December 2018 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2018-12-20
by Eve Maler 20 Dec '18

20 Dec '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-20 (Many thanks to Domenico for his many years of awesome graphics!) MinutesRoll call Quorum was not reached. Meeting logistics - Doodle poll is now closed: winning meeting time is *Thursdays 6am PT/8am CT/9am ET/2pm UK/3pm CET* - We will start up again on *Thursday Jan 10 at the new time* If you subscribe to the Kantara calendar, updates there (which Eve will do shortly) should simply show up. If you are a non-voting participant and wish to receive an invitation (through your email address so that it goes on to your preferred calendar) in addition to your subscription to the Kantara calendar, let Eve know. Approve minutes - Approve minutes of UMA telecon 2018-12-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06>, UMA telecon 2018-12-13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-13> Deferred. Reminder: Identiverse call for presentations <https://www.cvent.com/c/abstracts/0e1feab0-e824-428e-abea-9f5d54e03059> is open till Jan 11 Your holiday break is the *perfect* time to write those proposals! Don't think in terms of "the single UMA talk" or whatever. Implementation details are awesome. "Forward-thinking" / "theoretical" can be considered as well. Particularly if you're new to all this, you can reach out to Andi (see the email address on the site). Treat January 11 as a hard deadline this time! High assurance of the RO to the RqP - CIBA Core <https://openid.net/specs/openid-client-initiated-backchannel-authentication…> spec is just out - Previous discussion: May 31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31> , Jun 7 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07> , Sep 13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> , Oct 18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-10-18> , Dec 6 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06> , Dec 13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-13>– Peter described a method of strong binding from Alice registration time to ensure "high RO IAL" Deferred until we can put Peter on the spot. [image: (smile)] UMA business model - Look at publishing new/revised draft reports Eve has been working to capture our "UMA Legal Role Definitions" work in a new document <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> (request access if you can't get in to the GDoc). Andi spoke in favor of publishing it as a draft report and is willing to help with developing a new deliverable that focuses on the "IRM" aspects (use cases at the transitions of the numbered cradle-to-grave scenarios in the slide deck). This is not fully "standards-based" yet but could go in that direction. Tim asks: Are the reports key to encouraging adoption of UMA at this point? Certain use cases, at least, seem common – particularly going from state 1, managing a minor's resources, to state 2, enabling the now-adult person to take over management of their own resources. This seems particularly frequent in healthcare. *AI:* Andi and Eve: Met early in the new year to work on that second deliverable on "UMA relationship use cases". *AI:* Tim and Domenico: Review the GDoc over the holidays. What are the sectors where UMA is being seen? Eve: financial and healthcare; for financial, the specific use cases differ (enterprise/employee delegation, API protection, pensions dashboard, etc.). Various IoT use cases as well across sectors. Alec: healthcare, giving access to someone in their circle of care. The biggest challenge is compliance of all the parties. The RO is not able to choose their own AS/ASO, and ensuring privacy is important. Government-to-citizen as well, where SSI tends to come in, and also giving businesses access from an authoritative source. Colin: IDoT discussion in Kantara was ahead of its time. UMA and VCs discussion This thread <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/MVh9KUJuD…> in October sort of petered out because it was on two lists, but it's an interesting one. Let's think about it in the new year. IETF 104 Let's also think about plans for this in the new year. Schemas and overlays Colin: The core of this work is starting up, so please be aware of it. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Andi 3. Eve Non-voting participants: - Alec - Scott - Tim - Colin Regrets: - Nancy - Sal *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-12-20
by Eve Maler 19 Dec '18

