- WG-UMA - mailman.kantarainitiative.org

Meeting schedule for the rest of October
by Eve Maler 09 Oct '17

09 Oct '17

Because the second public comment period on the specs goes till Nov 12, putting the WG calls on hiatus till we get any comments or need to prepare for exiting that period seems to make the most sense for the moment. The Legal calls are going gangbusters, so those should continue. And I've got some travel. So... WG calls on Thursdays at 9am PT: - *Oct 12 no* - *Oct 19 no* (that's IIW) - *Oct 26* *maybe* (stay tuned) Legal calls on Fridays at 8am PT: - *Oct 13 yes* - *Oct 20 no* (I'm traveling and unavailable) - *Oct 27* *yes* I'll adjust the calendar. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2017-10-06
by Eve Maler 06 Oct '17

06 Oct '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-10-06 Attending: Eve, Kathleen, Colin, Tim, Mark, John, Thomas Who on this call will be at IIW? John. We revised the existing train-track diagram in web and OmniGraffle form, and created new ones in the slides <https://docs.google.com/a/meshfire.com/presentation/d/1I12agEsfaJK3LEiJyROr…>. We're not quite done with the RPT diagram, and will also have to create "tear-down" versions. We may also want to create different diagrams for different use cases. We discussed to what extent terms of service/privacy notices ("ToS/PN" in the diagrams) are negotiable. Assuming they are currently not, thinking about the "cascading OAuth" use case where the main AS wants to either give access to resources that the RO doesn't want them to or vice versa, the RS would have to reserve some resources from central protection – which would be inconvenient for the RO. We discussed to what extent model clause text should be "mandatory" for the RqP side. We're not sure how our legal tools will be used; it could be that we should make the RO-side clause text "MUST" and the RqP side "MAY", but in practice it will all be discretionary to use. Maybe some parties picking it up for use will want to make it all mandatory. Note that some use cases will need clever parameterizing within the text, such as trying to require a service to allow "right to erasure" but ensuring allowance for the service to meet data retention requirements. Tim will be able to share the draft framework doc by next week. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

UMA and Rebooting Web of Trust
by Adrian Gropper 06 Oct '17

06 Oct '17

The fifth Rebooting Web of Trust meeting concluded today. Led by Christopher Allen, we gather twice a year to advance standards for self-sovereign identity with trust rooted in distributed ledgers rather than federation. At this point there are five or six implementations based on four different blockchains that participate. Amazingly enough, after years of promoting UMA as a self-sovereign technology standard, this group has noticed and is poised to adopt UMA. The catalyst was the presence of Mark Miller as renowned evangelist for Capabilities-based security architectures. I suspect many UMAnitarains realize this is what we’ve been doing but Mark had not heard of UMA and I had not heard of Capabilities. A rushed summary of how UMA complements blockchain identity standards is here https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/… References at the end of this paper provide background on Capabilities design and link to the early standardization work by the Decentralized Identity Foundation that will likely shift to adopt UMA. At this point, the HIE of One project is the only implementation of self-sovereign identity combined with UMA. You can read our white paper at https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/… This discussion will continue at IIW where many of us in RWoT attend. However, let’s get the discussion started in this thread. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: https://patientprivacyrights.org/donate-3/

1 0

Legal telecon is on for tomorrow
by Eve Maler 05 Oct '17

05 Oct '17

There's been some seemingly unfortunate "SCCs water under the bridge <https://iapp.org/news/a/understanding-schrems-2-0/>" since last week (thanks to Mark L for the link), but we should press on with our framework nonetheless. Domenico and I have gone back and forth on some new graphical elements I can share with you. Tim, if you have any new text work,let me know and I can put it in GDoc. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Considering our WG call tomorrow
by Eve Maler 04 Oct '17

04 Oct '17

Iif we have the UMA WG call tomorrow, on the docket would probably be a) coordinating IIW activities and b) further discussion about conducting interops. Who's interested and can attend? I'll wait till 2pm PT/5pm ET before deciding whether to hold vs. cancel the call. Thanks! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

Extra params in permission ticket response
by Mike Schwartz 04 Oct '17

04 Oct '17

UMA Gurus, https://docs.kantarainitiative.org/uma/ed/oauth-uma-federated-authz-2.0-07.… Section 4.1 Resource Server Request to Permission Endpoint says "it has the following parameters". Can it have extra parameters? The OpenID Connect Core authentication request spec says "Other parameters MAY be sent." - Mike -- ------------------------ Michael Schwartz Gluu Founder / CEO mike(a)gluu.org https://www.linkedin.com/in/nynymike/

