- WG-UMA - mailman.kantarainitiative.org

Removing RReg's dependency on resource owners
by Eve Maler 19 Nov '16

19 Nov '16

Currently in RReg we make the "name" property in the resource description and the scope description REQUIRED, for the UMA use case. Given our discussion in the 2016-11-18 telecon about softening resource owner-related things in RReg, properly these should be OPTIONAL (since OAuth and OIDC don't involve "setting policies", and OAuth sometimes doesn't involve resource owners at all, only clients acting on their own behalf). Should the Core spec profile RReg to make these properties REQUIRED vs. OPTIONAL? *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA telecon 2016-11-18
by Eve Maler 18 Nov '16

18 Nov '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-18 MinutesRoll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2016-11-10 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-10>: Deferred. Logistics The agenda is starting to include even the minutiae of the issue backlog and the roadmap. It looks long, but is designed to keep us honest in gaining consensus on discussion topics. If people show up to meetings and review spec drafts, we'll push through everything on a good schedule. No meetings next week. Work on UMA.next issues The RReg definition of a protected resource goes too far because it presumes an RO. If we soften it to mention just an AS, then we think that the RReg spec is generic enough to serve OAuth needs along with UMA etc. needs. Let's try that. Eve asked an aesthetic question about the sample endpoints in the config response. If anyone would like to see them looking different send mail with your preference. The entire abstract and Introduction are new (and is awaiting a new ASCII diagram). PLEASE review and comment. Discussion of Eve's strawman proposal: James likes the idea because, what if you want to mix UMA and OAuth scopes? You can't expect a client to maintain multiple access tokens where there are AS's supporting multiple grant types that deal with incompatible tokens. This is where getting Implementer's Drafts out there would be really useful. You could include OAuth scopes in an RPT now with no UMA permissions, but the permissions property would still have to appear with nothing in the array; that's ugly. If the AS gives the RS a locally validatable RPT, normally the format of the token would be considered in the realm of a "private communication" between them, and it would be considered a burden to impose constraints on that. In the interest of making possible the new Intro text's promise that "The token introspection extension lets the resource owner increase and decrease grants at a grain finer than a whole access token.", do we want to say that the AS MUST/SHOULD/MAY package up locally validatable RPTs as signed versions of the token introspection object? Maybe we just point this out; it's the obvious object to sign if you want that functionality. *AI:* James: Send a note to the list about the question of a locally validatable RPT and whether to recommend something about its format. What scopes should the client ask for, and why? The client knows nothing about resource IDs and in particular nothing about any of the resource IDs associated with the permission ticket it just brought to the AS, only about the API and presumably about the scopes possible on the HTTP resource to which it just attempted access. This client-AS request is the first step in the UMA grant, and we can tell because the client is coming to the token endpoint with a permission ticket. Let's say the ticket has R1, R2, and R3. They all have "view" available, and R2 and R3 have "print" available. There are OAuth-protected resources at the same RS that have scopes that overlap. Is it possible to have a hybrid client-AS request at this stage? Is it possible to be executing two OAuth grants at the same time? Eve hasn't heard of this before, and we do already have an invalid_scope error in place to protect against scope clashes of the sort imagined. This may mean that our hybrid UMA-OAuth scenario above wouldn't work anyway. *AI:* Eve: Send a note to the list laying out the current situation wrt scopes. Instructions: - RReg 02: Soften "protected resource" definition and any similar passages to remove the insistence that an RO is required for protection to obtain over a resource. - Implement the token introspection proposal. - Sketch a Sec 1 Intro diagram. - Revise the Sec 3 intro and sketch an ASCII diagram for it. Attendees As of 3 Oct 2016, quorum is 6 of 11. (Domenico, Sal, Nagesh, Andi, Robert, Maciej, Eve, Jeffrey, Mike, Cigdem, Sarah) 1. Eve 2. Maciej 3. Sarah Non-voting participants: - James - Arlene - Kathleen Regrets: - John W - Sal *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA legal telecon 2016-11-18
by Eve Maler 18 Nov '16

