- WG-UMA - mailman.kantarainitiative.org

Proposal for revised UMA Legal mission statement
by Eve Maler 02 Nov '16

02 Nov '16

Completing my action item. Please let me know what you think! Current mission statement(s) <http://kantarainitiative.org/confluence/display/uma/UMA+Legal> Recent discussion on this point <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> - Produce a set of toolkits and associated educational materials by the end of 2017 whose purpose is to accelerate the ability of those in the following roles to adopt, deploy, and use UMA-enabled services in a manner consistent with UMA's charter <http://kantarainitiative.org/confluence/display/uma/Charter>*, particularly where the resource owner is an individual: - Individuals themselves ("natural persons") - Organizations ("legal persons" such as businesses and governments) - Legal representatives of the above - Focus on GDPR-related toolkits first and foremost. A toolkit could be anything that helps use or leverage an existing piece of legislation or framework, such as an SDK, a checklist, consent receipt templates or profiles, or a set of CommonAccord text, and could be related to the GDPR itself, the EU-U.S. Privacy Shield, BCRs, and so on. - Develop a roadmap by the end of 2016 that identifies specific deliverables and timelines within 2017. - By the end of 2016, develop two initial deliverables to inform the roadmap work: - Comparative analysis of UMA and GDPR concepts such as data subject, processor, and controller - Roundup of contractual and regulatory use cases - Leverage specialist legal expertise wherever possible to complete and review the deliverables. *What I mean here, specifically, is: "enable a resource owner to control the authorization of data sharing and other protected-resource access made between online services on the owner’s behalf or with the owner’s authorization by an autonomous requesting party" *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2016-11-03
by Eve Maler 02 Nov '16

02 Nov '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-11-03 Date and Time - *Thursdays,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-10-13 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-10-13> - Logistics for upcoming meetings (calendar <http://kantarainitiative.org/confluence/display/uma/Calendar>) and 2016 roadmap <http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016> check-in - Meta-discussion: Did anything come up at IIW that we *need* to discuss before/during working on UMA.next issues? - Work on UMA.next issues – Core is up to 06 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-06.html> – please review changes <https://github.com/KantaraInitiative/wg-uma/commits/06-edits> ahead of time! – comments in commits link directly to relevant sections in formatted spec - Claims redirection URI language change <https://github.com/KantaraInitiative/wg-uma/commit/b68fed44b33e63265cd1ad5f…> – no discussion unless someone raises a hand - Requesting party claims endpoint option 2: two commits (1 <https://github.com/KantaraInitiative/wg-uma/commit/da255cdb5f719b6ab6b9022f…> , 2 <https://github.com/KantaraInitiative/wg-uma/commit/fc407b420a2c899b81ced965…>) – no discussion unless someone raises a hand - "Authorization process" concept and logic <https://github.com/KantaraInitiative/wg-uma/commit/faf4c903b9b39c81f3a74ff2…> - Token profiling goes poof <https://github.com/KantaraInitiative/wg-uma/commit/48c61b999c9b0ab358102ddc…> – some questions that need discussing - Domenico's latest diagrams - See the up-to-date swimlane <http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd> - Set math: See 9-29 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-09-29> and 10-6 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-10-06> - Identify any other parts of the spec that are known to need attending to - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Core draft rev 06 is up
by Eve Maler 01 Nov '16

01 Nov '16

https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-06.html This rev has some discussed changes that just need final consensus, and some speculative changes that need discussion (mostly around the token profiling -- see the suddenly very short Sec 3.4 <https://docs.kantarainitiative.org/uma/ed/uma-core-2.0-06.html#check-rpt-st…>). I'll send out an agenda tomorrow that lists these points formally. I'm still useless at tagging and will take all the help I can get, but see the *top eight commits* (which took place on this date, Oct 31) on the list here: https://github.com/KantaraInitiative/wg-uma/commits/06-edits It really helps when people can review the new text ahead of time! The swimlane is also updated to correspond: http://www.websequencediagrams.com/files/render?link=Pu0sP0Oe2kjKc2WgdKZd Domenico has also sent me some awesome revised diagrams that I'll be working with tomorrow; stay tuned. I think we'll be able to get some new figures into the spec shortly. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA APAC sync tomorrow
by Eve Maler 31 Oct '16

