- WG-UMA - mailman.kantarainitiative.org

Attempt at better clarity around "resources can have multiple parts on the RS side"
by Eve Maler 28 Nov '16

28 Nov '16

I realized that we had an unstated MAY here. Instead of trying to squish the statement into the RReg "protected resource" definition as before, I've now broken this out into a paragraph in RReg Sec 2, Resource Registration, as follows: "A resource server MAY register and manage as a single protected resource a set of digital data or API endpoints that, from its perspective, consists multiple parts, has dynamic elements, or otherwise has internal complexity; it alone is responsible for maintaining any required mappings between this complexity and the resource identifier known to the authorization server." This is something that, in fact, the HEART group has been facing in its discussions about the FHIR API, and other APIs that are working on UMA protection will face it as well (though FHIR has the worst of it since it's a complex API). Let me know what you think. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

Reminder: UMA APAC sync coming up
by Eve Maler 28 Nov '16

28 Nov '16

*Purpose:* Synchronizing on current work with APAC-based participants and gathering their input. *RSVPs* from those in the APAC region (sent directly to me) will be much appreciated! *Call may be canceled if no RSVPs* - Sample times: US Pacific *Tue Nov 29* 4pm / Aus east *Wed Nov 30* 11am / NZ *Wed Nov 30* 1pm - Skype: +99051000000481 - US toll: +1-805-309-2350 - Sydney: +61.2.8014.4647 - Auckland: +64.9.973.0310 - Additional international numbers: https://www.turbobridge.com/in ternational.html <https://www.google.com/url?q=https%3A%2F%2Fwww.turbobridge.com%2Finternatio…> - Web: https://panel.turbobridge.com/webcall/ <https://www.google.com/url?q=https%3A%2F%2Fpanel.turbobridge.com%2Fwebcall%…> - Code: 178-2540# - Screenshare: http://join.me/findthomas <https://www.google.com/url?q=http%3A%2F%2Fjoin.me%2Ffindthomas&sa=D&ust=147…> (DO NOT USE join.me <https://www.google.com/url?q=http%3A%2F%2Fjoin.me&sa=D&ust=1475556106312000…> dial-in number) - See the calendar entry for more details: http://kantarainitiative.org/c onfluence/display/uma/Calendar *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

New drafts are ready
by Eve Maler 28 Nov '16

28 Nov '16

Core rev 09: https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-09.html RReg rev 02: https://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-02.html I closed issues #235 and #236 from Sarah on RReg. We haven't been very disciplined about closing issues that have been implemented and thoroughly discussed in Core, but there's really quite a lot of them that could be closed by now; I'll plan to do that shortly. Biggest changes this time around/food for thought for our call this Thursday: - Token profiling in Core - Lots of rhetorical/conceptual changes in the front part of Core (please read through -- new ASCII art!) - Scope set math is fully on the docket! - Assumption: Only one grant is in use at a time - Assumption: Client-requested scopes are intended to apply only to the apparent resource that the client attempted to access (since they can't know about resource IDs) ?? - Question: What should guide RS's in requesting permissions on behalf of a client? I for one would be very willing to have this week's call go a little long as I have to miss the following week again, and time is getting very short. If anyone can stay long with me, that would be great. Lots still to do. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: No WG or Legal call this week due to US Thanksgiving
by Eve Maler 22 Nov '16

22 Nov '16

I do plan to have Core 09 and RReg 02 out sometime after Thursday, though! The Core changes will concentrate on the Intros, conceptual descriptions, and new diagrams (so text diffs will unfortunately be a bit invasive). Happy Thanksgiving to all those celebrating it! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Removing RReg's dependency on resource owners
by Eve Maler 20 Nov '16

20 Nov '16

Currently in RReg we make the "name" property in the resource description and the scope description REQUIRED, for the UMA use case. Given our discussion in the 2016-11-18 telecon about softening resource owner-related things in RReg, properly these should be OPTIONAL (since OAuth and OIDC don't involve "setting policies", and OAuth sometimes doesn't involve resource owners at all, only clients acting on their own behalf). Should the Core spec profile RReg to make these properties REQUIRED vs. OPTIONAL? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2016-11-18
by Eve Maler 18 Nov '16

