<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:13px"><div id="yui_3_16_0_1_1441798886758_4528"><span id="yui_3_16_0_1_1441798886758_4527"><font id="yui_3_16_0_1_1441798886758_8416" face="Courier New, courier, monaco, monospace, sans-serif">Hi Pedro - Nice to hear from you after a long time. Whatever you are planning to implement for an organization is perhaps what we are looking for a resource application within an organization. There are two different scenarios we are trying to handle which may be different from what this spec is about but we are trying to tie everything together. <br></font></span></div><div id="yui_3_16_0_1_1441798886758_4528"><span><font face="Courier New, courier, monaco, monospace, sans-serif"><br></font></span></div><div id="yui_3_16_0_1_1441798886758_4528" dir="ltr"><span id="yui_3_16_0_1_1441798886758_5911"><font id="yui_3_16_0_1_1441798886758_8463" face="Courier New, courier, monaco, monospace, sans-serif">1) A Client application will register with the Auth Server a list of "scopes" or permissions to access certain resource applications. But it doesn't mean that it will be able to gain access to all those resource apps (see the second point)</font></span></div><div id="yui_3_16_0_1_1441798886758_4528" dir="ltr"><span><font face="Courier New, courier, monaco, monospace, sans-serif"><br></font></span></div><div id="yui_3_16_0_1_1441798886758_4528" dir="ltr"><span id="yui_3_16_0_1_1441798886758_6254"><font id="yui_3_16_0_1_1441798886758_8464" face="Courier New, courier, monaco, monospace, sans-serif">2) Each of the resource applications will register its own policy (a policy engine will need to be built to evaluate the requests and provide a decision) on what a client application can/cannot access - for example, a client application with client_id "client1" can only have read only access to resource app1 or even a certain part of the app.</font></span></div><div id="yui_3_16_0_1_1441798886758_4528" dir="ltr"><span><font face="Courier New, courier, monaco, monospace, sans-serif"><br></font></span></div><div id="yui_3_16_0_1_1441798886758_4528" dir="ltr"><span id="yui_3_16_0_1_1441798886758_6925"><font id="yui_3_16_0_1_1441798886758_8458" face="Courier New, courier, monaco, monospace, sans-serif">3) When the client app uses the client credentials grant to obtain an access token to access resource application, the auth server will check both the policies and then provide the access token.</font></span></div><div id="yui_3_16_0_1_1441798886758_7894"><font face="HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif"><br></font></div><div dir="ltr" id="yui_3_16_0_1_1441798886758_7895"><font id="yui_3_16_0_1_1441798886758_8420" face="Courier New, courier, monaco, monospace, sans-serif">I haven't yet gone through the spec - so not clear whether it addresses the above but just wanted to share our thoughts with you.<br></font></div><div dir="ltr" id="yui_3_16_0_1_1441798886758_7895"><font face="Courier New, courier, monaco, monospace, sans-serif"><br></font></div><div dir="ltr" id="yui_3_16_0_1_1441798886758_7895"><font id="yui_3_16_0_1_1441798886758_8897" face="Courier New, courier, monaco, monospace, sans-serif">Thanks,</font></div><div dir="ltr" id="yui_3_16_0_1_1441798886758_7895"><font id="yui_3_16_0_1_1441798886758_8418" face="Courier New, courier, monaco, monospace, sans-serif">Raghu</font></div> <div style="font-family: times new roman, new york, times, serif; font-size: 13px;" id="yui_3_16_0_1_1441798886758_4537"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1441798886758_4536"> <div dir="ltr" id="yui_3_16_0_1_1441798886758_4535"> <hr size="1" id="yui_3_16_0_1_1441798886758_4538"> <font size="2" face="Arial" id="yui_3_16_0_1_1441798886758_4534"> <b><span style="font-weight:bold;">From:</span></b> Pedro Igor Silva <psilva@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> Bill Burke <bburke@redhat.com> <br><b><span style="font-weight: bold;">Cc:</span></b> keycloak-user@lists.jboss.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, September 9, 2015 10:44 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [keycloak-user] UMA Profile for OAuth 2<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_1_1441798886758_4609"><br></div><div class="y_msg_container" id="yui_3_16_0_1_1441798886758_4609"><br>Hey Raghu,<br clear="none"><br clear="none"> Fell free to share your requirements around authz and UMA. <br clear="none"><br clear="none"> We're considering two use cases and scenarios where the subject of a transaction can be an individual or a NPE (Non-person entity). <br clear="none"><br clear="none"> Right now, I'm focusing on NPE use cases, where an organization is both the resource owner and the authorizing party, acting on its own behalf, protecting its own resources. Which, IMO, helps to address most of the authz requirements for those applications that need to protect their own resources.<br clear="none"><br clear="none">Regards.<br clear="none">Pedro Igor<br clear="none"> <br clear="none"><br clear="none">----- Original Message -----<br clear="none">From: "Bill Burke" <<a shape="rect" ymailto="mailto:bburke@redhat.com" href="mailto:bburke@redhat.com">bburke@redhat.com</a>><br clear="none">To: <a shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none">Sent: Wednesday, September 9, 2015 9:14:12 AM<br clear="none">Subject: Re: [keycloak-user] UMA Profile for OAuth 2<br clear="none"><br clear="none">Pedro is working on a permission service on top of UMA, but it will be a <br clear="none">separate service and/or an optional addon to keycloak.<br clear="none"><br clear="none">On 9/9/2015 7:11 AM, Raghu Prabhala wrote:<br clear="none">> Bill/Stian,<br clear="none">><br clear="none">> Do you have any plans to support the UMA profile for OAuth 2 in the near<br clear="none">> future?<br clear="none">><br clear="none">> <a shape="rect" href="http://tools.ietf.org/html/draft-hardjono-oauth-umacore-13" target="_blank" id="yui_3_16_0_1_1441798886758_6396">http://tools.ietf.org/html/draft-hardjono-oauth-umacore-13</a><br clear="none">><br clear="none">> Thanks,<br clear="none">> Raghu<br clear="none">><br clear="none">><br clear="none">> _______________________________________________<br clear="none">> keycloak-user mailing list<br clear="none">> <a shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none">> <a shape="rect" href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank" id="yui_3_16_0_1_1441798886758_6578">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br clear="none">><br clear="none"><br clear="none">-- <br clear="none">Bill Burke<br clear="none">JBoss, a division of Red Hat<br clear="none"><a shape="rect" href="http://bill.burkecentral.com/" target="_blank">http://bill.burkecentral.com</a><div class="qtdSeparateBR"><br><br></div><div class="yqt3062527008" id="yqtfd17692"><br clear="none">_______________________________________________<br clear="none">keycloak-user mailing list<br clear="none"><a shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none"><a shape="rect" href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br clear="none">_______________________________________________<br clear="none">keycloak-user mailing list<br clear="none"><a shape="rect" ymailto="mailto:keycloak-user@lists.jboss.org" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br clear="none"><a shape="rect" href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br clear="none"></div><br><br></div> </div> </div> </div></body></html>