<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Thank you Adrian.
<div class=""><br class="">
</div>
<div class="">The next sentence after the example reads “The resource server MUST NOT give access in the case of an invalid RPT or an RPT associated with insufficient authorization.” </div>
<div class=""><br class="">
</div>
<div class="">Reading those together my interpretation is that the RS is permitted to deny access for it’s own reasons, but the RS is not permitted to grant access that the AS has denied. Am I reading it correctly?</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">Scott</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jun 22, 2016, at 10:59 AM, Adrian Gropper <<a href="mailto:agropper@healthurl.com" class="">agropper@healthurl.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">From the Jan 29 minutes: <br class="">
<p class="">The actual UMA Core spec has a clause, which Eve has dubbed the "Adrian clause":
<a href="https://docs.kantarainitiative.org/uma/rec-uma-core-v1_0_1.html#give-access" class="" rel="nofollow">
UMA Core Sec 3.3.3</a>: "The resource server MAY apply additional authorization controls when determining how to respond."</p>
<p class="">Adrian<br class="">
</p>
</div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Wed, Jun 22, 2016 at 10:31 AM, Scott Shorter <span dir="ltr" class="">
<<a href="mailto:sshorter@kimbleassociates.com" target="_blank" class="">sshorter@kimbleassociates.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word" class="">
<div class="">Hi Adrian,</div>
<div class=""><br class="">
</div>
<div class="">Thanks for clarifying the distinction. I just realized that my understanding of the term authorization server is probably influenced more by my familiarity with the <a href="https://www.commoncriteriaportal.org/files/ppfiles/PP_AUTHSRV_BR_v1.0.pdf" target="_blank" class="">2005
common criteria protection profile</a> than it is by UMA. I’m curious whether and how well UMA maps to any of the usage scenarios in that document, but that’s a thread that I’m going to choose not to tug on right now.</div>
<div class=""><br class="">
</div>
<div class="">I do agree that the RS enforces the access control policy because they serve up resources when the required permission tickets are presented. The AS absolutely has a role in enforcing an access control policy since they are responsible for serving
up permission tickets only in accordance with the policy. Am I misunderstanding something? I have not found the “Adrian clause”, can you point me to it?</div>
<div class=""><br class="">
</div>
<div class="">Thanks and regards,</div>
<span class="">
<div class="">Scott</div>
<br class="">
<div class="">Scott Shorter - Vice President, Security<br class="">
<a href="mailto:sshorter@kimbleassociates.com" target="_blank" class="">sshorter@kimbleassociates.com</a><br class="">
</div>
<br class="">
</span>
<div class="">
<div class="h5">
<div class="">
<blockquote type="cite" class="">
<div class="">On Jun 21, 2016, at 10:54 AM, Adrian Gropper <<a href="mailto:agropper@healthurl.com" target="_blank" class="">agropper@healthurl.com</a>> wrote:</div>
<br class="">
<div class="">Hi Scott,
<div class=""><br class="">
</div>
<div class="">Thank you for highlighting a critical distinction between the AS as "trusted agent of the patient" and the AS "enforcer". This is a very helpful step to consensus.</div>
<div class=""><br class="">
</div>
<div class="">I maintain that the RS Is the only "enforcer" in the UMA model. Whatever the UMA AS says, the RS always has the last word and may override the AS to grant either more or less scope. (This kind is a foundational component of UMA as opposed to just
OAuth, and is informally referred to in the guidance docs as "the Adrian clause".)</div>
<div class=""><br class="">
</div>
<div class="">I hope we can settle whether the AS is completely trusted by Alice or not as we continue this thread.<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Adrian</div>
<div class=""><br class="">
On Tuesday, June 21, 2016, Scott Shorter <<a href="mailto:sshorter@kimbleassociates.com" target="_blank" class="">sshorter@kimbleassociates.com</a>> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word" class="">Hi Adrian,
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class="">Let me try to convince you that there's no need for HEART to be profiling privacy and that trying to do so would do more harm than good.<br class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class=""><br class="">
</div>
<div class="">While I concur with the premise that HEART should not be profiling privacy, I do not agree that that is what is currently being proposed. As I mentioned on the call I believe the issue at hand is access control rather than privacy.</div>