3 4

Notes from UMA Legal telecon 2017-09-29
by Eve Maler 29 Sep '17

29 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-09-29 Attending: Eve, Tim, John, Bjorn, Mark Agenda: - What work remains for us to have a complete legal framework? - Getting ready to develop one key set of tools: model clauses / standard contractual clauses (discussed here: http://ec.europa.eu/justice/data-protection/international-transfers/transfe… ) - Could we actually get ours preapproved? - Note controller-to-controller transfer vs. controller-to-processor transfer options, something we’ve discussed in the past Jim pointed out his "Accordified" GDPR text efforts: - DE/FR/NL/EN. (Spanish and Greek also available): http://www.commonaccord.org/index.php?action=list&file=Dx/Acme/09-EU-US-Dat… - E.g., English language version under hypothetical of a UK sub of a US company transfering data to US parent: http://www.commonaccord.org/index.php?action=xEdit&file=Dx/Acme/09-EU-US-Da… - Source: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32010D0087 What's the difference between BCRs (binding corporate rules) and model clauses/SCCs? A set of BCRs is a kind of contract that might have SCCs in it. BCRs are developed in an ~18-month process, and have to be approved in all the various jurisdictions where they apply. BCRs have a lot of upfront cost/time, but save the organization cost/time later. SCCs can also be preapproved, but then each contract overall doesn't have preapproval, so you haven't saved as much cost/time upfront. Is it viable for us as a WG or dot-org to seek preapproval of SCCs we write? Maybe we should ask the Art. 29 Working Party about this. This could be valuable for giving UMA/Kantara visibility at that level. *AI:* Eve: Discuss the proposition of generic preapproval of standardized SCCs with Colin and Andrew. ISO/IEC 29100 <https://www.iso.org/standard/45123.html> is the key privacy framework that defines the terms PII subject, PII controller, PII processor (etc.). (We are using Data Subject etc. in our UMA Definitions Annotated deliverable.) In Consent Receipt, they use PII Subject etc. and recommend parameterizing the language accordingly. We can literally parameterize the language in our SCCs to the extent that we capture our language in CommonAccord. GDPR seems like the most obvious target for our completion of the framework, since it's got the right world attention, deadline, etc. Key questions (which we've asked before): - Can the Data Subject truly serve as their own Data Controller in a permission granting interaction? (Karsten Kinast has said yes before, at least philosophically.) Mark calls this a Master Controller Access Framework. - If yes, does it make sense for our use cases for end-to-end licensing relationships <https://docs.google.com/a/meshfire.com/presentation/d/1I12agEsfaJK3LEiJyROr…> to split out to make the requesting party (and client operator?) become either a) another Data Controller, or b) a Data Processor? Also see the new slide diagram <http://Merging RO-RSO, RO-ASO, and RO-RSO-ASO relationship train tracks> "Merging RO-RSO, RO-ASO, and RO-RSO-ASO relationship train tracks". This shows how our legal framework would work in terms of contract and licensing clause text dependencies. *AI:* Eve: Ask Domenico to take a look at the new diagram. A key theme of our work is to ensconce the twin to GDPR's (never-talked-about, Article 7) "right to withdraw consent at any time" – the right to consent, or not, at any time (vs. simply opting in or not!). The recitals of GDPR are infused with a data subject's rights but oftentimes regulators can't know what's possible in tech until they've seen it with their own eyes. UMA + consent receipts are powerful in this respect. *AI:* Tim: Think about revamping his magnum opus for Eve to "GDoc-ify". *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

We do have a Legal call tomorrow
by Eve Maler 29 Sep '17

29 Sep '17

8am PT, http://join.me/findthomas Topics: - What work remains for us to have a complete legal framework? - Getting ready to develop one key set of tools: model clauses / standard contractual clauses (discussed here: http://ec.europa.eu/justice/data-protection/international-transfers/transfe…) - Could we actually get ours preapproved? - Note controller-to-controller transfer vs. controller-to-processor transfer options, something we’ve discussed in the past Eve Maler (sent from my iPad) | cell +1 425 345 6756

2 1

Fwd: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Eve Maler 28 Sep '17

28 Sep '17

FYI. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Megan Cannon <megan(a)kantarainitiative.org> Date: Thu, Sep 28, 2017 at 9:04 AM Subject: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 To: announcements(a)kantarainitiative.org Cc: marketing(a)kantarainitiative.org, staff(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently concluded a round of public review, compiled comments, updated the original drafts, and approved the *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization* and *Federated Authorization for User-Managed Access (UMA) 2.0*. The documents described below now enter a second 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Document 1: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization (revision 08) Document 2: Federated Authorization for User-Managed Access (UMA) 2.0 (revision 08) Version: 2.0 Document Date: 2017-09-04 Document URLs: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html> and Federated Authorization for User-Managed Access (UMA) 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-08.…> To see a summary of comments and changes made related to the first public comment period, see this Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. Overview of Documents: *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for User-Managed Access (UMA) 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-09-28 *Review period closes: 2017-11-12 at 11:59 UTC* *To Comment on the Specification:* To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION" referencing the section or sub-section number, your comment and your proposed text to change. *Intellectual Property Rights Notice: * In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-11-12 at 11:59 UTC, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Cannon Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo] Click here to unsubscribe: https://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= keohitgu&unsub=1&unsubconfirm=1

1 0

Returning RPT from Resource Server
by Pedro Igor Silva 28 Sep '17

28 Sep '17

Hello, I have an use case where resources from a UMA protected resource server don't require issuance of permission tickets. There is no need for RO approval neither claims gathering flow. But just check if a requesting party is allowed or not to access the resource. I was wondering if I could enable a RS to act as a broker in a way that it could exchange the token the client has with a RPT and then return the RPT to the client. Subsequent requests from client will then use the RPT returned by the RS to access protected resources. With this scenario I'm looking for: * Avoid unnecessary round trips between clients and AS in order to obtain a RPT when a permission ticket is not necessary. * Allow RS to push additional claims to AS with runtime/contextual data and evaluate policies based on these claims. Any thoughts ? Regards. Pedro Igor

2 4