-uma/issues/358> resolution – see proposal in email <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/QUDHjPWke…> - Consider motion to approve specs - Timeline - Progression of specs - Meeting schedule - UMA2 logo - New candidates to consider - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Distributed OAuth draft
by Justin Richer 15 Nov '17

15 Nov '17

Dick Hardt is proposing a Distributed OAuth system: https://tools.ietf.org/html/draft-hardt-oauth-distributed I've brought up that this is potentially related to UMA 2.0's solution space, and Dick has stated that he believes that they're solving a subset of UMA's problem space, and therefore don't need a lot of the functions and structure in UMA. Something to look into for people in this group, and perhaps even engage on the IETF side. -- Justin

2 1

Preparing for progressing the specs / discussing and deciding new issue #358
by Eve Maler 15 Nov '17

15 Nov '17

I've edited the Grant spec to take care of the two outstanding editorial issues (but haven't published it yet), and also the Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. In the meantime, we received a late-breaking issue from an external commenter that I put into issue #358 <https://github.com/KantaraInitiative/wg-uma/issues/358>. I'll duplicate the text here so we can hopefully discuss and decide it efficiently, in email and if necessary in our upcoming call on Thursday: *Authorization should be under the purview of the relying party* *Referencing sections 3.3.1, 3.3.2, 3.3.4, and 6.2 of the UMA 2.0 Grant for OAuth 2.0 Authorization, our comments are as follows.* *Authorization of a client should strictly be under the purview of the relying party, who would use their own sources of information about the client to determine that authorization. Including any information beyond an identity credential score with the credential itself invites invasion of privacy and trackability. Claims, then, should not contain personally identifiable nor sensitive information. Authorization must be separate from authentication.* *The real-world analogy is the key master of a room. The key master is responsible for issuing and revoking keys and for knowing who those keys are given to; the keys themselves do not contain information about the person holding that key.* Please weigh in with your comments. I will try and do so myself when I get a chance later tonight. The goal is to wrap up all outstanding issues (as of now, this is the only one; the comment period closes at 11:59 UTC today) ASAP and vote out the (edited as required) specs for the LC to certify as ready for All-Member Ballot. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

6 10

Notes from UMA Legal telecon 2017-11-10
by Eve Maler 11 Nov '17

11 Nov '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-11-10 Attending: Eve, Jeff, Devon, Theresa, Mark, Kathleen, Tim, Ann, John Doc homework: - A very early section (the first?) should present the "pain point" by introducing several broad scenarios, including an Alice-to-Alice, Alice-to-Bob, and Alice-to-org, drawing from deliverable #1. It could introduce the language of "resource owner" and "requesting party". We could note that org-to-whoever sharing is out of scope for this exercise (framework). We could have a very high-level version of the x-and-y-axis scenario diagram that just talks about these two roles. and then the version with the three high-level scenarios. - In NewSec, we want to make the strongest case we can for our chosen legal devices, and ultimately for our biggest target type of toolkit (templates of some sort). - Later, we can get into the sub-scenarios we have collected, e.g., Alice as a guardian of a data subject too young to consent etc. The "collaborative diagrams" in the GSlides need more differentiation and "iconification". "Model clauses" specifically means they need regulatory approval, so how about "template clauses" or even "clause templates" or something? Templates will do for now. Let's get more specific about pain points. "Through a combination of strengthening data protection regulations, justified consumer cynicism and savviness about poor security and AdTech/MarTech ecosystems, and good rationales for data sharing, particularly in the cases of healthcare and the Internet of Things, we're seeing people start to be given just a little more transparency into and control of their personal data. Organizations have never had more incentives to make changes and reduce friction..." The healthcare construct of a "consent directive" can be directly and favorably compared to ToS opt-in (or, for that matter, opt-out – soon to be made effectively illegal by GDPR) as a mechanism for inviting individuals to express their data sharing preferences in ways that are not influenced by outside actors. UMA enables this construct to be digitized in a standard and repeatable way. This framework enables it to be AIs: - Eve: Create two new scenario diagrams ready to put into the GDoc: - Very high-level diagram introducing "RO" and "RqP" language - Fixed three-scenarios diagram - Tim: Flesh out the licensing framework itself - Possibly this includes the rationale as started in the comment on NewSec Be sure to see all the new comments in the doc. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Last Chance: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Megan Cannon 11 Nov '17