</div>
</div>
</div>
</div>
</div>
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">During today's HEART call we agreed that "Alice completely trusts her UMA Authorization Server." <br class="">
</div>
</div>
</div>
</div>
</blockquote>
<br class="">
</div>
<div class=""><font color="#454545" class="">I believe that the proposed statement is incomplete until it specifies
</font><i style="color:rgb(69,69,69)" class="">what</i><font color="#454545" class=""> Alice “completely trusts” her AS
</font><i style="color:rgb(69,69,69)" class="">to do</i><font color="#454545" class="">.</font><span style="color:rgb(69,69,69)" class=""> </span><font color="#454545" class="">I suggest instead that “Alice trusts her UMA Authorization Server to enforce the
access control policy.” Questions of specifically how to protect Alice’s privacy using those access control settings are beyond the scope of the profile, but discussion of how access control would be implemented in the profile is quite appropriate.</font></div>
<div class=""><span style="color:rgb(69,69,69)" class=""><br class="">
</span></div>
<div class="">
<div style="margin:0px;line-height:normal;color:rgb(69,69,69)" class="">So the discussion is not about “profiling privacy” so much as identifying the access control settings that make sense in the context of the use case. Specifying that the AS is responsible
for enforcing an access control policy is well within the scope of defining a profile. It also makes sense for a use case to specify that certain resources are expected to be protected by default.</div>
<div style="margin:0px;line-height:normal;color:rgb(69,69,69);min-height:14px" class="">
<br class="">
</div>
<div style="margin:0px;line-height:normal;color:rgb(69,69,69)" class="">I think we agree that the profile should not “profile privacy” by specifying on Alice’s behalf what data may or may not be shared, but it seems entirely in the scope of the effort to stipulate
that the Authorization Server will enforce Alice’s expected access control policy. A specific use case can even describe the access control policies that are assumed to be in place, and the ways that Alice might modify them, as a way to illustrate the capabilities
enabled by the profile.</div>
</div>
<div style="margin:0px;line-height:normal;color:rgb(69,69,69)" class=""><br class="">
</div>
<div style="margin:0px;line-height:normal;color:rgb(69,69,69)" class="">Thanks,</div>
<div style="margin:0px;line-height:normal;color:rgb(69,69,69)" class="">Scott</div>
<div class=""><br class="">
<div class="">Scott Shorter - Vice President, Security<br class="">
<a class="">sshorter@kimbleassociates.com</a></div>
</div>
</div>
</blockquote>
</div>
<br class="">
<br class="">
-- <br class="">
<div dir="ltr" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div dir="ltr" class="">
<div class=""><br class="">
<div dir="ltr" class="">Adrian Gropper MD<span style="font-size:11pt" class=""></span><br class="">
<br class="">
<span style="font-family:"Arial",sans-serif;color:#1f497d" class="">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:"Arial",sans-serif;color:#1f497d" class=""><br class="">
HELP us fight for the right to control personal health data.</span><span style="font-family:"Arial",sans-serif;color:#1f497d" class=""></span><span style="font-family:"Arial",sans-serif;color:#1f497d" class=""><br class="">
DONATE: <a href="http://patientprivacyrights.org/donate-2/" target="_blank" class="">
<span style="color:#0563c1" class="">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:#1f497d" class=""></span>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
<br clear="all" class="">
<br class="">
-- <br class="">
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div dir="ltr" class="">
<div class=""><br class="">
<div dir="ltr" class="">Adrian Gropper MD<span style="font-size:11pt" class=""></span><br class="">
<br class="">
<span style="font-family:"Arial",sans-serif;color:#1f497d" class="">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:"Arial",sans-serif;color:#1f497d" class=""><br class="">
HELP us fight for the right to control personal health data.</span><span style="font-family:"Arial",sans-serif;color:#1f497d" class=""></span><span style="font-family:"Arial",sans-serif;color:#1f497d" class=""><br class="">
DONATE: <a href="http://patientprivacyrights.org/donate-2/" target="_blank" class="">
<span style="color:#0563c1" class="">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:#1f497d" class=""></span>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>