- WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] Reminder: Legal subgroup call is on for tomorrow (Friday) morning
by Eve Maler 26 May '17

26 May '17

Thanks, Tim! Note: I may be a tiny bit late starting today's call. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756) > On May 26, 2017, at 3:19 AM, Tim Reiniger <tim(a)futurelaw.net> wrote: > > Here is the paper for today’s call. > > Tim > > From: wg-uma-bounces(a)kantarainitiative.org [mailto:wg-uma-bounces@kantarainitiative.org] On Behalf Of Eve Maler > Sent: Thursday, May 25, 2017 9:37 PM > To: wg-uma(a)kantarainitiative.org > Subject: [WG-UMA] Reminder: Legal subgroup call is on for tomorrow (Friday) morning > > Tim and I met earlier this week, and he will have a revision of deliverable #2 and news about the direction of deliverable #3 for us. Our legal framework is starting to shape up! > > I can also share news of a talk I gave at a legal conference yesterday, and we can discuss the prospect of a Kantara-wide Legal WG, if time. > > Eve Maler (sent from my iPad) | cell +1 425 345 6756 > <UMA Legal Model Deliverable 2 Paper.docx>

1 0

Reminder: Legal subgroup call is on for tomorrow (Friday) morning
by Eve Maler 26 May '17

26 May '17

Tim and I met earlier this week, and he will have a revision of deliverable #2 and news about the direction of deliverable #3 for us. Our legal framework is starting to shape up! I can also share news of a talk I gave at a legal conference yesterday, and we can discuss the prospect of a Kantara-wide Legal WG, if time. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Draft minutes of UMA telecon 2017-05-25
by Eve Maler 25 May '17

25 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-05-18 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18>: APPROVED. Logistics - Final Draft Specification to be remanded to Kantara staff TODAY UMA V2.0 work We discussed FedAuthz Sec 3.2 in the scratch draft and changed editorial text to ensure that the UMA errors for the resource registration endpoint are clarified to be MAYs while the HTTP errors are MUSTs. (Take out of hanging list.) By contrast, we confirmed our understanding that Sec 4.3 – "the authorization server responds with an HTTP 400 (Bad Request) status code and includes one of the following error codes" – stays declarative and thus is definitely still implicitly a MUST in the fashion of our issue #312 decision. Issue #313 <https://github.com/KantaraInitiative/wg-uma/issues/320>: We needed more explanation from Justin. He meant that the phrase "human-readable" needs better definition. The method suggested is to do what RFC IETF 7591 Sec 2 <http://The value of this field MAY be internationalized, as described in Section 2.2.> does, which is say "The value of this field MAY be internationalized, as described in (7591) Section 2.2." Since that section already says it's OPTIONAL for the AS to do anything with it, and all other details are already covered, that's all we need to do; we can remove the paragraph. Issue #315 <https://github.com/KantaraInitiative/wg-uma/issues/315>: Reverse the wording so that REQUIRED is first. Issue #316 <https://github.com/KantaraInitiative/wg-uma/issues/317>: A big problem is the example of a hash of the session cookie, which is a really unusual way of doing things. Justin can do a pull request by 2pm ET. Issue #317 <https://github.com/KantaraInitiative/wg-uma/issues/317>: The two logical response options, = and <, shouldn't say MUST; for consistency they should just say "the authorization server responds...". (Yes, Justin did mean non-null!) Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: Regarding 3.3.6: invalid_scope should also cover cases where the client asked for a scope it's not registered for: In Sec 3.3.4, mention that if the client requests a scope that it didn't pre-register for, it's not an error (at the RPT request stage) because, during the authorization assessment process, the RequestedScopes might include scopes requested on the client's behalf by the RS. However, it is not included as a requested scope. Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: s/other entity other/any entity other/ Issue #323 <https://github.com/KantaraInitiative/wg-uma/issues/323>: PoP: Let's keep as is. Other: - Catch curly quotes. - Catch out-of-date references. - Update publication dates. - Choose the correct Status of This Document. - Close issues! Logistics Eve and Justin will get the spec drafts ready in the next hour for Kantara staff to publish. Other artifact work: Let's work on those things casually next week and in the interim. Items include: - UIG (Eve) - Wikipedia page (Domenico will work on Italian one; Eve will reach out to others who have edited other pages in the past) - Release notes - FAQ (Eve has one to add) - Case Studies page - Swimlane (Eve) - Implementation page (Maciej) - ... Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Kathleen *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-05-25
by Eve Maler 24 May '17