31 Oct '16

*Purpose:* Synchronizing on current work with APAC-based participants and gathering their input. *RSVPs* from those in the APAC region (sent directly to me) will be much appreciated! - Sample times: Seattle *Tue Nov 1* 4pm / Sydney *Wed Nov 2* 10am / Wellington *Wed Nov 2* noon - Skype: +99051000000481 - US toll: +1-805-309-2350 - Sydney: +61.2.8014.4647 - Auckland: +64.9.973.0310 - Additional international numbers: https://www.turbobridge.com/ international.html <https://www.google.com/url?q=https%3A%2F%2Fwww.turbobridge.com%2Finternatio…> - Web: https://panel.turbobridge.com/webcall/ <https://www.google.com/url?q=https%3A%2F%2Fpanel.turbobridge.com%2Fwebcall%…> - Code: 178-2540# - Screenshare: http://join.me/findthomas <https://www.google.com/url?q=http%3A%2F%2Fjoin.me%2Ffindthomas&sa=D&ust=147…> (DO NOT USE join.me <https://www.google.com/url?q=http%3A%2F%2Fjoin.me&sa=D&ust=1475556106312000…> dial-in number) - See the calendar entry for more details: http://kantarainitiative.org/ confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA legal telecon 2016-10-28
by Eve Maler 28 Oct '16

28 Oct '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-10-28 - Working session on User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Working through use cases per party in the transaction Attending: Eve, Jeff S, Kathleen *Parking lot* A FAQ would be: What about the identity story? What about where the identity of the RO would be stored vs where the consents would be stored? (thinking of Eve's "scenario 1", which is the UK Blue Badge one) *FAQ idea* We should add FAQs in the doc itself, to answer questions right as they arise in readers' minds, such as: - Once data is unshared, doesn't the recipient already have the data? What happens after that? - This model seems to assume that the enterprise doesn't have any overarching policy itself, and just allows a user to have any sharing policy they wish. Is that correct? - This relates to the larger topic of moving the setting on the continuum of org/individual control more towards the individual; see "blockchain identity use case" - What are specific burdens around PHI vs generic PII? Let's collect these and be as "pointed" as possible in formulating them. We can decide how and where to answer them as we go. *Funded legal analysis and use case work* Eve reached out to Karsten, who likely doesn't have time for the work himself, but who has kindly made himself available to chat with Eve to suggest next steps. She will take action on this. Eve suggests that we should decide, by the end of the year, which deliverables to produce in 2017 as "toolkits" (of some sort) for *all* of the frameworks out there. We discussed our rationale for this: It's to get from our very early stage of UMA adoption to exactly one evolutionary stage further. [image: (smile)] Meaning, we recognize that organizations have incentives to gather data, sometimes act badly towards less-empowered parties (individuals in the main), and so on, and we are looking to demonstrate benefits to those organizations – particularly business and legal audiences -- of the use of UMA through educational materials and reduce friction in using UMA through our "toolkits" (which could be model clauses, could be BCR tools, could be consent receipt templates or profiles, etc.). This is basically a further sharpened mission proposal, if you compare to our 2015 and 2016 versions <http://kantarainitiative.org/confluence/display/uma/UMA+Legal>. *AI:* Eve: Propose a sharpened mission statement on the list for review. Regarding the number of use cases in the world: The hope is that it's more like prepositions (a couple of dozen in English) vs verbs (essentially infinite)! But if there are really any number of them, probably we'll have to identify the most common ones that have lots of examples that hew to a pattern, and leave the "long tail" ones alone. Eve is planning to document these briefly in the wiki and prepare them for our hoped-for legal expert to review, so that we can get to a place where our "toolkits" can supply good tools that map neatly to GDPR interpretations. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: no WG meeting this week (legal call Friday is still on)
by Eve Maler 25 Oct '16

