Policy Manager

27 Aug 2020

      Hi,
To our discussions, I’ve started to break out just the RO policy manager component of the original wallet spec

Best,
- Alec

Alec Laws
647 822 1529
alec@identos.ca

—

## 1. Introduction

This document extends [UMA Fedz] in order to specify the interface provided by the AS to the RO for policy management. This is achieved by introducing a Policy Management API specification and client type which represents the RO: the UMA Policy Manager.

This new client type is authorized to use the policy API after being authorized by the RO as the AS. THis is the same mechanism used by an RS to put resources under protection, the RS is issued a PAT by the AS.

This new client provides a few key benefits to an UMA ecosystems
- The AS may delegate policy management user expereince and advicce to another party
- The RO is able to choose this client, where they may not be able to choose an AS or RS. The RO receives a consistent policy management interface
- The RO may manage resources at many AS's to have a complete view of their resources and policy

For example, there are two UMA AS's, one being operated by the Alice's local health authority and one operated by Alice's personal Bank. Alice's resource servers are only able to accept authorization decisions from those RS, effectively Alice must use those RSs to protect her resources. When those AS's support this profile, they give back some agency to Alice in how she manages her resources and policy, and reduce their own need to provide this UX (maybe each AS provides on UMA Policy Manager by defaults, but also accept third party policy management services). Alice may then manage policy across all of her RS's and AS's from a single control panel. 

### 1.1 Notational Conventions

### 1.2 Abstract Flow

```
      +------------------+ 
      |     resource     | 
      |       owner      | 
      +------------------+ 
             |              
             |   
             v 
      +------------------+
      |     Policy       |
      |     Manager      |
      +------+-----------+
             |       
             |       
          manage (a PAT type authz?)   
             |              
             |              
             v              
       +-----------+   
       |   policy  |   
       |    API    |   
       +-----------+   
       +---------------+--+
       |                  |
       |   authorization  |
       |      server      |
       |                  |
       +------------------+
```

This specification uses all of the terms and concepts in [UMAGrant] and [UMA Fedz]. This figure introduces the following new concepts:

- UMA Policy Manager
- Policy API 		The API presented by the AS to the Policy Manager. This API is OAuth protected

### 1.3 HTTP Usage, API Security, and Identity Context

## 2 Authorization Server Metadata 

TBD

## 3 Policy API 

note: this API is very similar to the permission endpoint, expect the payload includes an RS sub, additional policy condition, and is signed by a RO-RS credential

The API available at the policy_endpoint enables the policy manager the modify policy over the RO's protected resources. These policies define the claims gathering requirements for an RqP to gain access to the resource, and should also indicate the intended purpose/use for resource access. Management of the policy beings on successful creation and ends on successful revocation.

The relationship manager uses a RESTful API at the authorization server's policy endpoint to create, read, update, and delete policy descriptions, along with retrieving lists of such descriptions.

note: I think it's also useful to allow the RO to read a list of registered resources, I don't think would live under the policy_endpoint, it's essentially like the GET API from the resource_registration_endpoint with additional information about the RS?

note: through the `   "user_access_policy_uri":"http://as.example.com/rs/222/resource/KX3A-39WE/policy"` the RS could also let the relationship manager know (though manage API) what path to use at the AS to modify policy for this resource?? This restricts

Figure TDB illustrates the policy API operations, with requests and success responses shown.
```
FIGURE TDB
```

- user authz to use the API, same as RS getting a PAT -> continuity of resources, "account at the AS"

- read rs's

- read registered resources
  - organized by RS?

- manage policy
  - resource(s) + acceptable claims conditions

### 4.a Policy Description

A policy is a JSON document, that describes the a policy sufficiently for the authorization server to make a decision for a resource request. A policy document MAY be provided as a signed JWT to ensure it's integrity to the RS during enforcement. A policy description has the following parameters

resource_id REQUIRED The resource id registered at the AS that this policy applies to

resource_scopes REQUIRED The approved scopes if the claims requirements are met

claims REQUIRED An array of claims/attributes that must be presented by the RqP in order to access this resource under this policy

optional/extension/discussion:
sub The subject known by the RS for this RO (useful for general resource definitions)
resource_server (again, useful for general resource definitions)

client_id The client application that may be used to access this resource

intent The purpose/intention of resource use the RqP must accept

For example... 

```
{
  resoruce_id: "KX3A-39WE",
  "resource_scopes": [
      "read-public",
      "post-updates",
  ],
  claims: [
    ???
  ]
}
```

Alec L

Domenico Catalano

Adrian Gropper

Alec Laws

tags

participants (4)