...
This is a list of issues we need to burn down in working on the spec(s) (currently just the core protocol). See also the issues listed in the Scenarios and Use Cases document.
Access token formats
How to fill in the access token format property in the AM's hostmeta XRD?
Claims formats
How to fill in the claims format format property in the AM's hostmeta XRD?
XRD vs. JRD
Should JRD be used instead of XRD? in addition to XRD?
Compliance with OAuth 2.0
...
(
...
Closed)
Eran has begun exposing drafts of his OAuth 2.0 spec. We should begin We have begun moving the UMA core protocol spec onto an OAuth 2.0 basis as soon as practicable, and try to stay on top of any changes on a weekly basis.
Modularity
...
(
...
Closed)
Some UMA features on top of OAuth 2.0 are separable; some seem to be attractive to a wider developer audience even outside the UMA value proposition. Which should be defined in separate specs for greater modularity? Will some pieces be in a position to be submitted to the IETF in the near term, ahead of submitting some other pieces? Some possibilities:
- Dynamic discovery
- Back-channel token validation
- Claims-required mechanism
- Resource-oriented scope management
New vs. existing patterns for getting a token
(Assigned to Maciej)
The Lexicon describes ways that the existing WRAP profiles could be mapped to UMA's needs for a requesting party to participate in getting authorized access. What is the correct mapping? Do we need new and different patterns?We will be opportunistic in splitting out any modular features that are requested for use outside a unified UMA context.
Token-getting flows
Need to identify specific OAuth flows (and profile them, as necessary) in Step 2 to cover:
- Alice-to-service (on behalf of Alice)
- Alice-to-service (on its own behalf)
- Alice-to-Bob
Interactions between refresh tokens and the claims-required flow (Closed)
Do we have any need or desire to require refresh tokens to be issued in all cases, perhaps due to the positioning of the claims-required request, or is this a matter purely between a requester (client) and AM (authorization server)?
...
We've been asked for input on whether we need new OAuth error messages beyond the HTTP error layer. Do we need a new OAuth error around "claims-required", or an explicit extension point for an UMA error, or no explicit extension point at all for adding our own flow at this point?
Identity tokens and claims
(Assigned to GeorgeThis relates to the Claims 2.0 signing work, and possibly to the OAuth and OpenID Artifact Binding signing work.)
George Fletcher and Praveen Alavilli have mused on how to create "identity tokens" that would represent a particular user online in a generic way. Is this applicable to UMA scenarios in which the authorizing user or the requesting party must be identified? If so, is it useful for us to standardize it in some spec module? See:
...
George has motivated the need for identity tokens in an email thread. The next step is for the group to discuss and validate the need.
How do we solve the bob@gmail.com problem? There are three ways to get a verification of this:
- The requester may have a current session that will suffice, and generates a claim.
- The requester is willing to be an RP to the gmail IdP, and redirects Bob there to log in, and gets the claim and passes it along. (??)
- The requester redirects you synchronously to the AM, which acts as an RP itself. In this case, there's no claim being passed.
Do we have to allow for asking for claims in one language and getting claims back in another? E.g., you might want to ask for an identity claim in JSON/Claims 2.0, but maybe the IdP only speaks SAML. Does the resulting assertion need to be converted into a different form?
Making some simplifying assumptions, is it likely that Alice intends to share specific kinds of resources with specific other people whose "usernames" at the related requester app sites she already knows? In this case, can can configure the ACL policies with the "right" entries, such that the requester can either use an existing requesting-user session or sign a claim in lightweight fashion on behalf of the requesting user.
Token validation models
(Assigned to Maciej)
Several different ideas have been floated:
...
Maciej has laid out requirements and considerations in an email thread (and the group discussed the issue a tiny bit on 2010-04-01). The next step is to discuss how our use cases inform our need for a technical solution here.
Signed messages
(Assigned to Paul)
Does UMA require messages from the requester to the host to be signed in any circumstances, or does it need to ensure that the option is preserved in OAuth, or does it not care?
Paul has made a case that UMA needs no signing of messages in an email thread, and the group further discussed the issue on 2010-04-01. We await more written scenarios from TomH to inform our decision-making here.
(See also the newest OAuth signing proposals.)
Discovery
Needs for various kinds of discovery have come to light:
...
Resource-oriented scope management
(Assigned to TomH)Resources are represented differently in different systems. E.g., Flickr has its own system of naming and grouping resources. How can UMA handle all these different systems? What if you want to set the same policy over two sets of photos, one at Flickr and one at Picasa? It's suggested that hosts control exactly the granularity of access to sets of resources – it could inform the AM of every single resource it has, or could tell the AM it has "sets" (groups?) of resources. Policies at the AM can only be applied at the level of granularity that the host has informed it of. However, what if a single resource appears in multiple sets? The host needs to give the requester a description of the scope it needs to ask for. This could be "encrypted", with some label that maps to a struct that the host gave the AM earlier.
Optimizing for "baskets"
The following issue was discussed on 2010-04-22:
...
George wonders if this is missing an opportunity for truly intuitive and useful optimization on the requester's part when accessing all the things in a basket. Should it be possible for the requester to approach each host/protected resource in a basket with some kind of intermediate token saying that it's asking for access as part of a "basket request", so that it doesn't have to re-qualify over and over at the AM, by (e.g.) presenting the same set of claims? Then again, if inheritance works such that the "strongest" policy (according to whose definition??) is inherited by everything in the basket, that could be valuable.
Policy support
What kinds of policies would an AM support? What sorts of policy engines would they use? The guess is that there would be a core set of claims that would be supported, driving a minimum set of policies. Other kinds of policies, such as time-based ones, would likely be popular too. If real-time token validation is performed, then time-based policies (and auditing) could be really precise; otherwise there would be some variability based on access token validity windows.
Scalability
With a centralized component, what are the problems with scale? How can we test the scalability of real-time token validation? It's likely that every user can only have n login sessions a day, but they may have 10n or 100n data-sharing connections happen on their behalf a day.