25 Oct '16

For those at IIW, have a great time! Let us know how everything goes. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder for those convening UMA sessions at IIW
by Eve Maler 23 Oct '16

23 Oct '16

At the beginning of any UMA-related session, please remind other attendees that: - The UMA Work Group (see the wiki at *tinyurl.com/umawg <http://tinyurl.com/umawg>*) is part of the Kantara Initiative - Kantara is a signatory of the OpenStand (see *open-stand.org <http://open-stand.org>*) Principles and embraces an open, transparent, multi-stakeholder community - The Work Group has an IPR policy called "Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non discriminatory" (see *tinyurl.com/kantaraipr <http://tinyurl.com/kantaraipr>* and the appropriate section) - We strongly recommend that those who wish to *contribute UMA feedback* during or after the session join the WG as a (voting or non-voting) participant, which can be done online (see the *Join* link off the wiki) - Questions about Kantara/IPR can be directed to Colin, and questions about the Work Group can be directed to Eve/@xmlgrrl You can do this in the form of slides, and/or verbally reinforced by session notes, or whatever. Sending this consistent message will really help. Thank you! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Section 7 - Security considerations - bearer tokens
by Cigdem Sengul 22 Oct '16

22 Oct '16

Hello, Eve suggested that I start the discussion about this in the list. Regarding the security concerns about the bearer tokens in the draft, I was curious whether it is worth mentioning Proof-of-Possession (PoP) tokens. In addition, RFC 6750 recommendations may also be referred to in the draft. Thanks, --Cigdem

4 7

Notes from UMA telecon 2016-10-21
by Eve Maler 21 Oct '16

21 Oct '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-10-21 MinutesRoll call Quorum was not reached. Logistics *Next week: no meeting because of IIW!* Have a great time if you're going. Please don't forget to send George comments on his deck, and soon. Approve minutes Approve minutes of UMA telecon 2016-10-13 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-10-13>: Deferred. Work on UMA.next issues *Requesting party claims endpoint:* Eve's proposal for the AS *declaring a requesting party claims endpoint* to the client was that we should pick option 2: both static (in the config data) and dynamic (in the response to the client) methods, with MAY, and with dynamic overriding static if it's present, providing the rationale that static pattern enables the RqP to authorize client pushing of claims and the dynamic pattern enables variable URLs according to the AS's management of its API. Mike notes that OIDC just had a thread <http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20161010/0063…> about a similar matter, regarding scopes. Eve guesses that this specific thread may not be related because it's about a required registration and the interaction between two specs. Is there another thread? Eve proposes spec'ing the text, and if anyone can identify a concern that seems more related, do it by the time rev 06 is out. Eve proposes that the definition of "authorization process" should require that "request_submitted" be more formally defined to have the AS emit a 403, and say that "The authorization server responds with the HTTP 403 (Forbidden) status code.", and the client is free to start another authorization process at a later time. Similarly the other 400s require starting new authorization processes. This makes clear what "persistence" means for a PCT. Mike and Cigdem are supportive. *Authorization interface and UMA grant:* We looked at Dom's first diagram. We requested: - Adding "natural person" and "legal person" icons to both the RO and RqP blocks - Some way of ensuring that inside the AS block: - The protection API concept is associated with the RO-RS-AS tuple - The authorization interface concept is associated with the C-RqP-AS tuple - The UMA grant concept is associated with the C-AS tuple - The PCT is shown as being optional in a nice-looking way - The second canvas with the life cycle should use initial capitals in the text - Attempt resource access - Register requested permission - Authorization process - Authorization assessment - It should also have a small "start" arrow to show that the client attempts access to the resource - The life cycle circle should be a bit smaller to make sure all the outer text shows - Overlay the RPT so that it shows "through" the life cycle (maybe make the circle translucent?) - Keep up the flowcharts according to the swimlane; do as you wish with the life cycle color coding Instructions: - Spec requesting party claims endpoint declaration as indicated above - Spec authorization process definition as indicated above - Create a draft ASCII diagram for the first canvas - Update swimlane *Bearer RPT and PoP tokens:* We didn't get to this, so please weigh in on the list. Eve is happy to try out spec text (and also removing spec text!) in 06 if we hurry on that. Attendees As of 3 Oct 2016, quorum is 6 of 11. (Domenico, Sal, Nagesh, Andi, Robert, Maciej, Eve, Jeffrey, Mike, Cigdem, Sarah) 1. Domenico 2. Eve 3. Mike 4. Cigdem Non-voting participants: - John Regrets: - James *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2016-10-21
by Eve Maler 21 Oct '16