24 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-25 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-05-18 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18> - Logistics/timing: - Final Draft Specification to be remanded to Kantara staff TODAY - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> /dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor) - Eve has implemented all decisions where possible and is expecting final Justin comment by this morning - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

No Legal call tomorrow
by Eve Maler 18 May '17

18 May '17

Instead, I'm going to do some offline doc review with Tim. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Do Promises To Use "Best Efforts" To Protect Data Really Require Unreasonable Action? - Data Protection Report
by John Wunderlich 18 May '17

18 May '17

In UMA legal and the Information Sharing workgroups, it will be important to be mindful of 'best practices' vs 'reasonable efforts'. http://www.dataprotectionreport.com/2017/05/do-promises-to-use-best-efforts… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 3

Draft minutes of UMA telecon 2017-05-18
by Eve Maler 18 May '17

18 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2017-04-27 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-04-27>: APPROVED by acclamation. Logistics - Candidate motion for consideration: - "Approve the draft UMA 2.0 specifications [as amended according to the instructions of UMA telecon 2017-05-18] as Draft Recommendations for public comment and IPR review." - Assuming we approve and forward the specs today, how to structure the next 45 days' worth of time? UMA V2.0 work We reviewed the recommendations of UMA telecon 2017-05-12 and everything seemed to be acceptable. We have consensus. Issue #312 <https://github.com/KantaraInitiative/wg-uma/issues/312>: Consensus to remove the language (option 2). Issue #313 <https://github.com/KantaraInitiative/wg-uma/issues/313>: Copy the text instead of move it. The second paragraph is not entirely relevant to Grant, so only a subset should be copied over. Issue #314 <https://github.com/KantaraInitiative/wg-uma/issues/314>: The RS, along with the AS, has to manage mappings of resource IDs to specific resource owners. Let's drop the note. Issue #315 <https://github.com/KantaraInitiative/wg-uma/issues/315>: Eve has suggested wording. This is practically editorial. We should say "pre-registered" instead of "registered". Should we say first "Only if the client has pre-registered a single full claims redirection URI, this is OPTIONAL." and then put the other proposed wording at the end? Yes. Issue #317 <https://github.com/KantaraInitiative/wg-uma/issues/317>: Did Justin mean "also non-null", or did he mean "also null"? Gluu first gets a token with no scopes, and then adds scopes to it. Is that first token a true RPT? It doesn't have permissions associated with it, so this could be a sort of interim step. It's certainly okay for a client not to pre-register for/request scopes. And we decided that it's okay for the RS to include zero scopes in its permission ticket. (Justin had made a separate comment about some inconsistency in FedAuthz about our language on this point.) So if we were serious about allowing zero scopes in *RequestedScopes*, then if that is null too, then it should be possible to issue a token with "nothing – that's what you wanted, and you'll like it!" But if it was non-null, that should result in a hard error. So we need to break this out into two bullets, with the two different conditions. Or the more elegant solution is to remove "is non-null" from the current last bullet, because if CandidateGrantedScopes is null and RequestedScopes is non-null, then the former is < the latter, and it would come under the third bullet. There should be only two logical bullets: = and <. Issue #322 <https://github.com/KantaraInitiative/wg-uma/issues/322>: We made a strong decision to make permissions be a SHOULD for extensibility reasons, in case someone wanted to experiment with the dividing line between AS and RS responsibilities. However, token introspection is already optional in OAuth, and with the spec refactoring, maybe this isn't necessary anymore. And changing from a SHOULD to a MUST is backwards incompatible, whereas the reverse isn't (it would break implementations to change it in this direction). Consensus to change to a MUST. Issue #320 <https://github.com/KantaraInitiative/wg-uma/issues/320>: We don't understand this one. Hopefully this will result in only non-normative language later. Issue #321 <https://github.com/KantaraInitiative/wg-uma/issues/321>: Simple fix. Issue #318 <https://github.com/KantaraInitiative/wg-uma/issues/318>: This is a normative change, but we should do it for consistency. (This also changes the WSD.) Issue #316 <https://github.com/KantaraInitiative/wg-uma/issues/316>: Eve will work with Justin to ensure it says everything he wants, in addition to reiterating any OAuth messages as appropriate. Mike also notes that FAPI from OIDC went beyond requiring state (but of course that is an industry profile). Attend to: Issues #319 <https://github.com/KantaraInitiative/wg-uma/issues/319> and #323 <https://github.com/KantaraInitiative/wg-uma/issues/323> and the following editorial instruction: - Remove "Note:" from beginnings of "For an example of how..." references. A candidate motion: MOTION: Mike moves and Maciej seconds: Approve the draft UMA 2.0 specifications, Grant rev 04 and FedAuthz rev 04, as amended according to the instructions of UMA telecon 2017-05-18, as Draft Recommendations for public comment and IPR review. APPROVED by unanimous consent. *AI:* Eve, Justin, and Maciej: Edit! and ensure the Draft Recommendation markers are properly in place. *AI:* Eve: Work with Kantara staff on review/publication next steps. Logistics Note that, once this 45-day review has begun, any substantive (think backwards-incompatible) changes will require going back to another such review. We should review the 05 drafts ASAP to catch any text implementation boo-boos before this goes out the door – even before next Thursday. Maybe we can also figure out #320 before publication as well. Let's try to make hay early next week while the sun shines. Maybe Eve will even call an ad hoc. We can figure out our meeting schedule after that. Note: No meeting the week of CIS (June 22). Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - James - Jin Guest: - Jim Willeke Regrets: - John W - Justin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-05-18 (looking for quorum for this meeting!)
by Eve Maler 17 May '17