18 Nov '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-18 MinutesRoll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2016-11-10 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-10>: Deferred. Logistics The agenda is starting to include even the minutiae of the issue backlog and the roadmap. It looks long, but is designed to keep us honest in gaining consensus on discussion topics. If people show up to meetings and review spec drafts, we'll push through everything on a good schedule. No meetings next week. Work on UMA.next issues The RReg definition of a protected resource goes too far because it presumes an RO. If we soften it to mention just an AS, then we think that the RReg spec is generic enough to serve OAuth needs along with UMA etc. needs. Let's try that. Eve asked an aesthetic question about the sample endpoints in the config response. If anyone would like to see them looking different send mail with your preference. The entire abstract and Introduction are new (and is awaiting a new ASCII diagram). PLEASE review and comment. Discussion of Eve's strawman proposal: James likes the idea because, what if you want to mix UMA and OAuth scopes? You can't expect a client to maintain multiple access tokens where there are AS's supporting multiple grant types that deal with incompatible tokens. This is where getting Implementer's Drafts out there would be really useful. You could include OAuth scopes in an RPT now with no UMA permissions, but the permissions property would still have to appear with nothing in the array; that's ugly. If the AS gives the RS a locally validatable RPT, normally the format of the token would be considered in the realm of a "private communication" between them, and it would be considered a burden to impose constraints on that. In the interest of making possible the new Intro text's promise that "The token introspection extension lets the resource owner increase and decrease grants at a grain finer than a whole access token.", do we want to say that the AS MUST/SHOULD/MAY package up locally validatable RPTs as signed versions of the token introspection object? Maybe we just point this out; it's the obvious object to sign if you want that functionality. *AI:* James: Send a note to the list about the question of a locally validatable RPT and whether to recommend something about its format. What scopes should the client ask for, and why? The client knows nothing about resource IDs and in particular nothing about any of the resource IDs associated with the permission ticket it just brought to the AS, only about the API and presumably about the scopes possible on the HTTP resource to which it just attempted access. This client-AS request is the first step in the UMA grant, and we can tell because the client is coming to the token endpoint with a permission ticket. Let's say the ticket has R1, R2, and R3. They all have "view" available, and R2 and R3 have "print" available. There are OAuth-protected resources at the same RS that have scopes that overlap. Is it possible to have a hybrid client-AS request at this stage? Is it possible to be executing two OAuth grants at the same time? Eve hasn't heard of this before, and we do already have an invalid_scope error in place to protect against scope clashes of the sort imagined. This may mean that our hybrid UMA-OAuth scenario above wouldn't work anyway. *AI:* Eve: Send a note to the list laying out the current situation wrt scopes. Instructions: - RReg 02: Soften "protected resource" definition and any similar passages to remove the insistence that an RO is required for protection to obtain over a resource. - Implement the token introspection proposal. - Sketch a Sec 1 Intro diagram. - Revise the Sec 3 intro and sketch an ASCII diagram for it. Attendees As of 3 Oct 2016, quorum is 6 of 11. (Domenico, Sal, Nagesh, Andi, Robert, Maciej, Eve, Jeffrey, Mike, Cigdem, Sarah) 1. Eve 2. Maciej 3. Sarah Non-voting participants: - James - Arlene - Kathleen Regrets: - John W - Sal *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA legal telecon 2016-11-18
by Eve Maler 18 Nov '16

18 Nov '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-11-18 - Eve to give update on Karsten Kinast convo Attending: Eve, John W, Kathleen Eve had a chance to deep-dive on some of our current topics with Karsten. In the rights-based EU conception, law/regulatory interpretation/contract can capture the sheer reality of little Johnny's natural rights to privacy over data about him; he has an aura that can't be detached. His relationship with his mother Alice is internal, and UMA's relationship is with him, not Alice. This is "the view of the world from the human rights/legal end". On the other hand, "the view of the world from the technical end", where the technical end in our case is UMA, would connect UMA to Alice because she is the one actually wielding the technology as a resource owner. So the bridge we're building connects those two worlds at the point of identifying the resource owner, data subject, and grantor roles. Does that work? For this reason, it's perhaps best to use the literal GDPR (and other data protection law) wording, vs. being cute and using "resource subject". This is making us want to revise the charter to a) ensure that our work helps UMA be used for good and not evil generally, and also b) ensure it's used *on behalf of* data subjects, not just for resource owners in that role. How about replacing ", particularly where the resource owner is an individual" with "in a manner consistent with protecting privacy rights" (and get rid of the word "themselves")? They also talked about sharing access with the intent of making the grantee a(nother) data controller vs. making them a data processor. Making someone a DP (say, because you're asking them to do something "on your behalf" for consideration – e.g. outsourcing payroll processing) means accountability remains with the grantor (Alice), while making someone another DC means you've just given them access for whatever reason, and they're just another accessor. Control becomes additive. So Eve's working theory became: Would it be possible to develop tools that distinguish between Alice's ability to grant access for the purpose of processing vs. for other purposes, as a broad means of managing the DS's/ risk? Would our time be best spent in this group working on these tools first vs. other tools? Could grantors/resource owners clearly understand such distinctions? This is where the DS would be accountable but the DP would need to take on responsibilities (think "RACI") to balance the risk. Our tools – e.g., data sharing agreements – could include standard text for that. The last subject they discussed was the types of use cases that would need to be developed. Eve has started a fresh Legal Use Cases page, here <http://kantarainitiative.org/confluence/display/uma/Legal+Use+Cases>. It's just a shell so far. Following are the use case axes identified so far. - Granting access to DC vs. DP - Disclosing data vs. granting other kinds of access (e.g., letting a client of a grantee add data back through the API, or let it use an algorithm by paying for access, or accessing a photo...) - Whether the DS and the grantor are both in the EU (leave this complexity aside for now??) - Every vertical and horizontal use case will probably need its own special-sauce text! But we should at least start gathering examples and identifying what are hopefully "design patterns" John is concerned that XACML went down a similar path, with resulting complexity. Let's seek ways to boil the smallest of ponds. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-11-18 (special Friday meeting just after Legal call)
by Eve Maler 18 Nov '16