21 Oct '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-10-21 - Working session on User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Working through use cases per party in the transaction Attending: Eve, John W, Ann What is the scope of our work (in this subgroup)? The technical layer may or may not change, while the contractual and regulatory layers above may change surrounding it. Our effort to gather use cases is an attempt to literally scope our work for now. Think of this as a "V1" effort of the "UMA legal subgroup" (which perhaps needs a new name because "legal" is too specific?). The use cases are driven by business and influenced by the regulatory environment, and could be implemented with UMA *and*other technologies – e.g., consent receipts, user-submitted terms, JLINC's stuff, etc. Eve's theory: We wanted to do draft model text by 1Q2016. [image: (smile)] But the need for some visible progress by 4Q2016 is getting acute. Evidence: The use case of "delegation of access rights" (think "power of attorney", or positive acceptance of access on behalf of the resource owner, or "I am accepting that you gave me rights to drive this connected car", or "this is a payment API and Alice gives Bob the right to spend money out of her account") keeps coming up. UMA the technical solution says nothing about the API semantics, but the contractual and maybe the regulatory layer (think Open Banking API and PSD2) may say a lot about this. Also, there are some complementary technologies such as Token Exchange <https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-05>, which has an "act_as" semantic, which may have a role at the technical layer. Once upon a time, we had innovated the "Binding Obligations" approach, which enabled a mapping of the non-technical layers to the technical layer where there was a state change so that it's possible to capture that change as part of the chain of evidence (hey, with blockchain/DLT involved??). Sometimes there is no technical state change at the UMA level, but sometimes there is, e.g., a token expires or gets issued or something. And we can start to be more and more clever about that. Keep in mind that "getting access" could mean getting a value of data, or getting access to a stream of data (e.g. Websocket), or getting access so as to insert or delete data. In the world that used to be, only control of "disclosure" mattered. But now, with UMA anyway, API publishers (RS's) are authoritative for what grain of access is possible, and ROs can control what scopes are handed out. What are the constraints on Bob's behavior once he gets access as a "first-party" RqP? 1. Bob is a completely free agent to use the access as he sees fit. 2. Bob is legally or contractually constrained in how he uses the access. 3. Bob is technically constrained in how he uses the access. Eve attempts to make the case that there are fine gradations (referencing her as-yet unpublished permission model taxonomy!) among "ways he uses the access", e.g. onward sharing with third-party grantees such as Charlie, and using it for marketing purposes vs. essential business purposes. She owes the group/the world her taxonomy writeup already. Look at last week's notes for the description of how UMA and a combination of other technologies could address the onward sharing proposition. The "*delegation of access rights*" use case seems to be such a popular one that maybe we should highlight it in our interim publications. What are the realistic options for Bob's use or disclosure of Alice's data he's been exposed to (in this specific case, vs. onward sharing)? "Information wants to be free", generally. To the extent that data is volatile, it loses value over time. To the extent that data is nonvolatile and valuable, helping Alice not to overshare will help, and leveraging wider ecosystems where the business model favors Alice's interests. Beyond that, only nontechnical methods of enforcement will need to be exploited to keep the Bobs in line. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0