18 Nov '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-11-18 - Eve to give update on Karsten Kinast convo Attending: Eve, John W, Kathleen Eve had a chance to deep-dive on some of our current topics with Karsten. In the rights-based EU conception, law/regulatory interpretation/contract can capture the sheer reality of little Johnny's natural rights to privacy over data about him; he has an aura that can't be detached. His relationship with his mother Alice is internal, and UMA's relationship is with him, not Alice. This is "the view of the world from the human rights/legal end". On the other hand, "the view of the world from the technical end", where the technical end in our case is UMA, would connect UMA to Alice because she is the one actually wielding the technology as a resource owner. So the bridge we're building connects those two worlds at the point of identifying the resource owner, data subject, and grantor roles. Does that work? For this reason, it's perhaps best to use the literal GDPR (and other data protection law) wording, vs. being cute and using "resource subject". This is making us want to revise the charter to a) ensure that our work helps UMA be used for good and not evil generally, and also b) ensure it's used *on behalf of* data subjects, not just for resource owners in that role. How about replacing ", particularly where the resource owner is an individual" with "in a manner consistent with protecting privacy rights" (and get rid of the word "themselves")? They also talked about sharing access with the intent of making the grantee a(nother) data controller vs. making them a data processor. Making someone a DP (say, because you're asking them to do something "on your behalf" for consideration – e.g. outsourcing payroll processing) means accountability remains with the grantor (Alice), while making someone another DC means you've just given them access for whatever reason, and they're just another accessor. Control becomes additive. So Eve's working theory became: Would it be possible to develop tools that distinguish between Alice's ability to grant access for the purpose of processing vs. for other purposes, as a broad means of managing the DS's/ risk? Would our time be best spent in this group working on these tools first vs. other tools? Could grantors/resource owners clearly understand such distinctions? This is where the DS would be accountable but the DP would need to take on responsibilities (think "RACI") to balance the risk. Our tools – e.g., data sharing agreements – could include standard text for that. The last subject they discussed was the types of use cases that would need to be developed. Eve has started a fresh Legal Use Cases page, here <http://kantarainitiative.org/confluence/display/uma/Legal+Use+Cases>. It's just a shell so far. Following are the use case axes identified so far. - Granting access to DC vs. DP - Disclosing data vs. granting other kinds of access (e.g., letting a client of a grantee add data back through the API, or let it use an algorithm by paying for access, or accessing a photo...) - Whether the DS and the grantor are both in the EU (leave this complexity aside for now??) - Every vertical and horizontal use case will probably need its own special-sauce text! But we should at least start gathering examples and identifying what are hopefully "design patterns" John is concerned that XACML went down a similar path, with resulting complexity. Let's seek ways to boil the smallest of ponds. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-11-18 (special Friday meeting just after Legal call)
by Eve Maler 18 Nov '16

18 Nov '16

In the Legal call, I'll have an update from a discussion with Karsten Kinast that we can discuss. ==== http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-18 Date and Time - *Special Friday meeting,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-11-10 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-10> - Logistics for upcoming meetings (calendar <http://kantarainitiative.org/confluence/display/uma/Calendar>) and 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> check-in - Next week: *no WG or legal meeting* due to US holiday - Week after: normal WG meeting on Dec 1 - Week after that: Eve unavailable on Thu/Fri... - Work on UMA.next issues – Core is up to 08 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-08.html> and RReg is up to 01 <http://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-01.html> – please review changes ahead of time if possible - Besides agreed and expected changes, main changes are: - Removed pat_grant_types_supported per proposal <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/GVnuVMnoX…> - "protection API token" --> "protection API access token" - "permission registration --> "permission request" (rhetorical and syntax) - "permission_scopes" --> "resource_scopes" - "resource set reg" --> "resource reg" (rhetorical and syntax) in RReg spec - Introduction text in Core (incomplete) – please especially review - To discuss specifically this time: - Briefly review Introduction and plan to include high-level diagram - Discuss "token profiling" proposal to: - Make token introspection permissions structure optional - Require its array to contain one or more values - Require AS to support token introspection - Require AS to support permissions structure - Recommend development of extensions for alternative introspection structures - Even if token introspection isn’t used, can/should we require the ability for a locally validatable RPT to operate at a “permissions” grain somehow? - Need to say something about RReg taking place in the context of a resource owner? Is it always done in that context? Doesn't it depend on the RReg security mechanism used? - Set math: See 9-29 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-09-29> and 10-6 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-10-06>, and the email thread <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/though…> – including... - What scopes should the client ask for, *and why*? (E.g., least-privilege rationale.) What should the mechanism be for asking for scopes for specific protected resources? - What permissions should the RS request on behalf of the client, *and why*? - claim_token_profiles_supported: My proposal <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/GVnuVMnoX…> was to keep this profiling mechanism, but clean it up and provide two actual profiles or at least credible examples, say, for OIDC ID tokens and SAML assertions. Discussion? - uma_profiles_supported: My proposal <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/GVnuVMnoX…> was to keep this profiling mechanism, but figure out seriously if the extensibility profiles are doing the right job, and include credible examples of extensions and not just extensibility profiles. Discussion? - Is step-up auth the way it was conceived in UMA1 hunky dory according to the claims collection mechanism in UMA2? - Need to have IANA registry entries for both old uma-configuration and uma2-configuration? - Shoebox endpoint - Claims hashing - See the latest swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Core rev 08 is out; sorry for the delay
by Eve Maler 18 Nov '16

