To help me understand, I presume we are UMA 2013, including:
ASO to RSO obligation:
http://www.commonaccord.org/index.php?action=doc&file=GHx/KantaraInitiative/UMA/2013/2.md#4.2.Sec
and perhaps add indemnification from ASO to RSO against any liability to RO.
The question, if I understand it, is whether the RSO becomes legally
protected from claims by RO that info was improperly sent to RqP.
That sounds like a legal question, and the answer is probably "that
depends." As a strict matter of contract law, it seems easy enough to make
that happen. The RSO makes sure that the ASO has language in its contract
with RO that releases RSO, and looks to ASO for indemnification. But
depending on the nature of the information and the relationship of RSO to
RO (outside the pure data administration) RSO, the law could impose a duty
on RSO that cannot be waived and RSO might be worried that ASO is
financially fragile.
Have I understood the question?
On Fri, Dec 11, 2015 at 8:49 PM, Adrian Gropper
I'm trying to understand the essence of an UMA Legal framework by picking a very simple but real-life use case and premise.
Premise: The resource server operator (RSO) installs UMA because it limits their liability due to clients interactions. In other words, they are transferring some risk to an authorization server operator (ASO), otherwise they would just implement OAuth.
For simplicity, presume:
- a single resource: https://uma.rso.com/adrian/weight/readonly - terms of use: the data is only to be accessed by anyone, including rso, via the resource above - clients will present a valid SSL certificate and a token verifiable at the authorization server - this contract between RS and RO expires after one year or upon notice by either party
Under these circumstances, the RSO has transferred most of the liability for interacting with a particular client to the ASO. This, I believe is the UMA Legal MVP.
In a real-world use-case, the RSO may not be allowed to duck this much liability. For example, the RSO might be required by law to notify the RO that a particular Client / RqP is on an industry watchlist.
In this case, the Client / RqP is providing attributes to both the AS and the RS. The RSO bears somewhat greater liability unless it can warn the RO via UMA the same way it might warn the RO via OAuth.
Can the ASO bear the responsibility of warning the RO or must the RS warn the RO directly?
As far as I can tell, this is the essence of UMA legal. Everything else is just an elaboration on one of the four bullet points above. This, incidentally, is the use-case I'm discussing with the US Office for Civil Rights.
Adrian
--
Adrian Gropper MD
PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma