Working Drafts

This page collects our draft specifications and other auxiliary material, and various other useful materials that may contribute to them. See the list of child pages at the bottom for a summary.

The following diagram illustrates the "call tree" of key specifications and other documents that are relevant to the UMA universe. Click on boxes in the diagram to get the corresponding document. (Note that this diagram may not keep up with rapid spec changes and links only to one document even if there are multiple representations or versions or variants; the table below gives more detail where warranted.)

Unknown macro: {html}

Specifications in Progress

We are currently using Christian's UMA-Specifications area on github – http://github.com/mrtopf/UMA-Specifications – for our active spec development, with snapshots provided at http://mrtopf.clprojects.net/uma/. Following is an accounting of specs and their status.

Spec	Description	Status
UMA Scenarios and Use Cases	Records the scenarios and use cases governing the development of the User-Managed Access protocol and guiding associated implementations and deployments.	Currently maintained directly on this wiki. Latest version is here. We are behind on assessing and adding scenarios; see below on this page for the "scenario docket".
UMA User Stories	Records the use cases in a clipped "user story" form similar to that used by the Agile methodology.	Currently maintained directly on this wiki. Latest version is here.
UMA Requirements	Records the specific requirements governing the development of the User-Managed Access protocol and guiding associated implementations and deployments.	Currently maintained directly on this wiki. Latest version is here. We treat design principles (beyond the ones in our charter) as "emergent", and collect them as we see fit.
UMA 1.0 Core Protocol	Defines the User-Managed Access (UMA) 1.0 core protocol. This protocol provides a method for users to control access to their protected resources, residing on any number of host sites, through an authorization manager that makes access decisions based on user policy.	Active development currently takes place on github. A high-fidelity snapshot is kept here (the working draft on this site is a copy of the high-fidelity one that may not look quite right). Note that the core spec currently points to OAuth 2.0 draft 10, but draft 11 came out recently and we haven't synced with it yet.
Resource registration	Defines the mechanism for hosts to convey important information about resources that the AM needs to protect.	This spec has seen significant new progress.
Dynamic client registration	Defines how hosts can dynamically discover information about an AM and how hosts and requesters can dynamically register at an AM to get a unique client identifier and optional secret.	Some UMA group participants have contributed an Internet-Draft to the IETF on this (pretty HTML version here), and intend to continue working on it as an OAuth WG action item.
Protocol Issues	Random list of issues we need to burn down in working on the specs.	This list is known not to be complete. We are also putting specific spec design issues directly into the specs on github.
Claims 2.0	Defines a JSON-based format for expressing claims and requests for claims.	Currently maintained directly on this wiki. Latest version is here. (See also the proposal for third-party-asserted "trusted claims".)
Simple Access Authorization Claims	Uses the Claims 2.0 specification to define a small set of basic claims to be used in the process of User-Managed Access (UMA) access authorization.	Currently maintained directly on this wiki. Latest version is here.
Legal Considerations in UMA Authorization	Explores legal issues raised by the act of using User-Managed Access (UMA) to authorize another party to get web resource access.	Currently maintained directly on this wiki. Latest version is here. Awaiting incorporation of many comments, include a contribution by JeffS.
Lexicon	Compendium of official and unofficial terms and definitions related to UMA.	This document has served as an aid to figuring out legal considerations; now it is not very actively maintained. Latest version is here.

Scenario Docket

Following is the current status of scenarios and their constituent use cases.

Scenario nickname	Champion	Status	Other notes
Calendar	Eve	Accepted
E-commerce	Eve	Accepted
Loan	Domenico	Accepted
Distributed services	Christian	Pending
Two-way location	Eve	Pending
Requester delegate	Mike H.	Accepted	One of the two specific use cases was accepted, the other rejected
Employer/employee	Eve	Pending
Custodian	Maciej	Pending
Moving resources	Maciej	Pending
Protected inbox	Joe	Pending
CV sharing	Maciej	Accepted
Health data	Gerry	Pending
Car-buying	Iain/Joe	Awaiting submission	This will likely be a summary pointing to the original Kantara InfoSharing document
"Hey, sailor"	Eve	Awaiting submission
ACLs with PoCo integration	?	?
Terms negotiation: null	Eve	Pending
Terms negotiation: requester identification	Eve	Pending
Terms negotiation: facts	Eve	Awaiting submission
Terms negotiation: promises	Eve	Awaiting submission
Terms negotiation: payments	Eve	Awaiting submission