19 Dec '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-20 Date and Time - *Thursdays 9am PT (to be changed at our next meeting on Jan 7!)* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Meeting logistics - Doodle poll is now closed: winning meeting time is *Thursdays 6am PT/8am CT/9am ET/2pm UK/3pm CET* - We will start up again on *Thursday Jan 7 at the new time* - Approve minutes of UMA telecon 2018-12-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06>, UMA telecon 2018-12-13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-13> - Reminder: Identiverse call for presentations <https://www.cvent.com/c/abstracts/0e1feab0-e824-428e-abea-9f5d54e03059> is open till Jan 11 - High assurance of the RO to the RqP - CIBA Core <https://openid.net/specs/openid-client-initiated-backchannel-authentication…> spec is just out - Previous discussion: May 31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31> , Jun 7 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07> , Sep 13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> , Oct 18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-10-18> , Dec 6 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06> , Dec 13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-13>– Peter described a method of strong binding from Alice registration time to ensure "high RO IAL" - UMA business model - Look at publishing new/revised draft reports - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Draft minutes of UMA telecom 2018-12-13
by Eve Maler 13 Dec '18

13 Dec '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-13 MinutesRoll call Quorum was not reached. Meeting logistics - Reminder: Doodle poll is still open <https://doodle.com/poll/78ymsmn38hss72qs> for new meeting time in the new year; respond by Tuesday of next week - Meeting at the *usual time* (Thursday 9am Pacific) on Dec 20; *not meeting* on Dec 27 Approve minutes - Approve minutes of UMA telecon 2018-12-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06> Deferred. Reminder: Identiverse call for presentations <https://www.cvent.com/c/abstracts/0e1feab0-e824-428e-abea-9f5d54e03059> is open Deadline is 11 Jan 2019. 180 degrees / decoupled / CIBA use cases - Use case doc <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/Vk3YpypIL…> from Nancy - Latest CIBA specs: MODRNA status page <https://openid.net/wg/mobile/status/>, FAPI profile <https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_CIBA.md?filev…> - What are *practical* methods, leveraging the existing UMA flows, for a requesting party to know the RO is the RO? - How does the RS know the RO is the RO? - Previous discussion: May 31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31> , Jun 7 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07> , Sep 13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> , Oct 18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-10-18> , Dec 6 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06> – please refresh your memory The MODRNA status page is here <https://openid.net/wg/mobile/status/>. The last issues have just been closed. The plan is to have a CIBA Core spec (current draft here <https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=asc…> – thanks, Bjorn!), which will move to the Connect working group after IPR issues are resolved, and a MODRNA profile, which will stay in the MODRNA group, along with the FAPI profile. The specs were split just yesterday, and tomorrow the specs will be sent out for public review before the Implementer's Draft vote. Beyond the notification modes we discussed, the substantive changes are around greater implementability and focusing strongly on the mobile use case, and how to treat the return values, and adding security and privacy considerations. Brian C and Dave T did a lot of work on it. We discussed Mike's analysis from Jun 7 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07>. Bjorn wonders if his concerns from that time aren't as applicable to the Core spec as to the MODRNA profile. It would be a good idea for us to review the Core spec at this juncture. We can analyze if, in fact, the "UMA business model" approach is accounted for, with multiple parties and delegation between them. The Oct 18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-10-18> notes go into detail on why this is important. The PAT is the only in-band UMA artifact that suggests a communications channel we could use to prove how Alice could prove who she is to the RqP's satisfaction. Peter suggests that they are doing something like this: They are leveraging a "modified use of scopes" to determine access to things. Alice's IdP has a tightly coupled relationship with the AS (effectively colocated) but they have a protocol-level separation. The scope is placed into the access token that is presented to the RS, but the scope is signed by the AS, which proves that it was Alice that authorized the access to the resource. This sounds like the ecosystem circumstance described in the last paragraph of UMA Grant Sec 5.7 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html#trus…>. Adrian notes that a Verifiable Credentials approach would give a level of flexibility of how you would achieve that trust. (They're actually using a very long list of resource-type-bound scopes to achieve this now.) Family members and non-family members need to be treated differently. In Peter's case, they have done in-person proofing. How can we prove that the "Alice" of the managing-resources (at the RS) and the "Alice" of the controlling-access (at the AS) is the same at all times? Is there a good IAL (identity assurance level) across all interactions? In Peter's implementation of sharing, they have keys that are under management and there is a strong binding when Alice first starts registering proofing documents (passports, etc.) and strong lifecycle management throughout, along with consent receipts as part of the RPT(-equivalent). Very interesting. It seems that we are on the right track for potential profiling (or something), by asking the right questions in specific enough form. More next week. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Sal 4. Eve Non-voting participants: - Scott - Thomas - Nancy - Adrian - Bjorn - Colin Regrets: - Andi - Cigdem *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-12-13
by Eve Maler 12 Dec '18

