Page Comparison

...

The UMA interfaces diagram maps out the relationships of UMA entities to OAuth entities, and UMA APIs to clients that call them.

The UMA Implementations page catalogues some known implementations, including open source.

The generic low-level UMA flow swimlane  swimlane illustrates a sample realistic flow and points off to specific UMA specification sections.

The UMA Implementations page catalogues some known implementations, including open source.

 Here is the source code:

participant "resource\nowner (RO)" as RO
participant "resource\nserver (RS)" as RS
participant "authorization\nserver (AS)" as AS
participant "client\napp (C)" as C
participant "requesting\nparty (RqP)" as RqP
note over RO, RS, AS, C, RqP
Sample low-level UMA flow with photo access scenario; V1.0.1 spec references
end note
RS-->RS: OOB Learn AS location
RS->AS: UMA1.4 Retrieve AS config data
AS->RS: UMA1.4 Return AS config data
AS->RS: UMA2 Issue client creds\n(can be dynamic)
RS->RO: UMA1.3.1 Redirect to AS...
RO->AS: ...to log in and consent to...
AS->RS: ...PAT issuance (OAuth scope="uma_protection")\n(can use any grant flow, e.g. implicit or client creds)
RO-->RS: OOB Choose resources to protect
RO-->AS: OOB Configure policies (can happen after client attempts access)
note over RS,AS
Assume one static photo resource, simple scope strings
end note
RS->AS: RSR2.2.1 POST /resource_set\nat RSR endpoint with "view" and "print" scopes
AS->RS: RSR2.2.1 201 Created; _id in body has {rsid}
RqP-->C: OOB Provision protected resource location
C->RS: UMA3.1.1 Attempt GET /photo.jpg (view) at resource endpoint
RS->AS: UMA3.2.1 POST requested permission with “view”\nat permission registration endpoint
AS->RS: UMA3.2.3 Return permission ticket
RS->C: UMA3.3.1 Return as_uri and permission ticket
C->AS: UMA1.4 Retrieve AS configuration data
AS->C: UMA1.4 Return AS config data
AS->C: UMA2 Issue client creds\n(can be dynamic)
C->RqP: UMA1.3.2 Redirect to AS...
RqP->AS: ...to log in and consent to...
AS->C: ...AAT issuance (OAuth scope="uma_authorization")\n(can use any grant flow, e.g. implicit or client creds)
note over C,AS
Assume complex interaction for argument's sake
end note
C->AS: UMA3.5.1 POST plain authz data request with\npermission ticket at RPT endpoint
AS-->AS: UMA3.5.2 Assess request
AS->C: UMA3.5.4 Return need_info with error_details hints:\nauthentication_context and claims
C->RqP: UMA3.6.1 Redirect to AS...
RqP->AS: ...for...
AS->C: ...step-up authentication
C->AS: UMA3.5.1 POST claim token with permission ticket\nat RPT endpoint
AS->C: UMA3.5.4 Return need_info with claims\nand redirect_user
C->RqP: UMA3.6.3 Redirect to AS...
RqP->AS: ...to provide claims in person...
AS->C: ...until AS reports claims_submitted
C->AS: UMA3.5.1 POST plain authz data request with\npermission ticket at RPT endpoint
AS->C: UMA3.5.3 Return success and RPT
C->RS: UMA3.1.2 Attempt resource access with RPT
note over RS,AS: Assume default RPT profile and happy path
RS->AS: UMA3.4.2 POST to token introspection endpoint
AS->RS: UMA3.4.2 Return extended introspection object
RS-->RS: UMA3.3.3 Assess access attempt against\npermissions; has "view" scope
RS->C: UMA3.3.3 Enable photo viewing
C->RS: UMA3.1.2 Attempt POST /photo.jpg (print) at resource endpoint with RPT
note over RS: Assume cache is allowed and fresh
RS-->RS: OOB Consult RPT cache; no “print” scope
RS->AS: UMA3.2.1 POST requested permission with “print”\nat permission registration endpoint
AS->RS: UMA3.2.3 Return permission ticket
RS->C: UMA3.3.1 Return as_uri and permission ticket
note over C: Assume cache is allowed and fresh
C-->C: OOB Consult AS config data cache
note over C,AS
Assume simple interaction\nfor argument's sake;\ncached claims OK for “print”;\nAS chooses to refresh RPT string
end note
C->AS: UMA3.5.1 POST plain authz data\nrequest with permission ticket\nat RPT endpoint
AS-->AS: UMA3.5.2 Assess request
AS->C: UMA3.5.3 Return success and new RPT
C->RS: UMA3.1.2 Attempt resource access with RPT
RS->AS: UMA3.4.2 POST to token introspection endpoint
AS->RS: UMA3.4.2 Return Return extended introspection object
RS-->RS: UMA3.3.3 Assess access attempt against\npermissions; has "print” scope
RS->C: UMA3.3.3 Enable photo printing