Network Working Group T. Hardjono, Ed.
Internet-Draft MIT
Intended status: Standards Track December 27, 2012
Expires: June 30, 2013
User-Managed Access (UMA) Profile of OAuth 2.0
draft-hardjono-oauth-umacore-06
Abstract
User-Managed Access (UMA) is a profile of OAuth 2.0. UMA defines how
resource owners can control access to their protected resources made
by clients operated by arbitrary rquesting parties, where the
resources reside on any number of resource servers, and where a
centralized authorization server governs access based on resource
owner policy.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on June 30, 2013.
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
Hardjono Expires June 30, 2013 [Page 1]
Internet-Draft UMA Core December 2012
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 7
1.2. Basic Terminology . . . . . . . . . . . . . . . . . . . . 7
1.3. Endpoints, Endpoint Protection, and Tokens . . . . . . . . 8
1.4. Scope Types, Resource Sets, Permissions, and
Authorization . . . . . . . . . . . . . . . . . . . . . . 10
1.5. Authorization Server Configuration Data . . . . . . . . . 12
2. Protecting a Resource . . . . . . . . . . . . . . . . . . . . 15
2.1. Resource Server Obtains PAT . . . . . . . . . . . . . . . 15
2.2. Resource Server Registers Sets of Resources to Be
Protected . . . . . . . . . . . . . . . . . . . . . . . . 16
3. Getting Authorization and Accessing a Resource . . . . . . . . 16
3.1. Client Attempts to Access Protected Resource . . . . . . . 18
3.1.1. Client Presents No RPT . . . . . . . . . . . . . . . . 19
3.1.2. Client Presents an RPT That Has Insufficient
Authorization Data . . . . . . . . . . . . . . . . . . 19
3.1.3. Client Presents a Valid RPT with Sufficient
Authorization Data . . . . . . . . . . . . . . . . . . 20
3.2. Resource Server Registers a Permission With
Authorization Server . . . . . . . . . . . . . . . . . . . 20
3.3. Resource Server Determines the RPT Status . . . . . . . . 22
3.3.1. UMA Bearer Token Profile . . . . . . . . . . . . . . . 22
3.4. Client Asks Authorization Server for RPT and
Authorization Data . . . . . . . . . . . . . . . . . . . . 24
3.4.1. Client Obtains AAT . . . . . . . . . . . . . . . . . . 25
3.4.2. Client Obtains RPT . . . . . . . . . . . . . . . . . . 26
3.4.3. Client Asks for Authorization Data . . . . . . . . . . 27
3.5. Claims-Gathering Flows . . . . . . . . . . . . . . . . . . 29
3.5.1. Claims-Gathering Flow for Clients Operated by
End-Users . . . . . . . . . . . . . . . . . . . . . . 30
3.5.1.1. OpenID Connect Claim Profile . . . . . . . . . . . 31
4. Error Messages . . . . . . . . . . . . . . . . . . . . . . . . 32
4.1. OAuth Error Responses . . . . . . . . . . . . . . . . . . 32
4.2. UMA Error Responses . . . . . . . . . . . . . . . . . . . 32
5. Specification of Additional Profiles . . . . . . . . . . . . . 33
5.1. Specifying Profiles of UMA . . . . . . . . . . . . . . . . 34
datatracker.ietf.org