October 2019 - WG-UMA - mailman.kantarainitiative.org

Nov 12 biz-legal meeting and call for Thursday agenda items: please respond
by Eve Maler 29 Oct '19

29 Oct '19

If I don't hear about technical agenda items *by tomorrow morning*, I will cancel our Oct 31 call. We do have a biz-legal call on Nov 5, but *unless you let me know by tomorrow morning* that you'd like me to ask Colin or Ruth to open the bridge, I will cancel the Nov 12 call because I'll be attending the TechVision Chrysalis conference. Thank you! *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from 2019-10-29 UMA business-legal framework telecon
by Eve Maler 29 Oct '19

29 Oct '19

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-10-29 Attending: Eve, Cigdem, Nancy, Andi, Adrian, Tim (regrets: Domenico) We worked through the section after the Introduction. We want to get to the RRA-centered states and state changes content next time. Nancy has provided some rough content/use cases that are healthcare-focused that we can use as a base. Let's also add (say) FSI-focused use cases. There is also the co-equal rights challenge (multiple co-equal resource owners/RRAs? and also DS's?). *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Summertime Skew this week
by Eve Maler 28 Oct '19

28 Oct '19

Just a reminder that while the UK (and elsewhere) have “fallen back” in terms of the clock already, the US (and elsewhere) will not for another week. Per tradition we use US time as our anchor. So our UMA calls will appear to shift if you’re in the UK. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

The ACCESS Act could be called the UMA Act
by Adrian Gropper 24 Oct '19

24 Oct '19

Check out https://www.warner.senate.gov/public/index.cfm/2019/10/senators-introduce-b… Especially Section 5: Delegation. (There's a link <https://www.scribd.com/document/431507476/ACCESS-Act-Section-by-Section-FIN…> to a nice summary at the very end of the page.) It calls for a right to specify a fiduciary agent, hopefully one that I can compile and own myself. I can imagine a law like this applying to all of our service providers above a certain size, like say 50 employees. -- Adrian

3 6

Call for agenda items for Thursday Oct 24
by Eve Maler 23 Oct '19

23 Oct '19

This is our "technical" meeting series. Please respond here ASAP if you have completed an action item or would like to bring up a topic or extension draft for discussion. I may cancel if we're not seeing agenda item proposals. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Notes from 2019-10-22 UMA business-legal framework telecon
by Eve Maler 22 Oct '19

22 Oct '19

Current documents being worked on (WG participants will receive edit access for the asking; others may receive view access): - Business-Legal Framework and Use Cases <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> (GDoc) - Mapping Graphics <https://docs.google.com/presentation/d/1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BB…> (GSlides) - Legal Role Definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…> (GSlides) - Definitions and Use Cases Spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> (GSheet) https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-10-22 Attending: Eve, Colin, Nancy, Andi, Domenico We worked directly in the document, accepting suggestions and editing the results. We discussed whether we should keep "Alice" for consistency as the resource owner name, vs. use variety (e.g. the "Jane" example as in Andi's new "simple example up top). *AI:* Domenico: In the Mapping Graphics <https://docs.google.com/presentation/d/1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BB…> slide 19 graphic, can he please ensure that the "technical terms" (currently with no-color background outside the legal terms) be distinguished somehow (maybe with italic or with a color background) and be all lowercase? In the Typical Use Case section, let's try telling a brief narrative story about the life insurance use case, either before or after the technical definitions, so as to make it easy for nontechnical readers to understand those definitions. We do need the technical definitions – otherwise we can't delve into the permission token/license work that the paper needs to do. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business-legal framework telecon tomorrow
by Eve Maler 21 Oct '19

21 Oct '19

We’re meeting tomorrow, Tuesday, at 8am PT. Many thanks to those who contributed to document edits last week! Please see previous weekly reminders for relevant links. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Reminder: UMA business-legal framework telecon 2019-10-15
by Eve Maler 15 Oct '19

15 Oct '19

I can't attend myself tomorrow, but Ruth Puente has kindly agreed to open the bridge for this call. Previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…>. Our spreadsheet is here <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…>, our "business model: mapping graphics" deck is here <https://drive.google.com/open?id=1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BBjBB7xG…>, our full/older Legal Role Definitions deck is here <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>, and our draft doc is here <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…>. Trying to access these links will send me a notification to share the docs with you with your preferred ID, if I haven't already given you access. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

4 3

Call for feedback: meeting schedules and Thursday agenda items
by Eve Maler 10 Oct '19

10 Oct '19

Apologies for the disruptions to my availability of late. I've had some extra travel demands, and Q4 continues in the same vein. Currently, the Tuesday 8am PT meeting series (business-legal framework, goal: draft second report) looks like this: - Oct 15: *meeting sans me, Ruth will open the bridge* - Oct 22: *meeting* - Oct 29: *meeting* - Nov 5: *meeting sans me, or I can cancel -- let me know* - Nov 12: *meeting sans me, or I can cancel -- let me know* - Nov 19: *meeting* - Nov 26: *will cancel due to US holiday* The Thursday 6am PT meeting series (technical, main goals: extension/XYZ use case collection, charter refresh) looks like this: - Oct 17:* need to cancel* - Oct 24: *meeting* - Oct 31: *meeting* - Nov 7: *need to cancel* - Nov 14: *need to cancel* - Nov 21: *meeting* - Nov 28: *will cancel due to US holiday* Note that it's past time for our charter refresh. If people have other thoughts on work items we should attend to in the "Thursday stream", or on meeting schedules generally, then let's please discuss here. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-10-03
by Eve Maler 03 Oct '19

03 Oct '19

(Apologies for having gotten the date wrong in the link before.) https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-10-03 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-09-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19> MOTION: - Minutes of UMA telecon 2019-09-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-09-19> APPROVED. XYZ use cases Eve suggests that, for at least the use cases that UMA doesn't cover today, we should be putting them in our GitHub issues. We can tag them with "extension" and "XYZ", and this allows lookup for anyone who might be interested to create an UMA extension, as well as for anyone interested to see UMA-related use cases that have arisen in the XYZ context and applicable to the universe. As well, if someone is solving such a use case in some other manner, through (say) profiling existing technologies (Sal mentioned signed claims with an expiration date and AS signatures for the *offline RS* use case, along with a smarter client), those could be explored too. So GitHub recording gives us an "all of the above" strategy for solving use cases. Discussing that use case: Cigdem discovered that the ace-actors draft had gotten archived. The "client AS" (CAS) concept was only in that draft. We had thought that this document was key in the thinking of the ACE group (e.g. to recognize "requesting parties"), but they've now backed off of all of that. Sal will help with more offline/IoT use cases. In UMA2 we achieved more IoT friendliness, mainly through explicitly allowing local RS validation of a self-contained RPT (access token) vs. strongly requiring token introspection as in UMA1. Discussing the *Alice-to-Alice* use case: Eve and Justin have had further discussion about whether UMA's method of using the UMA claims collection methods (whether pushing or interaction) for both Alice-to-Alice sharing and Alice-to-Bob sharing is appropriate. Her thinking is that using UMA's method in all cases is appropriate because the RqP's identity isn't known until you collect the claims, and in fact, it's not really an identity at all, it's "some claims" that satisfy policy (or don't). In the Pensions Dashboard use case, it's "little Alice" (lower assurance) using a special account aggregation client vs. the "big Alice" that is highly assured on the resource owner side. And in the case of HEART-style use cases like "btg" (break the glass), it's a lot more like role-based access based on claims sought in policy/supplied. Finally, we found usage of the OAuth authorization endpoint troublesome when used on the requesting side for the AAT because it required early and strong identity-based binding of Bob to the AS, and we could see this getting in our way when use on the owner side if we were to do more work around the Alice-to-AS relationship in future for getting visibility into Alice's assurance level (currently the "AS app" is outside UMA's scope). All this is to say that UMA had its reasons for aligning on its own mechanism for treating all requesting parties alike, and we expect that surely XYZ will too. Peter will attend to his use case on his return. Nominations for chair and vice-chair MOTION: Sal moves and Thomas seconds: Nominate Eve for UMA WG chair and Maciej for WG vice-chair for a new annual term. Motion PASSES by ACCLAMATION. MOTION: Andi moves and Sal seconds: To formally thank our chairs for their service and exemplary leadership on an ongoing basis. [image: (smile)] Motion PASSES by ACCLAMATION. (Eve says thanks!) Attendees As of 16 Jul 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Thomas 4. Andi 5. Eve 6. Cigdem Non-voting participants: - Nancy Regrets: - Maciej - Peter *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0