I like how you make the distinction between business-level problem vs. technical problem. Like you said, relying parties (3rd party app vendors) would like as much access as possible. But I also think that the technological solutions (for e.g. OAuth) should default to user’s predefined settings regardless of how the service provider sets up the Authorization. Unless I am missing something, I am not seeing this being addressed anywhere.

Saqib

There is a business-level problem here (relying parties would prefer getting as much access as possible), and also a technical problem (defining “scope” of access in an interoperable way is hard, as evidenced by the OAuth group’s decision to punt on semantics for this field).

I think UMA should ideally be able to pick up whatever technical solution wins the day, but we did propose a solution to the wider community that relies on “extreme RESTfulness” of the API being accessed to achieve interop. If an API can be described meaningfully as a set of triples of resource URL/HTTP method/semantic, then the first two parts could be encoded (we proposed a JSON format) as a way to ask for and grant that kind of access in an OAuth or UMA ecosystem. It’s more wordy than 100% of the OAuth deployments on the planet, but it can at least be consistently applied.

So that’s the technical problem. My hope is that the business-level problem can be tackled piecemeal at the UMA level by giving users better tools to offer valuable data on their own terms. Changing them from passive to active participants (through the assistance of an AM) should change the incentives a bit.

Further thoughts welcome…

Recently I have been looking at how Google Apps Marketplace apps utilize OAuth to access user’s Google Apps data. It is all or nothing access. Once Google Apps domain administrator adds a Marketplace Apps to the domain, the app gets full access all the data in the entire domain. This kinda worries the Data Custodians, and rightfully so.

Here are somethings, if implemented, may calm the fears of the data custodians:

1) Controls to prevent mis-use of this over-reaching authorizations;
2) Granular policy controls, i.e. ability to give read-only access to pre-defined data for users who will be using the apps;
3) A view into detailed logs of access and audit logs;
4) Anomaly detection system.

I am not sure how UMA can help in this area, but would like to hear your thoughts.

Saqib