Subject: [Ace] New doc: draft-maler-ace-oauth-uma-00

From: Eve Maler <[email-masked]>
Date: Tue, 10 Mar 2015 10:53:05 -0700

Hi all,

Hannes, Erik, Samuel, and I worked on a new discussion document that gives insight into the ways in which OAuth and UMA could be used towards IoT requirements for authentication and authorization:

http://tools.ietf.org/html/draft-maler-ace-oauth-uma-00

Quoting the abstract:

   Authentication and authorization are fundamental security features
   used in Internet and Web applications.  Providing the same level of
   security functionality to the Internet of Things (IoT) environment as
   well is a logical enhancement and reduces the risk of unauthorized
   access to personal data.

   IoT devices, however, have limitations in terms of processing power,
   memory, user interface, Internet connectivity, etc.  Since many use
   cases span Web and IoT environments and the question of "Web" vs.
   "IoT" can in some cases be considered a continuum, it is required to
   find security solutions that can accommodate the capabilities and
   constraints of both environments without significant compromises.

   Thus, an approach of adapting already standardized and deployed
   authentication and authorization technologies is worth examining.
   This document describes how the Web Authorization Protocol (OAuth) in
   combination with User-Managed Access (UMA) can be used for an IoT
   environment to bring Web-scale authorization services to the IoT
   world.

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

---

From: Olaf Bergmann <[email-masked]>
Date: Wed, 25 Mar 2015 11:10:55 +0100

Eve,

> http://tools.ietf.org/html/draft-maler-ace-oauth-uma-00

Thanks for sharing this.

One question: draft-hardjono-oauth-umacore-12 specifies that when a
client attempts to access a protected resource, the resource server must
register a requested permission with its authorization server to get an
RPT that the client must present to the authorization server. From
reading Section 5 of draft-maler-ace-oauth-uma, it is unclear to me
whether or not this step is required in this profile. Can you clarify
how this is supposed to work?

Thanks
Olaf

---

From: Thomas Hardjono <[email-masked]>
Date: Wed, 25 Mar 2015 16:14:35 +0000

Hi Olaf,

In order to use UMA in a given IoT scenario, you will need to create a profile of UMA that defines the "missing parts", such as the contents of the permission ticket. This is what the HEART WG is doing in the OIF. 

/thomas/

> On Mar 25, 2015, at 06:11, Olaf Bergmann <[email-masked]> wrote:
> 
> Eve,
> 
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

---

From: Olaf Bergmann <[email-masked]>
Date: Thu, 26 Mar 2015 12:11:21 +0100

Hi Thomas,

Thomas Hardjono <[email-masked]> writes:

> In order to use UMA in a given IoT scenario, you will need to create a
> profile of UMA that defines the "missing parts", such as the contents
> of the permission ticket. This is what the HEART WG is doing in the
> OIF.

Thank you for the clarification, maybe it would be good to include this
as a note or so in draft-maler-ace-oauth-uma.

Can you provide a pointer to the HEART WG's docs?

Grüße
Olaf

---

From: Thomas Hardjono <[email-masked]>
Date: Thu, 26 Mar 2015 14:18:06 +0000

Hi Olaf,

The need to create profiles is kind of expected (i.e. no need to call it out).
This was true also of the SAML2.0 specs where there is a core-spec and then
a bunch of profiles (the most oft-used being the Web Browser SSO profile),
bindings, etc. This allows the core spec to remain stable, and for new profiles
(use-case specific) to be developed later.

As Eve correctly noted (in previous UMA WG meetings), the UMA permission ticket
is an opaque structure, so it may not need to be profiled. However, IMO if there
are use-case deployments where multiple ASs are used and Federation is thus needed,
then the permission ticket may need to be profiled (at least for that use-case).

The HEART WG is specifically addressing the Healthcare vertical (not IoT per se).
They've just started, so it is early days yet. Their site is here:

http://openid.net/wg/heart/

/thomas/

________________________________________
From: Olaf Bergmann [[email-masked]]
Sent: Thursday, March 26, 2015 7:11 AM
To: Thomas Hardjono
Cc: Eve Maler; [email-masked]
Subject: Re: [Ace] New doc: draft-maler-ace-oauth-uma-00

Hi Thomas,

Grüße
Olaf