- WG-UMA - mailman.kantarainitiative.org

Fwd: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0
by Eve Maler 28 Sep '17

28 Sep '17

FYI. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Megan Cannon <megan(a)kantarainitiative.org> Date: Thu, Sep 28, 2017 at 9:04 AM Subject: Public review for comments and IPR review for Kantara Initiative UMA 2.0 Grant for OAuth 2.0 Authorization and Federated Authorization for UMA 2.0 To: announcements(a)kantarainitiative.org Cc: marketing(a)kantarainitiative.org, staff(a)kantarainitiative.org Dear Kantara Initiative Members and Community, This is a formal notice. Members of the Kantara Initiative User Managed Access Work Group (UMAWG) have recently concluded a round of public review, compiled comments, updated the original drafts, and approved the *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization* and *Federated Authorization for User-Managed Access (UMA) 2.0*. The documents described below now enter a second 45-day public comment and IPR review period in preparation for a member ballot to consider their approval as Kantara Initiative Recommendations. Document 1: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization (revision 08) Document 2: Federated Authorization for User-Managed Access (UMA) 2.0 (revision 08) Version: 2.0 Document Date: 2017-09-04 Document URLs: User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization <https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html> and Federated Authorization for User-Managed Access (UMA) 2.0 <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-08.…> To see a summary of comments and changes made related to the first public comment period, see this Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…> document. Overview of Documents: *User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization:* This specification defines a means for a client, representing a requesting party, to use a permission ticket to request an OAuth 2.0 access token to gain access to a protected resource asynchronously from the time a resource owner authorizes access. *Federated Authorization for User-Managed Access (UMA) 2.0:* This specification defines a means for an UMA-enabled authorization server and resource server to be loosely coupled, or federated, in a resource owner context. This is an open invitation to comment. Kantara Initiative solicits feedback from potential users, developers and other interested parties, whether Kantara Initiative members or not, for the sake of improving the interoperability and quality of its technical work. Public Review and IPR Review Period Opens: 2017-09-28 *Review period closes: 2017-11-12 at 11:59 UTC* *To Comment on the Specification:* To comment please email your comments to staff(a)kantarainitiative.org with the subject "UMAWG COMMENT SUBMISSION" referencing the section or sub-section number, your comment and your proposed text to change. *Intellectual Property Rights Notice: * In accordance with the Kantara Initiative IPR Policy Article 5 and the Kantara Initiative Operating Procedures Article 6, you have a period of 45 days to review the draft specification for any Necessary Claims that may be implicated by the draft specification. While there is no requirement to review your patent portfolio for Necessary Claims, please be advised that unless you provide a licensing objection in accordance with the Kantara Initiative IPR Policy Article 5 or a notice of withdrawal in accordance with Kantara Initiative IPR Policy Article 6 on or before 2017-11-12 at 11:59 UTC, you will have committed to the licensing provisions as set forth by the Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non-Discriminatory (RAND) IPR Policy with respect to any Necessary Claims implicated by the final approved specification. Having signed the Group Participation Agreement (GPA) all members of the UMAWG should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved Kantara Initiative specification. Kantara Initiative invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification so that these notices may be provided to the UMAWG. To submit an IPR Necessary Claim, email staff(a)kantarainitiative.org with the subject "UMAWG IPR CLAIM". Please contact the Kantara Initiative staff at staff(a)kantarainitiative.org with any questions regarding this notice. Best Regards, Megan Cannon Megan Cannon | Program Manager | Kantara D: +1.781.876.6287 <(781)%20876-6287> | M: +1.781.258.5523 <(781)%20258-5523> megan(a)kantarainitiative.org kantarainitiative.org <http://www.kantarainitiative.org/> 401 Edgewater Place, Suite 600, Wakefield, MA, 01880 USA [image: Kantara-Logo] Click here to unsubscribe: https://kantarainitiative.org/ mailman/options/announcements/eve%40xmlgrrl.com?password= keohitgu&unsub=1&unsubconfirm=1

1 0

Returning RPT from Resource Server
by Pedro Igor Silva 28 Sep '17

28 Sep '17

Hello, I have an use case where resources from a UMA protected resource server don't require issuance of permission tickets. There is no need for RO approval neither claims gathering flow. But just check if a requesting party is allowed or not to access the resource. I was wondering if I could enable a RS to act as a broker in a way that it could exchange the token the client has with a RPT and then return the RPT to the client. Subsequent requests from client will then use the RPT returned by the RS to access protected resources. With this scenario I'm looking for: * Avoid unnecessary round trips between clients and AS in order to obtain a RPT when a permission ticket is not necessary. * Allow RS to push additional claims to AS with runtime/contextual data and evaluate policies based on these claims. Any thoughts ? Regards. Pedro Igor