18 Nov '16

Just back from Paris by way of Reykjavik. :-) I'd hoped to get this rev up before that trip, but at least I got good use of the laptop battery on the way back... http://docs.kantarainitiative.org/uma/ed/uma-core-2.0-08.html I'm just about to send out the agenda for tomorrow. It's got lots of specifics for us to review and discuss. Hopefully east coast, European, and early-riser west coast people will have a quick chance to take a look. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: WG call has moved to Friday this week / New RReg draft up
by Eve Maler 16 Nov '16

16 Nov '16

Don't forget that this week's WG call is Friday instead of Thursday, after the Legal call; please see the calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> if in doubt. ==== In other news, I've managed to publish a new version of the RReg (used to be RSR) spec, rev 01 <https://docs.kantarainitiative.org/uma/ed/oauth-resource-reg-2.0-01.html>, a mere three months after rev 00. The main edits were squished into one big commit <https://github.com/KantaraInitiative/wg-uma/commit/81814413b7ccb39576bc7a5c…>. Nothing all that huge changed and it's not that deep or philosophical a spec, but I'll list some food-for-thought topics here that I plan to add to the agenda for Friday: 1. Is this really and truly a spec that's independent of UMA ("OAuth" RReg)? Does it need an extension grant or token introspection extension of some kind to function properly? 2. We currently force scope URIs (vs. plain strings) to resolve to a scope description document, though we impose no testable-assertion penalty if this is violated. Do we want to keep this a MUST? 3. The Core spec allows RS's to manage protection of any resources it likes at the "edge", away from UMA. Should we say something explicitly in RReg as well about this option, sanctioning the option of letting an RS leave out any resources, and scopes of resources, that it wants? 4. Do we need to say something about resource registration taking place in the context of a resource owner or at least in the context of the trust relationship of an AS and RS? For UMA, it's all about the PAT context. This comes back to question 1... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Issue #256: Consider the naming of entities and concepts: configuration/discovery
by Eve Maler 14 Nov '16

14 Nov '16

https://github.com/KantaraInitiative/wg-uma/issues/256 This is one of a series of messages meant for discussion of naming of entities and concepts. This message consolidates *configuration/discovery* terms from the GitHub issue: - configuration data (original) - discovery document (proposed; might change the name of the directory -- or should it be file? -- where the metadata resides) For now, let's please discuss only in email, unless we're all somehow magically aligned by the time we get to the next call. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 4

Issue #256: Consider the naming of entities and concepts: authorization/claims terms
by Eve Maler 14 Nov '16

14 Nov '16

https://github.com/KantaraInitiative/wg-uma/issues/256 This is one of a series of messages meant for discussion of naming of entities and concepts. This message consolidates a bunch of *authorization/claims* terms from the GitHub issue: - authorization process (new) - authorization interface (new) - authorization API (obsolete) - UMA grant (new) - trust elevation (still used but some not crazy about it) - gathered claims, claims gathering (intended to be used just for interactive) - requesting party claims endpoint (original, sometimes accidentally subbed with "interactive claims-gathering endpoint") - pushed claims, claim pushing - claims collection (sort of new, intended to be used for both interactive and pushed) For now, let's please discuss only in email, unless we're all somehow magically aligned by the time we get to the next call. I'll provide my own thoughts in a followup message. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 6

Applicability of OAuth 2.0 hack to UMA?
by John Wunderlich 13 Nov '16

13 Nov '16

Has anyone looked at “Signing into One Billion Mobile LApp Accounts Effortlessly with OAuth 2.0. <https://www.blackhat.com/docs/eu-16/materials/eu-16-Yang-Signing-Into-Billi…>” for applicability to UMA? Sincerely, John Wunderlich @PrivacyCDN <https://twitter.com/PrivacyCDN> Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

6 6

Issue #256: Consider the naming of entities and concepts: major entity/concept terms
by Eve Maler 11 Nov '16

11 Nov '16

https://github.com/KantaraInitiative/wg-uma/issues/256 This is one of a series of messages meant for discussion of naming of entities and concepts. This message consolidates a bunch of *major entity/concept* terms from the GitHub issue: - resource owner (RO) (original; from OAuth) - requesting party (RqP) (original; confusion with identity "RP") - resource server (RS) (enhanced OAuth version; also acts as OAuth client; confusion with identity "RP") - client (enhanced OAuth version; also acts as OAuth client; confusion with identity "RP") - authorization server (AS) (enhanced OAuth version) - resource set (original), protected resource, resource (colloquial) - scopes (also appeared in the *authorization/claims* message) For now, let's please discuss only in email, unless we're all somehow magically aligned by the time we get to the next call. I'll provide my own thoughts in a followup message. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 7