12 Dec '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-13 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Meeting logistics - Reminder: Doodle poll is still open <https://doodle.com/poll/78ymsmn38hss72qs> for new meeting time in the new year; respond by Tuesday of next week - Meeting at the *usual time* (Thursday 9am Pacific) on Dec 20; *not meeting* on Dec 27 - Approve minutes of UMA telecon 2018-12-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06> - Reminder: Identiverse call for presentations <https://www.cvent.com/c/abstracts/0e1feab0-e824-428e-abea-9f5d54e03059> is open - FYI, the Implementations page <https://kantarainitiative.org/confluence/display/uma/UMA+Implementations> has been updated - 180 degrees / decoupled / CIBA use cases - Use case doc <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/Vk3YpypIL…> from Nancy - Latest CIBA specs: MODRNA status page <https://openid.net/wg/mobile/status/>, FAPI profile <https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_CIBA.md?filev…> - What are *practical* methods, leveraging the existing UMA flows, for a requesting party to know the RO is the RO? - How does the RS know the RO is the RO? - Previous discussion: May 31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31> , Jun 7 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07> , Sep 13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-09-13> , Oct 18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-10-18> , Dec 6 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06> – please refresh your memory - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: Re: Swagger JSON for UMA API's?
by Mike Schwartz 08 Dec '18

08 Dec '18

UMA-tarians, I was wrong on the last call... we only have swaggerized the oxd API's: Swagger UI for oxd is here (including UMA RS endpoints): https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/GluuFede… We generate Markdown from annatations in the code, which get published in our mkdocs pages. But we might do swaggerize the UMA API's in the future--it's not that much harder to generate the swagger yaml file then the markdown. - Mike On 2018-12-07 20:35, Mike Schwartz wrote: > Yuriy, > > On the last UMA call, I volunteered to send a copy of our UMA Swagger > doc to the list. How can I get it/them? > > - Mike > > ----------- > Michael Schwartz > Gluu > Founder / CEO > mike(a)gluu.org > https://www.linkedin.com/in/nynymike/

