August 2015 - WG-UMA - mailman.kantarainitiative.org

UMA Specifications @ GitHub
by Maciej Machulak 14 Aug '15

14 Aug '15

Hi, The specs now have a new home - please updated your bookmarks :-) https://github.com/KantaraInitiative/wg-uma Cheers, Maciej -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

2 1

OASIS Trust-El TC UMA description
by Mike Schwartz 13 Aug '15

13 Aug '15

Andrew, Per the WG minutes, I'd be happy to write up a description of the trust elevation features of UMA. - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Draft minutes of UMA telecon 2015-08-13
by Eve Maler 13 Aug '15

13 Aug '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-13 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-13> Minutes Roll call Quorum was reached. Minutes approval MOTION: Approve the minutes of UMA telecon 2015-08-06 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-06>. APPROVED. Trust Elevation TC request Mike will follow up on Andrew H's request to write something up on UMA for the TC document. He's already on that TC. GitHub repo status Eve's xmlgrrl repo for UMA-Specifications is now moved over to the KI side <https://github.com/KantaraInitiative>. Issue resolution work We agree that a patch release is still the right thing to do. We assigned milestones afresh to all of the current issues. Eve will duplicate issues where they ultimately apply to subsequent releases. Issue 161/162 discussion: The constraint is that the RS must be able, based on the C's access attempt with no token and no other context, to distinguish the AS and RO that match the protected resource set. In practice, this likely means that the URI needs to be unique per resource set. Let's mention this constraint in a few places. E.g., in Core Sec 1.3.1 and Core Sec 2. And we also have to put it into RSR Sec 2 and Sec 2.2. Issue 163 discussion: 200 with a special header has been discussed. Let's align the header with the future! What do we think the V1.1/V2.0 header would be for the ticket, the RO-specific information the client would need, etc.? WWW-Authenticate: UMA parameters. So the name of this parameter would be what? We want to convey that we're not giving an error code, but we're starting a process that requires some additional action if they want to get the protected representation (ish) of the resource. We already have as_uri=as_uri and Justin would suggest that we have ticket=ticket in future. The sheer presence of the UMA header is all that is required – nothing else. Issue 172 discussion: The feedback from the implementation process is that what's in the spec is not enough. The OAuth spec has more guidance on this type of thing. Can we be more specific without saying exactly what the lifecycle is? Can it be forever or not, e.g.? The spreadsheet <https://docs.google.com/spreadsheets/d/1s27E3JsHdvl_UzhGkQ8ZWP2dnyAXQAj5sxE…> has a few more notes and champion assignments. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 30 Jul 2015 (pre-meeting), quorum is 7 of 12. (François, Domenico, Sal, Thomas, Andi, Phani, Robert, Maciej, Eve, Arlene, Irwin, Mike) Eve Irwin (regrets for next three telecons) Arlene Thomas Mike Maciej Domenico Sal Non-voting participants: Adrian Justin Sarah Nat Mark Jin Scott Regrets: Andi Robert François Ishan James Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

New swimlane for the issue 153/154 flow, with questions
by Eve Maler 13 Aug '15

13 Aug '15

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UMA wikipedia page has gotten some updates
by Eve Maler 13 Aug '15

13 Aug '15

https://en.wikipedia.org/wiki/User-Managed_Access I’ve asked if Victor Ake (my colleague and one of the UMAnitarian lurkers here) can work on an update to the Spanish version. Mark D, are you able to update the Dutch version now? And Domenico (who I think is on vacation at the moment), can you update the Italian version when you’re back? Anyone want to take a stab at other translated versions? Thanks! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Trust Elevation (OASIS) and UMA question
by Andrew Hughes 13 Aug '15

13 Aug '15

Hi UMAnitarians! I'm working on the OASIS Trust Elevation TC document, and would like to include a section that describes the UMA concept / mechanism of trust elevation (the "Needs Claims" flow, I think). In particular, we have a pattern that describes Trust Elevation and are soliciting contributions from WGs/TCs that do authorization protocols/profiles show how that pattern would look in their terms. Is anyone interested in working on this? I'm looking for 1/2 page-ish... Please contact me if you have questions thanks! andrew. -- *Andrew Hughes *CISM CISSP Independent Consultant *In Turn Information Management Consulting* o +1 650.209.7542 m +1 250.888.9474 1249 Palmer Road, Victoria, BC V8P 2H8 AndrewHughes3000(a)gmail.com ca.linkedin.com/pub/andrew-hughes/a/58/682/ *Identity Management | IT Governance | Information Security *