2 4

Regarding our call series this week and our spec approval timeline
by Eve Maler 27 Sep '17

27 Sep '17

It turns out the UMA2 specs require a second public review period, which we are going to start ASAP with the assistance of staff. This is to give Kantara Members their due chance to examine the technical changes made (summarized at the bottom of our Disposition of Comments document <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…>) and consider any intellectual property rights impact to them. NOTE: I think we're probably all eager to see these specs finalized, and technical comments aren't really the focus of this period (stability = good!). However, if comments do come in, we'll need to decide and document their dispositions. Give this turn of events, I'm going to *cancel tomorrow's WG call*. However, let's *keep the UMA Legal call on Friday*. If you have questions about the finalization process from here on out, let me know. *Eve Maler*Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

need_info: value for redirect_user
by Mike Schwartz 15 Sep '17

15 Sep '17

UMA-tarians, I have a question about the redirect_user value of the need_info error response. Is this supposed to be the base URI, to which the client should add a state and claims_redirect_uri value? - Mike

2 1

Draft minutes of UMA telecon 2017-09-14
by Eve Maler 15 Sep '17

15 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-09-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-08-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03> and UMA telecon 2017-08-17 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-17>: Deferred. Discussion of "union of resource-mapped" editorial issue Justin advocates removing the non-normative parenthetical with the *∪ resource* in it*.* We have consensus to do so, as long as this can remain in the realm of a free editorial fix prior to next publication as part of the V2.0 process. What's happening now and next steps - Colin/Andrew and the LC are taking up the question of certification (for either All-Member Ballot or some kind of Public Review of the deltas) - Shortly we'll gear up for GOTV - How shortly depends on getting an answer from Kantara. Eve has prepared a Google Sheets spreadsheet so we can do outreach - In anticipation of passage, what education/outreach activities make sense? what interop activities make sense? - Pre-Recommendation timeframe - Post-Recommendation - IIW timeframe - This is the only timeframe we know for sure: Oct 17-19 <https://www.eventbrite.com/e/internet-identity-workshop-xxv-25-2017b-ticket…>. That's not long from now! Eve can't attend, but has colleagues going (and ForgeRock is one of the sponsors). ForgeRock and Gluu would presumably have products to try out by then. Trying out an interop would depend on some kind of "standard API with resource and scope documentation" like we recommend in the specs. - Mike has been advocating informal interop testing before formal conformance testing with a test harness. Justin describes how that happened: People published endpoints and OIDF kept track of the results with published matrices. It was pretty complicated. - The first step would be identifying an independently implemented AS, RS, and C and try to get them to work with one another. - Who's attending IIW? George; Justin hopes to; Sal hopes to; Eve is a no. - Look at UMA2 logo options at this point? - We looked at the proposals from Domenico and Justin and worked together to come up with a direction that Justin will execute. *AI:* Eve: Reach out to known UMA2 implementers and see what entity role coverage they have. *AI:* Domenico: Send Justin his additional logo drafts as fodder. WG schedule - *Week of Sep 18:* No WG meeting Sep 21, no Legal meeting Sep 22 - *Week of Sep 25:* WG meeting will be held Sep 28, Legal meeting will be held Sep 29 To reiterate: No meetings next week! Other items on the WG docket - Pedro's flow suggestions - Justin remarks that if you're talking to the token endpoint without a ticket, you're just doing OAuth already (presumably with an existing grant, depending on details). He cautions not to accept all suggestions, which is what OAuth1 did. UMA2 is a lot cleaner and it would be a shame to load it up again. This is what the "extension" issue label is about. - Other issues labeled "extension" - Liaison with Consent and Information Sharing WG for some items? Anyone interested in consent receipt-related topics at all? Eve and George (related to the third bullet). *AI:* Eve: Create an issue for the first bullet so Pedro's suggestion doesn't get lost. *AI:* Eve: Discuss liaison activity with CIS WG. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Eve 4. Cigdem Non-voting participants: - James - Justin - George - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 3

Possibility of one small editorial clarification in Grant
by Eve Maler 15 Sep '17

