UMA F2F 2010-11-01
| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
Date and Time
- WG F2F on Monday, 1 Nov 2010, colocated with IIW XI at 11am-5pm PT (time chart)
- No dial-in
- No telecon this week
- Boole room in the Computer History Museum
...
- Charles Andres
- Alan Karp
- Henrik Biering
- Joseph Holsten
- Jeff Stollman
Minutes
Thomas offered to be the serve as a notes-taker for for most of the day.. Thank you!
New AI summary
Alan |
...
Open | Write up backup service/copy service use case, with reference to requester delegate scenario. |
| ||
George | Open | Write up "problem B" as a user experience description that can be turned into a user story. |
| |
Eve |
...
Open | Put the public-private continuum language and diagram into the Lexicon. |
...
|
Roll call
Quorum not reached.
...
Other updates from the wider UMA world
...
Maciej will speak on UMA at Devoxx in Antwerp soon. His paper for the MW4SOC conference will be published shortly.
Alan has worked on "transitive access" research, and will submit a scenario focusing on this. Our "requester delegate scenario" is related to this.
Over lunch, Alan demonstrated Tyler Close's work on "the Introducer" with some others (including Mike Hanson), which may offer one solution for the resource discovery problem in cases where the authorizing user wants to send the requesting party a link to a protected resource.
UMA for newbies
We reviewed the UMA entities, basic lexicon, trust a token/get a token/use a token protocol flow, the spec module map, and trusted claims (which Eve suggested should layer on top of the core protocol as an extension). The "Bob at Gmail" problem involves Alice wanting to grant access to Bob in his "bob@gmail.com" embodiment, perhaps through an access control list (ACL) that lists this email address. How can Bob show up, using some requester app, in a way that proves he is bob@gmail? This is illustrative of the trusted-claim problem.
In UMA terminology, we need to distinguish a "requester" (a software tool that implements an UMA protocol endpoint) and a "requesting party" (an individual or company that may assume legal liability for gaining authorized access).
The Liberty Alliance's Identity Web Services Framework (ID-WSF) solved for patterns like this, but it was considered by some as having too many components, and many web developers today consider it as being too complex.
There are many ways for Alice to provision knowledge of the resource to the requesting party. If the latter is Bob, for example, she can email the resource URL to him, hand him a business card with the resource location printed on it, or publish information about it openly on her blog. (Information cards and discovery services could also be employed.)
User stories: add, review, prioritize, decide
We reviewed the new User Stories page. Eve is trying to use some analogues of Agile techniquies to develop UMA user stories.
The page isn't very complete yet; Eve put in a sampling of user stories to test the columnal design, column sorting, and general "feel". Epics are tightly associated collections of stories; she has made epics all be in the "UX" category so that they focus on a human being's desire for some benefit. Some stories are "negative", in that they express some (typically malicious) entity's desired outcome that we want to avoid if at all possible.
...