11 Nov '17

Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently concluded a round of public review, compiled comments, updated the original drafts, and approved the User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for User-Managed Access (UMA) 2.0. The documents described below now enter a second 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Document 1: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization (revision 08) Document 2: Federated Authorization for User-Managed Access (UMA) 2.0 (revision 08) Version: 2.0 Document Date: 2017-09-04 Document URLs: <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html> User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization and <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-08. html> Federated Authorization for User-Managed Access (UMA) 2.0 To see a summary of comments and changes made related to the first public comment period, see this <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o f+Comments> Disposition of Comments document. Overview of Documents: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization: This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. Federated Authorization for User-Managed Access (UMA) 2.0: This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-09-28 Review period closes: 2017-11-12 at 11:59 UTC To Comment on the Specification: To comment please email your comments to <mailto:staff@kantarainitiative.org> staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION" referencing the section or sub-section number, your comment and your proposed text to change. Intellectual Property Rights Notice: In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-11-12 at 11:59 UTC, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member's patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email <mailto:staff@kantarainitiative.org> staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at <mailto:staff@kantarainitiative.org> staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Cannon Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 | M: +1.781.258.5523 megan(a)kantarainitiative.org <mailto:megan@kantarainitiative.org> kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA

1 0

Legal call is a yes for tomorrow
by Eve Maler 10 Nov '17

10 Nov '17

Talk to you all then. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Yes, Legal is meeting tomorrow
by Eve Maler 02 Nov '17

02 Nov '17

We won’t have Tim with us. He’s asked us to focus on figuring out which diagrams to use to accompany the text, starting with the sharing scenarios. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Upcoming meetings and timeline for the 2.0 specs
by Eve Maler 01 Nov '17

01 Nov '17

Hi folks-- Unless someone raises a hand to discuss something more urgently, here is what I suggest for a timeline in the upcoming weeks (Legal calls will proceed apace): - Thursday Nov 2: no meeting (this week) - Thursday Nov 9: no meeting (next week) - Sunday Nov 12: second public comment period ends at 11:59 UTC - *Monday Nov 13: e-ballot starts*, to approve the Draft Recommendations as amended and forward them to the LC for certification for All-Member Ballot (see below) - *Thursday Nov 16: quorate meeting to review where we are, possibly foreshorten e-ballot, look at logos...* There are currently three outstanding issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>. Two are editorial and easily disposed of. One is Pedro's issue, which is intended to be a suggestion for an extension rather than a new V2.0 feature. (Since the issue was submitted during the second public comment period, I just wanted to make this clear, so it's not a surprise when we take no action at this stage and record it in the Disposition of Comments document.) Assuming there are no more comments, I'll plan to prepare a rev 09 of Grant for the occasion of the Nov 13 e-ballot (FedAuthz is currently unaffected by the comments). We'll revise as necessary depending on what other comments come in. Please let me know if you have any questions. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

WebFinger for Resource Discovery
by Pedro Igor Silva 01 Nov '17

01 Nov '17

Hello, Have you ever considered WebFinger [1] to discover resources protected by a resource server ? For instance, that could help clients to obtain from the RS itself the resource identifier and AS in order to obtain a RPT without a permission ticket. [1] https://tools.ietf.org/html/rfc7033 Regards. Pedro Igor

2 1

Projects by IF as a small business using personal data
by Eve Maler 27 Oct '17

27 Oct '17

I've pointed to these folks before; they're a design studio doing excellent work on privacy and consent. Here's a great article <https://iapp.org/news/a/looking-at-how-our-small-business-uses-data-a-gdpr-…> at IAPP on how they have analyzed and captured their own use of personal data as GDPR enforcement approaches. It's a microcosm of how big orgs should perhaps be doing it. (And Jim H, they're using GitHub to capture the diffs to their data use statement... :-) ) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1