18 Nov '16

In the Legal call, I'll have an update from a discussion with Karsten Kinast that we can discuss. ==== http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-18 Date and Time - *Special Friday meeting,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-11-10 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-10> - Logistics for upcoming meetings (calendar <http://kantarainitiative.org/confluence/display/uma/Calendar>) and 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> check-in - Next week: *no WG or legal meeting* due to US holiday - Week after: normal WG meeting on Dec 1 - Week after that: Eve unavailable on Thu/Fri... - Work on UMA.next issues – Core is up to 08 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-08.html> and RReg is up to 01 <http://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-01.html> – please review changes ahead of time if possible - Besides agreed and expected changes, main changes are: - Removed pat_grant_types_supported per proposal <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/GVnuVMnoX…> - "protection API token" --> "protection API access token" - "permission registration --> "permission request" (rhetorical and syntax) - "permission_scopes" --> "resource_scopes" - "resource set reg" --> "resource reg" (rhetorical and syntax) in RReg spec - Introduction text in Core (incomplete) – please especially review - To discuss specifically this time: - Briefly review Introduction and plan to include high-level diagram - Discuss "token profiling" proposal to: - Make token introspection permissions structure optional - Require its array to contain one or more values - Require AS to support token introspection - Require AS to support permissions structure - Recommend development of extensions for alternative introspection structures - Even if token introspection isn’t used, can/should we require the ability for a locally validatable RPT to operate at a “permissions” grain somehow? - Need to say something about RReg taking place in the context of a resource owner? Is it always done in that context? Doesn't it depend on the RReg security mechanism used? - Set math: See 9-29 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-09-29> and 10-6 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-10-06>, and the email thread <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/though…> – including... - What scopes should the client ask for, *and why*? (E.g., least-privilege rationale.) What should the mechanism be for asking for scopes for specific protected resources? - What permissions should the RS request on behalf of the client, *and why*? - claim_token_profiles_supported: My proposal <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/GVnuVMnoX…> was to keep this profiling mechanism, but clean it up and provide two actual profiles or at least credible examples, say, for OIDC ID tokens and SAML assertions. Discussion? - uma_profiles_supported: My proposal <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/GVnuVMnoX…> was to keep this profiling mechanism, but figure out seriously if the extensibility profiles are doing the right job, and include credible examples of extensions and not just extensibility profiles. Discussion? - Is step-up auth the way it was conceived in UMA1 hunky dory according to the claims collection mechanism in UMA2? - Need to have IANA registry entries for both old uma-configuration and uma2-configuration? - Shoebox endpoint - Claims hashing - See the latest swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Core rev 08 is out; sorry for the delay
by Eve Maler 18 Nov '16

18 Nov '16

Just back from Paris by way of Reykjavik. :-) I'd hoped to get this rev up before that trip, but at least I got good use of the laptop battery on the way back... http://docs.kantarainitiative.org/uma/ed/uma-core-2.0-08.html I'm just about to send out the agenda for tomorrow. It's got lots of specifics for us to review and discuss. Hopefully east coast, European, and early-riser west coast people will have a quick chance to take a look. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: WG call has moved to Friday this week / New RReg draft up
by Eve Maler 16 Nov '16

16 Nov '16

Don't forget that this week's WG call is Friday instead of Thursday, after the Legal call; please see the calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> if in doubt. ==== In other news, I've managed to publish a new version of the RReg (used to be RSR) spec, rev 01 <https://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-01.html>, a mere three months after rev 00. The main edits were squished into one big commit <https://github.com/KantaraInitiative/wg-uma/commit/81814413b7ccb39576bc7a5c…>. Nothing all that huge changed and it's not that deep or philosophical a spec, but I'll list some food-for-thought topics here that I plan to add to the agenda for Friday: 1. Is this really and truly a spec that's independent of UMA ("OAuth" RReg)? Does it need an extension grant or token introspection extension of some kind to function properly? 2. We currently force scope URIs (vs. plain strings) to resolve to a scope description document, though we impose no testable-assertion penalty if this is violated. Do we want to keep this a MUST? 3. The Core spec allows RS's to manage protection of any resources it likes at the "edge", away from UMA. Should we say something explicitly in RReg as well about this option, sanctioning the option of letting an RS leave out any resources, and scopes of resources, that it wants? 4. Do we need to say something about resource registration taking place in the context of a resource owner or at least in the context of the trust relationship of an AS and RS? For UMA, it's all about the PAT context. This comes back to question 1... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0