1 0

Draft minutes of UMA telecon 2018-12-06
by Eve Maler 06 Dec '18

06 Dec '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06 MinutesRoll call Quorum was reached. FYI, the Implementations page <https://kantarainitiative.org/confluence/display/uma/UMA+Implementations> has been updated In about two months (that's the HIMSS timeframe -- Feb 11-15 in Orlando), there may be an update to the HIE of One listing reflecting the product side (Trustee). Adrian could be interested to attend HIMSS if there is someone willing to pay his way. And perhaps we should look at interop testing at HIMSS. Mike will update the Gluu listing to reflect the upcoming December ship date of the Gluu Gateway and the "Swaggerization" of the RS and (updated) client code. Swagger (technically OpenAPI <https://www.openapis.org/> is what they're using) is a kind of machine-readable API documentation that allows automated stubbing-out of applications. It's not the only API description language but it's pretty much the most popular. Since oxd is basically middleware (using Lua <https://www.lua.org/>), its Swagger isn't that interesting for a larger Swaggerization project. They changed it a lot, taking out "mix mode". What would it take to add an UMA module into Swagger? Then infrastructure would already be available to the online testing tools. If you could document which UMA scopes are required, security provisioning could be automated. Mike will share what they've already done. It may or may not be that helpful given the need to customize. Meeting logistics - Doodle poll is open <https://doodle.com/poll/78ymsmn38hss72qs> for new meeting time in the new year – this is a *sample week*, and likely the first week we would start the new time if we pick one - Meeting at the *usual time* (Thursdays 9am Pacific) on Dec 13 and 20; *not meeting* on Dec 27 Approve minutes - Approve minutes of UMA telecon 2018-11-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-11-15> APPROVED. Identiverse call for presentations is open Here <https://www.cvent.com/c/abstracts/0e1feab0-e824-428e-abea-9f5d54e03059>. Deadline is 11 Jan 2019. 180 degrees / decoupled / CIBA use cases - Secure, trusted sharing in both directions - Use case doc <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/Vk3YpypIL…> from Nancy - Latest CIBA specs: MODRNA status page <https://openid.net/wg/mobile/status/>, FAPI profile <https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_CIBA.md?filev…> We analyzed the use case doc. The "group X" parties seem to be a species of requesting part that have a motivation to share an UMA resource owner's data that they are a custodian of (they are in an UMA resource server role, we think), but they carry some liability for inappropriate sharing so they are going to want to be extra-careful about "group Y" (Alice) being who they say they are (the UMA resource owner) and also about others (Joe and Erica, the UMA requesting parties) being who they say they are – meeting Alice's policy. In previous discussions, we noted that the requesting party wants to ensure that it's truly Alice who is the resource owner. Is there also a need for the resource owner to know that Alice is the RO? Is authentication (of Alice/the RO particularly) something that we can connect to auditability, as it relates to our UMA business model work? Right now the PAT is the main thing that is "in band". Sal notes that this could connect to consent receipts as well. Eve has a plan to draft UMA business use cases and business/technical mappings (technical artifacts and legal devices) for people's perusal over the next couple of weeks. Andi says he'd also like to see us put some more thought into how we could handle cases where multiple resource owners exist for the same resource. Eve adds: These might include joint checking accounts, or two parents controlling a child's health record, etc. UN Commission on Refugees Tim asks if anyone has looked at their call for a proposal <https://www.ungm.org/Public/Notice/80196> for blockchain-related identities being issued; he's been talking to Colin about it and wonders about UMA's relevance. Cigdem just started looking at it. Adrian notes that HIE of One combines UMA and self-sovereign technologies and has been working on similar use cases. Alec notes that Identos's solution similarly has UMA on one side and a self-sovereign type of technology on the other side. Nancy mentions some interest as well. Colin remarks that responding to such calls tend to require a fair amount of resources and a big team. Kantara could potentially put a proposal together but a fairly large organization may need to prime the effort. Adrian mentions ID4D <http://id4d.worldbank.org/>. Attendees As of 18 Oct 2018, quorum is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Peter 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike 7. Cigdem Non-voting participants: - Alec - Adrian - Bjorn - George - Nancy - Colin - Tim Regrets: - Domenico *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Doodle poll: considering a new weekly time for the UMA WG telecon
by Eve Maler 05 Dec '18

05 Dec '18

We noticed we don't have any US west coast participants these days, strangely enough, and so decided it would be okay to seek out a meeting time that skews on the earlier side (any day of the week) to help out those in other time zones. I have created this Doodle poll <https://doodle.com/poll/78ymsmn38hss72qs> (times all good for me) with the *sample/potential starting week of 7 January 2019*. Please fill out at your earliest convenience, and we'll figure out what to do by the time of our call on *Thursday, December 20* (usual time). This is a good time to remind people in the APJ region -- for whom our regular meetings are typically not at friendly times -- that I'm happy to schedule ad hoc sync meetings whenever you request them. We often get others joining these calls as well. Thanks, all. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-12-06
by Eve Maler 05 Dec '18

05 Dec '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-12-06 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2018-11-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-11-15> - Identiverse call for presentations is open - FYI, the Implementations page <https://kantarainitiative.org/confluence/display/uma/UMA+Implementations> has been updated - Meeting logistics - Doodle poll is open <https://doodle.com/poll/78ymsmn38hss72qs> for new meeting time in the new year - Meeting at the *usual time* (Thursdays 9am Pacific) on Dec 13 and 20; *not meeting* on Dec 27 - 180 degrees / decoupled / CIBA use cases - Secure, trusted sharing in both directions - Use case doc <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/Vk3YpypIL…> from Nancy - Latest CIBA specs: MODRNA status page <https://openid.net/wg/mobile/status/>, FAPI profile <https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_CIBA.md?filev…> - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0