Sydney Identity Summit presentation by Eve Maler, VP of Innovation & Emerging Technology, ForgeRock

1. © 2016 ForgeRock. All rights reserved.
Doing Authorisation,
Consent, and Delegation
Right With UMA
Eve Maler
VP Innovation & Emerging Technology
@xmlgrrl
Sydney Identity Summit

2. © 2016 ForgeRock. All rights reserved. 2
flickr.com/photos/vincrosbie/16301598031/ CC BY-ND 2.0

3. © 2016 ForgeRock. All rights reserved.
flickr.com/photos/vincrosbie/16301598031/ CC BY-ND 2.0

4. flickr.com/photos/delmo-baggins/3143080675 CC BY-ND 2.0

5. Attribute sharing scenarios!
In the next stage of the project … [t]he team
will be investigating and testing this to further
address the thorny issues of trust and
transparency when gaining citizens’
permission. … “[E]ligibility for some services
can be quite dynamic, for example, as the
level of an individual’s in-work benefits varies,
and it may be necessary to carry out on-going
eligibility checks from time to time. UMA gives
the individual a place to go online where they
can see and manage all the consents they
have given to different organisations. Until
now, managing ongoing consent was
tricky,” [Ian Litton] added. “Typically, you
asked individuals to consent at a point in
time. They tick the T&Cs, which they never
see again. UMA should fix that problem.”
-- UKA Local Digital, 3 March 2016

6. Consumer/clinical health IoT scenarios!

7. resource
owner
requesHng
party
authorizaHon
server
resource
server
manage
delegate
control
negoHate protect
authorize
access manage
client
CloudyHealth
domain CloudyHealth
(IdP)
HospPortal
Dr. McCoy
DeviceConnect
app
Smartee
health watch
web apps,
mobile apps
Bruce
consent
revoke
deny
Bruce Wayne
shares device data
with Dr. McCoy

19. © 2016 ForgeRock. All rights reserved.
Why enable personal data sharing?
clinical research
better caredata accuracy

20. © 2016 ForgeRock. All rights reserved.
Why ensure personal control of sharing?
new IoT needs new regulatory pressures

21. © 2016 ForgeRock. All rights reserved.
The same architecture applies to
Google Apps-style delegation
“The enterprise
interprets
access control
as damage and
routes around it.”

22. © 2016 ForgeRock. All rights reserved.
Why enable constrained delegation?
security/authn governance APIs/IoT

23. © 2016 ForgeRock. All rights reserved.
Why formalise federated authorisation?
business ownership standard access model

24. © 2016 ForgeRock. All rights reserved.
The CMO and the CPO can and must meet
in the middle
“Consent should not be regarded as
freely given if the data subject has no
genuine or free choice or is unable to
refuse or withdraw consent without
detriment. …
In order to ensure that consent is freely
given, consent should not provide a valid
legal ground for the processing of
personal data in a specific case where
there is a clear imbalance between the
data subject and the controller…”
We value personal data as an
asset
Our customers’ wishes have
value
Our customers have their own
reasons to share, not share,
and mash up data, which we
can address as value-add
Risk management perspective Business perspective

25. © 2016 ForgeRock. All rights reserved.
The ForgeRock
Identity Platform
includes two UMA
components
authorization
server
resource server
client
(sample code provided)
UMA Provider
(access management)
UMA Protector
(gateway)

26. © 2016 ForgeRock. All rights reserved.
ForgeRock
ForgeRock
ForgeRockIdentity
ForgeRock
Forgerock.com
Forgerock.com/blog
Thank you!