17 May '17

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-18 Date and Time - *Thursdays, 9-10am PT* - Screenshare and dial-in: http://join.me/findthomas - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2017-04-27 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-04-27> - Logistics/timing: - Candidate motion for consideration: - "Approve the draft UMA 2.0 specifications [as amended according to the instructions of UMA telecon 2017-05-18] as Draft Recommendations for public comment and IPR review." - Assuming we approve and forward the specs today, how to structure the next 45 days' worth of time? - UMA V2.0 work: - All GitHub issues for V2.0 <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…>/ dynamic swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> (not updated to the spec refactor) - *Grant rev 03 <https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-03.html>** and FedAuthz rev 03 <https://docs.kantarainitiative.org/uma/ed/oauth-uma-federated-authz-2.0-03.…>*; stay tuned for revs 04 shortly - See UMA telecon 2017-05-12 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-05-12> for detailed notes about issue-closing recommendations, spec wording proposals (to appear in revs 04), and issues already closed - Revs 04 may also contain some editorial changes to intro sections - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

An Algorithm Summarizes Lengthy Text Surprisingly Well
by John Wunderlich 15 May '17

15 May '17

https://www.technologyreview.com/s/607828/an-algorithm-summarizes-lengthy-t… -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Anyone in UMA WG going to K(NO)W Identity in DC
by Thomas Hardjono 14 May '17

14 May '17

Anyone in UMA WG going to K(NO)W Identity in DC this coming week? /thomas/

1 0