1 0

Fwd: Four UMA Use-Cases in Healthcare
by Eve Maler 13 Aug '15

13 Aug '15

From Adrian for consideration in our legal subgroup meeting coming up shortly. Thanks, Adrian! > Begin forwarded message: > > From: Adrian Gropper <agropper(a)healthurl.com> > Subject: Four UMA Use-Cases in Healthcare > Date: 7 August 2015 at 6:33:18 AM PDT > To: Eve Maler <eve(a)xmlgrrl.com> > Cc: "Bucci, Debbie (HHS/ONCIT)" <debbie.bucci(a)hhs.gov>, Josh Mandel <jmandel(a)gmail.com>, Justin Richer <jricher(a)mit.edu> > > Eve, > > There may be only 4 distinct use-cases for UMA in healthcare. I wrote this in order to prepare for the legal subgroup this morning. Feel free to share if it's useful. > > > Alice-to-Alice N - The multiple portals problem - Alice wants to direct sharing herself > Alice wants to manage her EHR-1 and EHR-2 authorizations in one place. We call that place the AS. > Alice registers her AS with her practice’s EHR-1. > Alice registers her AS with another practice EHR-2. > From then on, Alice can sign-in to her EHR, view accounting for disclosures, and manage authorizations. > > Alice-to-Custodian - Delegation to a custodian > Custodian creates an AS for Alice. Custodian has a sign-in to Alice’s AS. > Alice registers her AS with her PCP’s EHR-1. > Alice registers her AS with another practice’s EHR-2. > From then on, Custodian can sign-in to Alice’s EHR, view accounting for disclosures, and manage authorizations. > > Alice-to-Bob Directed - Alice wants to authorize her PCP for directed sharing > Alice registers her AS with her PCP’s EHR-1. > The PCP shares an Alice-specific context with Bob. > Bob’s client EHR-2 presents claims to Alice’s AS, gets authorization. > EHR-2 accesses resource from EHR-1. > > Alice-to-Bob HIE - Alice wants to be discoverable > Alice registers her AS with her practice’s EHR-1. > Alice picks up a flier for the state HIE with a Q/R code, reads their Privacy Policy > Alice signs-in into her AS and scans the Q/R code. > The HIE allows Alice to pick her discovery attributes, registers Alice’s AS. > Bob’s client signs into the HIE, discovers Alice, gets authorization to EHR-1. > > > > -- > > Adrian Gropper MD > > RESTORE Health Privacy! > HELP us fight for the right to control personal health data. > DONATE: http://patientprivacyrights.org/donate-2/ <http://patientprivacyrights.org/donate-2/> Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

4 5

Reminder: UMA legal subgroup telecon 2015-08-14
by Eve Maler 12 Aug '15

12 Aug '15

Fri Aug 14 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Work through Adrian email thread to discuss UMA flow and use cases Walk through an UMA demonstration? (Eve) Discuss consent receipts and logging — how do they map to use cases? See consent receipt generator demo? (Mark) How many more use cases do we really need? a lot? a few? none? Discuss licensure vs. contract (if time?) Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Post 1.0 issue prioritization
by Mike Schwartz 12 Aug '15

12 Aug '15

>> In short: we don't have to wait, so let's not. Justin, I think Eve is doing a good job prioritizing the issues, and also getting feedback from the group on which issues to address. We've extended the calls to 90 minutes per week to specifically accommodate recent feedback we've gotten from implementers like you and others who are also now more actively engaged right now in development now that 1.0 came out. I don't think the group can afford to have more than one call per week, as we did last year to get the initial 1.0 spec to the finish line. I guess I'm wondering what else you think we can do to enable us to move in parallel like you suggest. - Mike

3 2

The idea of deferring big issues and focusing on actual bugs in the patch release
by Eve Maler 12 Aug '15

12 Aug '15

This topic is on the agenda for discussion tomorrow. In the case of issue 153/154, at least, there seems to be a definite leaning in the direction of deferral. If we lean that way for similar fundamental breaking issues, I added a column to the issue spreadsheet <https://docs.google.com/spreadsheets/d/1s27E3JsHdvl_UzhGkQ8ZWP2dnyAXQAj5sxE…> to imagine what the patch release workload might look like. The cells in bright yellow are my new proposals/questions for us to consider. You’ll also notice that I have proposed discussing and closing several issues tomorrow, in the pinkish color (mauve?). Judging by our past work cadence, we can likely meet our agreed timeline if we go in the deferral direction. If we don’t, we probably need to seriously rethink the timeline and release strategy. If you’ve got thoughts on the yellow cells ahead of the call (particularly if you can’t make the call), feel free to weigh in on this thread. Thanks, Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 3