15 Sep '17

Cigdem was suggesting a way to clarify a key set math formula in Grant Sec 3.3.4 during our rev 07 review, and I was struggling to figure out a way to format it the way she was suggesting, so in rev 08 I had just left it in place without changing it. But we figured out a rhetorical vs. formatting change that might clarify things a bit more: to change from this... *“{∪ resource {RequestedScopes\CandidateGrantedScopes}={}”* to this: *"{∪_of_resource {RequestedScopes\CandidateGrantedScopes}={}"* The intent is to say that you take the *union* over all the resource-mapped sets of the diff between *RequestedScopes* and *CandidateGrantedScopes*, and if *that's* empty, then you've got a slam-dunk case of issuing the RPT. The snippet *"∪ resource"* may be sufficient to convey that, but we thought *"∪_of_resource"* could be better. (Or maybe someone has some other improvement that's even better.) If we have quorum in our call today, we could do a new motion just like the e-ballot to rev to 09 with that update, assuming we think it's necessary. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2017-09-14
by Eve Maler 13 Sep '17

13 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-09-14 (please see page for details) Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-08-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-03> and UMA telecon 2017-08-17 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-08-17> - What's happening now and next steps - WG schedule - Other items on the WG docket - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

E-ballot: Whether to approve the UMA2 specs as Draft Recommendations and forward them to the LC
by Eve Maler 10 Sep '17

10 Sep '17

(You will find revisions 08 of the specifications in the email archives for now. We'll try to get them up in the usual place soon.) This electronic ballot is designed to conform to Kantara's Operating Procedures 2.0 <https://kantarainitiative.org/confluence/download/attachments/84279306/Kant…> (see Section 7.2). *Resolution 2017-09-05-A:* Having disposed of all Public Comment/IPR Review period comments, approve UMA 2.0 Grant rev 08 <https://08620661282160442115.googlegroups.com/attach/c51693320287d/oauth-um…> and FedAuthz rev 08 <https://08620661282160442115.googlegroups.com/attach/c51693320287d/oauth-um…> as Draft Recommendations and forward them, with reference to the UMA 2.0 Disposition of Comments <https://kantarainitiative.org/confluence/display/uma/UMA+V2.0+Disposition+o…>, to the Kantara Leadership Council to request their certification and determination of their next step towards finalization as Recommendations. WG voting participants (the current roster is here <https://kantarainitiative.org/confluence/display/uma/Participant+Roster>; eligible voters are Domenico, Sal, Andi, Maciej, Eve, Mike, and Cigdem), *please respond in this thread* with one of the following: [ ] Yes [ ] No *(you are encouraged to provide a rationale explaining why)* [ ] Abstain For the ballot to be valid, a majority of eligible voters must return a vote (including "Abstain"). For the ballot to pass, the "Yes" votes must exceed the "No" votes. This ballot closes at *10:59:59pm Pacific Daylight Time on Tuesday 5 Sep 2017*, or earlier at the Chair's discretion if all eligible voters have voted before that time. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

5 7

Approve Draft Recommendations
by Salvatore D'Agostino 10 Sep '17

10 Sep '17

I vote to approve.

1 0

Notes from UMA Legal telecon 2017-09-08 (no call next week after all)
by Eve Maler 08 Sep '17

08 Sep '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-09-08 Attending: Eve, Tim We agreed that deliverable #3 is complete. *AI:* Eve: Let Colin know about deliverable #3. The Uniform Fiduciary Access to Digital Assets Act <http://www.uniformlaws.org/Act.aspx?title=Fiduciary%20Access%20to%20Digital…> is already in effect in most US states and will require other states to take action quick. The Act calls for the use of an "online tool" – "an electronic service provided by a custodian that allows the user, in an agreement distinct from the terms-of-service agreement between the custodian and user, to provide directions for disclosure or nondisclosure of digital assets to a third person". That sounds exactly like an authorization server! Our legal framework and tools can help with providing that. The Uniform Law Commission has commissioners from every state. It seems they promoted the law pretty well, given the thorough coverage. There's' also the increasingly pressing requirements for PSD2 (January 2018) and GDPR (May 2018). There's also the DIACC Trust Framework effort. Kantara can take directed funding for efforts to build specific tools, for example contract clauses (tools) for specific purposes. Would that make sense in the case of "directed" sets of contract language for jurisdiction-specific bodies of law covering specific use cases? Is it time to go to the BL-FIDM list to get attention and review, and see if we can find "customers" for fleshing out the full framework and our first tools in Q4 2017? We think so. *AI:* Tim: Draft message to BL-FIDM. Some goals: Ask for review of existing deliverables (some subset?) and slide artifacts (some subset?) to be determined, ask for use cases (and directed funding if needed to hire any further expertise?) for specific tool development, and ask really interested parties to join WG to develop tools actively in Q4 2017 and beyond. *AI:* Eve: Cancel next week's Legal call. *AI:* Eve: Revitalize our external reviewer list and think about who else to add from IAPP. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0