Re: [WG-UMA] Some examples of terms of service for getting "social" OAuth client credentials [legal]

Very briefly: UMA the technology rests on OAuth the technology. A central benefit of OAuth the technology is that is distinguishes the identity of a client application from the identity of the user of that client application (by having an AS issue credentials to a client). Accordingly, an UMA AS (in the role of an OAuth AS) needs to issue client credentials to both an UMA RS and an UMA client (each in the role of an OAuth client). We have existence proofs of business agreements hinging on the issuance of OAuth client credentials. We have decided to examine those agreements for hints of interesting elements that we may want to include in UMA legal tools/rules at a similar level. By no means do we need to feel constrained by what’s in any one of these exemplars. Eve

On 30 Sep 2015, at 8:29 AM, Adrian Gropper wrote:

I'm confused. How is my UMA Authorization Server supposed to use the Privacy Policies and Terms of Service? Are we assuming some highly standardized data model around some 50 aspects of what Facebook might or might not do with my data before UMA can work? The degree of domain and business specificity that this approach implies seems totally impractical.

I see service provider assertions such as Privacy Policy and Terms of Service as secondary to UMA, to be considered off line at the time when the RO either registers an AS with an RS or walks away. These policies will also enter into dispute resolution.

The only link between these policies and the AS could be that the RS must specify which of the 50 clauses applies to a specific transaction to be authorized by the AS. In most cases, this metadata would not be "understood" by the AS but it would be part of the transaction logs. Occasionally, it could be linked by the RO to specific AS behavior as a kind of exception. For example, I might configure my AS to reject authorizations bearing the Facebook Policy Tag 7g without any particular standard or policy calculus.

From my perspective, the principal role of my AS is to introduce convenient _centalized_ transparency and notice into the data use practices of my service providers along with an opportunity to occasionally opt out of a transaction.

Adrian

On Wednesday, September 30, 2015, James Hazard javascript:_e(%7B%7D,'cvml','jh@hazardj.com');> wrote: One of the Facebook documents and one of the Twitter documents are now in component form. On the Facebook doc, there are some names for section components, positing a taxonomy. These names (mostly verbs) are simply a guess, and non-exclusive (the same materials can be recombined using different names). But, IMHO, evocative. In any event, a starting point.

http://cmacc-uma.herokuapp.com/index.php?action=source&file=/Wx/com/facebook/developers/policy/Form/Doc_v01.md http://cmacc-uma.herokuapp.com/index.php?action=source&file=/Wx/com/facebook/developers/policy/Form/Doc_v01.md

Both docs live in this tree: http://cmacc-uma.herokuapp.com/index.php?action=list&file=/Wx/com/ http://cmacc-uma.herokuapp.com/index.php?action=list&file=/Wx/com/

A theory of such trees is at: http://new.commonaccord.org/index.php?action=list&file=/ http://new.commonaccord.org/index.php?action=list&file=/

On Tue, Sep 29, 2015 at 5:03 AM, Eve Maler > wrote: I started collecting a few of these here:

https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Examples-of-Term... https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Examples-of-Term...

Eve Maler | cell +1 425.345.6756 tel:%2B1%20425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl@gmail.com <>

_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org <> http://kantarainitiative.org/mailman/listinfo/wg-uma http://kantarainitiative.org/mailman/listinfo/wg-uma

--

Adrian Gropper MD

PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/ http://patientprivacyrights.org/donate-2/

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl@gmail.com