Re: [Ace] New doc: draft-maler-ace-oauth-uma-00

Hopefully it won't be too confusing if I offer a bit more nuance on top of Thomas's answer. (Sorry, I was away on a cruise ship last week and am just catching up on email!)

Registering a permission is, in fact, a required step. The *extent* of the permission is a judgment call that the resource server is allowed to apply. ("The resource server is free to choose the extent of the requested permission that it registers, as long as it minimally suffices for the access attempted by the client.")

You don't strictly need to create a profile of UMA that defines any missing parts at all; there are default (and, in some cases, mandatory-to-implement) profiles that you can use in all cases. However, in practice, there are points of variability where it is very likely that you will want to lock down deployment choices. The HEART WG is one example of a community of interest doing this profiling for both security and semantic reasons (health data sharing, in that case).

I, for one, don't actually believe that permission tickets are an area that will require profiling in most cases, because it's an artifact that is produced and consumed solely by the authorization server. However, I'm aware of some discussions around profiling permission tickets for various clever purposes. It's entirely okay to consider doing this.

Hopefully these thoughts are helpful.

	Eve

> On 25 Mar 2015, at 9:14 AM, Thomas Hardjono <hardjono@mit.edu> wrote:
> 
> Hi Olaf,
> 
> In order to use UMA in a given IoT scenario, you will need to create a profile of UMA that defines the "missing parts", such as the contents of the permission ticket. This is what the HEART WG is doing in the OIF. 
> 
> 
> /thomas/
> 
> 
> 
> 
>> On Mar 25, 2015, at 06:11, Olaf Bergmann <bergmann@tzi.org> wrote:
>> 
>> Eve,
>> 
>> Eve Maler <eve@xmlgrrl.com> writes:
>> 
>>> http://tools.ietf.org/html/draft-maler-ace-oauth-uma-00
>> 
>> Thanks for sharing this.
>> 
>> One question: draft-hardjono-oauth-umacore-12 specifies that when a
>> client attempts to access a protected resource, the resource server must
>> register a requested permission with its authorization server to get an
>> RPT that the client must present to the authorization server. From
>> reading Section 5 of draft-maler-ace-oauth-uma, it is unclear to me
>> whether or not this step is required in this profile. Can you clarify
>> how this is supposed to work?
>> 
>> Thanks
>> Olaf
>> 
>> _______________________________________________
>> Ace mailing list
>> Ace@ietf.org
>> https://www.ietf.org/mailman/listinfo/ace
> 
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl