November 2019 - WG-UMA - mailman.kantarainitiative.org

Just posted a new implementation on our Implementations page!
by Eve Maler 23 Nov '19

23 Nov '19

Nancy sent me news of an UMA implementation her company has done -- you can read about it here: https://kantarainitiative.org/confluence/display/uma/UMA+Implementations#UM… @UMAWG is spreading the news and it's also on our wiki home page. Will you help out? Thanks in advance! https://twitter.com/UMAWG/status/1198015446475296768 (BTW, happy Thanksgiving to everyone who is celebrating it next week.) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Draft minutes of UMA telecon 2019-11-21
by Eve Maler 21 Nov '19

21 Nov '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-11-21 MinutesRoll call Quorum was not reached. Approve minutes - - Approve minutes of UMA telecon 2019-10-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-10-03> Deferred. Decentralized news Adrian has news to share; see his document <http://bit.ly/MVProtocol>. Eve has been working on an article with Lisa L on consent, and they have struggled with the lack of concrete flows in decentralized identity for consent. George concurs with the lack of concreteness out there; it's a problem for interoperability with DID methods to date. Adrian notes that there is an open meeting planned for tomorrow <https://lists.w3.org/Archives/Public/public-credentials/2019Nov/0037.html> to discuss (meta-discuss?) how to get started in bringing all the various streams of work to standards bodies. Resolving DIDs and telling wallets what VCs you want and other use cases will rely on commonality communications. It's possible to build POCs to illustrate concepts, but it doesn't build ecosystems. We walked through Adrian's document. It focuses on the Alice-to-Bob use case to keep things simple (UMAnitarians are very familiar with that). Alice-to-Alice is just a subset. MVP (minimum viable protocol) is represented by the "narrow waist" of the hourglass. Slide 5 introduces an UMA mapping to the entities. Slide 7 makes the resource owner their own issuer, interestingly. The hot conversation in the decentralized community is the two data storage options on slide 8; the bold elements are the complementary strengths on either side, the goal being to not be stuck with just Apple or Google as the wallet choice. Some discussion ensued about the larger ecosystem/adoption questions surrounding how to privacy-engineer personal data choice and control. Eve shared Bob Blakley's remarks from TechVision Chrysalis on decentralized identity about wallet binding/"evil Alice" concerns (which Eve supported contemporaneously). XYZ / RAR / PAR news Eve described the OAuth 2.1 proposal from the IETF 106 OAuth 1 session and its enthusiasm for code+PKCE (and a further set of protections). George is concerned about this being insufficient for mobile wallet-binding protection. Adrian echoes this concern. How to ensure trust when talking to the correct client (instance, not just class)? Currently, RAR (along with PAR) is designed to be a relatively lightweight extension on top of today's OAuth. In OAuth, Alice is sent to her bank/ASPSP (AS) to authorize or deny the transaction. In UMA, how would the AS know how to let Alice set her policy, which would be the equivalent operation? That's why we had a resource (and scope) registration step ahead of time. The fact that pre-registration was in the RO context was beneficial (essential) for the various parts of the flow/token ecosystem of UMA. But maybe we can use the RAR JSON data structure to inform our registration step. George says he's "stealing" that structure for what he calls transaction tokens, for internal microservices management. Attendees As of 16 Jul 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Maciej 3. Eve 4. Cigdem Non-voting participants: - Adrian - George - Scott - Thomas - Nancy Regrets: - Peter *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Planning for Thursday's UMA WG call
by Eve Maler 20 Nov '19

20 Nov '19

As my recent note mentioned, the plan is to have an UMA WG "technical" call this Thursday. I'd like to discuss the RAR/PAR specs particularly, since we haven't fully yet, and catch up on XYZ. Here is the previous thread discussing RAR <https://groups.google.com/forum/#!topic/kantara-initiative-uma-wg/56_fskNkn…>, and here is a handy IETF 106-related blog post <https://oauth.net/events/2019-11-ietf106/> with relevant spec links. (I attended the TXAuth BOF session remotely and plan to dial in to OAuth session 1 tonight.) If we meet, will we have sufficient attendees to have an interesting conversation? Please send a note in this thread or on Skype if you can make it. Thanks. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Upcoming UMA WG meetings
by Eve Maler 18 Nov '19

18 Nov '19

Hi all– I need to make some adjustments to upcoming UMA telecons due to shifting schedules. Here is the plan for the rest of the calendar year. Don't forget you can ask to receive a calendar invitation if you aren't already on them. Tuesday 8am PT meeting series (business-legal framework, goal: draft second report): - Tue Nov 19: *need to cancel (new)* - Tue Nov 26: canceled due to US holiday - Tue Dec 3: meeting - Tue Dec 10: meeting - Tue Dec 17: *I need to shift this a half-hour earlier due to an interfering meeting* - Tue Dec 25: will cancel due to holiday - Tue Dec 31: will cancel due to holiday Thursday 6am PT meeting series (technical, main goals: extension/XYZ use case collection, charter refresh): - Thu Nov 21: meeting - Thu Nov 28: canceled due to US holiday - Thu Dec 5: meeting - Thu Dec 12: meeting *(will call for agenda items and may cancel if none)* - Thu Dec 19: meeting *(will call for agenda items and may cancel if none)* - Thu Dec 26: will cancel due to holiday - Thu Jan 2: will cancel due to holiday *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: [KI-LC] Fwd: Call for Speakers: European Identity & Cloud Conference 2020
by Eve Maler 12 Nov '19

12 Nov '19

For your information and action. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message --------- From: Colin Wallis Kantara <colin(a)kantarainitiative.org> Date: Fri, Nov 8, 2019 at 10:57 AM Subject: [KI-LC] Fwd: Call for Speakers: European Identity & Cloud Conference 2020 To: Kantara Leadership Council <lc(a)kantarainitiative.org> Folks FYI and for cascading down through your groups. Looking forward to seeing announcements about great proposals being accepted that support Kantara's specs and programs..;-). Kind regards Colin ---------- Forwarded message --------- From: KuppingerCole Analysts <service(a)kuppingercole.com> Date: Fri, Nov 8, 2019 at 6:03 PM Subject: Call for Speakers: European Identity & Cloud Conference 2020 To: Colin Wallis <colin(a)kantarainitiative.org> Europe's Leading Information Security Conference | May 12 - 15, 2020 in Munich, Germany Click here <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> to view this message in a browser window. [image: Call for Speakers: European Identity & Cloud Conference] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> Dear Colin, Whether you are an identity expert, a thought leader in cybersecurity or a pioneer in the field of artificial intelligence, the *European Identity & Cloud Conference 2020 Call for Speakers* provides the perfect opportunity to shape the future of an entire industry! Share thought-provoking ideas, best practices and your personal experience in front of an international audience. There are many ways for you to step into the limelight of Europe’s largest conference on information security: Give a single presentation, contribute to a panel discussion or enter the big stage and deliver an insightful keynote on the topic of your expertise. Apply as a Speaker → <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> Call for Speakers is open* until January 24, 2020* *Exclusive Opportunity for Enterprise Representatives* KuppingerCole offers *full access to KuppingerCole´s KC PLUS Research Platform for 8 weeks* to all eligible submissions from enterprise representatives. If your proposal is accepted, your access will be *extended to one year.* Furthermore, the first 15 accepted proposals will be invited to our *KCx Talk “AI and Cybersecurity in the Age of Quantum Computing” on Sunday, May 10, 2020, in a top-class resort hotel in the greater area of Munich.* This invitation includes an exclusive seat at the KCx Talk evening dinner as well as one-night accommodation (May 10th – 11th, 2020) in a single room including breakfast at the resort hotel. Round off your experience with outdoor activities or relaxing time in the spa. To make sure you are back on time for the kick-off of EIC 2020 on Monday, May 11, 2020, we will arrange a transfer to the Infinity Hotel in Munich. This offer is only available for representatives of companies who do *NOT* provide solutions and/or services in markets, which are covered by the topics of this conference. [image: Call for Speakers] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> *10 Ways to Contribute to the Agenda * European Identity & Cloud Conference 2020 | Key Topics *1* AI, Digital ID, Cybersecurity: Re-Defining Leadership in a Post Digital Society *2* Defining an Effective Cybersecurity Strategy that protects your Digital Enterprise Against Cyber Risk *3* Top Trends in Identity & Access Management (IAM) and AI-powered Cybersecurity that Impact your Infrastructure *4* Managing Non-Human Identities *5* Using Blockchain for Identities – Latest Trends *6* Reaching a New Level of Operational Efficiency: Identities & Privileges in Robotic Process Automation *7* Cloud Strategy Roadmap *8* Balancing User Experience & Security through Customer Identity & Access Management *9* Bootcamps & Toolkits Supporting your AI Implementation Programs *10* Scale, Manage, Consolidate, Integrate: Public & On-Premise Cloud, Core IT Hosting, Edge IoT [image: Download as ics] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> *WHEN*: May 12-15, 2019 *WHERE*: INFINITY BallhausForum Andreas-Danzer-Weg 1 85716 Unterschleißheim, Munich Germany Location Info <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> *Save to your calendar* <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> EIC 2019 Impressions [image: EIC Impressions 2019] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> KuppingerCole Analysts' European Identity & Cloud Conference <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> - taking place May 12-15, 2020 in Munich, Germany - is the place where the Digital Transformation is alive. The EIC Conference offers a mixture out of best practice discussion, visionary presentations and networking with a future orientated community. More than 800 participants consisting out of end users and worldwide leading vendors, thought leaders and analysts get together in Munich to be inspired by a high-class list of international top-speakers. [image: Facebook] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> [image: Twitter] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> [image: LinkedIn] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> [image: Forward to Friend] <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> Copyright © KuppingerCole Analysts AG If you would like to change your subscription settings or if you don't want to receive further mails from KuppingerCole, please visit this link <https://service.kuppingercole.com/acton/rif/27249/s-0270-1911/-/l-000d:1522…> . To read KuppingerCole's privacy policy, click here <https://service.kuppingercole.com/acton/ct/27249/s-0270-1911/Bct/q-00cc/l-0…> . KuppingerCole Analysts AG | Wilhelmstr. 20-22, 65185 Wiesbaden, Germany | +49 (211) 2370 77-0 _______________________________________________ LC mailing list LC(a)kantarainitiative.org https://kantarainitiative.org/mailman/listinfo/lc

1 0

Fwd: [KI-LC] Fwd: Grow your reputation as an IAPP P.S.R. 2020 speaker
by Eve Maler 12 Nov '19

12 Nov '19

For your information and potentially action. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message --------- From: Colin Wallis Kantara <colin(a)kantarainitiative.org> Date: Tue, Nov 12, 2019 at 7:46 AM Subject: [KI-LC] Fwd: Grow your reputation as an IAPP P.S.R. 2020 speaker To: Kantara Leadership Council <lc(a)kantarainitiative.org> Folks FYI.. and cascading down through your group lists.. Cheers --------- Forwarded message --------- From: IAPP Events <events(a)iapp.org> Date: Tue, Nov 12, 2019 at 3:22 PM Subject: Grow your reputation as an IAPP P.S.R. 2020 speaker To: <colin(a)kantarainitiative.org> Apply to Speak at IAPP Privacy. Security. Risk. 2020 To view this email as a web page, click here <http://info.iapp.org/v/b0002zZudEF0M88s000Fa7U> *#PSR20 <http://info.iapp.org/c0720F8E0uUZ08zMi0avd00>* [image: IAPP Privacy. Security. Risk. 2020 | September 29 - October 2 | AUSTIN] <http://info.iapp.org/n/n0E80wj00FUu0MZ0a802zd7> Do you have expertise to share with the privacy and security community? Show that you are one of the privacy industry’s leading practitioners by speaking at *IAPP Privacy. Security. Risk 2020* <http://info.iapp.org/n0E80wj00FUu0MZ0a802zd7> in Austin, Texas. The call for proposals is open <http://info.iapp.org/TkUEd0808002aZx00u7FzM0>, and we’re looking for speakers who can inform and provoke with memorable presentations on timely topics. P.S.R. consistently attracts sellout crowds of privacy and information security professionals. Connect with them by sharing your knowledge and experience. You’ll grow your reputation while contributing to the privacy and information security communities. The *deadline to submit is Feb. 2, 2020*. Submit Your Proposal <http://info.iapp.org/TkUEd0808002aZx00u7FzM0> If you have any questions, please contact Julia Kirchmer. Julia is happy to help you throughout the process and will monitor the status of your submission. You can reach her at +1 603.427.9200 x275 or by email <http://info.iapp.org/Q0dM0aZ0Ey0uF0U8z20l780>. ------------------------------ *IAPP Privacy. Security. Risk. 2020 <http://info.iapp.org/n0E80wj00FUu0MZ0a802zd7>* Training September 29-30 Workshops September 30 * Conference October 1-2 * *Austin, Texas* [image: Facebook-icon-circle.png] <http://info.iapp.org/Xzu08mZ0U200Md7aF008Ez0> [image: Twitter_icon-circle.png] <http://info.iapp.org/G8Z0Md00an7AE0zu00208UF> [image: LinkedIn-icon-circle.png] <http://info.iapp.org/c0720F8E0uUZ08zMo0aBd00> [image: YouTube_Icon-circle.png] <http://info.iapp.org/HE0002F0U8padM70u8Z00Cz> [image: Instagram_Icon-circle.png] <http://info.iapp.org/DED720q0MZa00d08uU080zF> [image: IAPP Logo _PMS368_-01.png] <http://info.iapp.org/VaZr002zd80M000Eu7F8EU0> This email was sent by: INTERNATIONAL ASSOCIATION OF PRIVACY PROFESSIONALS, 75 Rochester Ave., Portsmouth, NH 03801 USA +1 603.427.9200. This email was sent to you at colin(a)kantarainitiative.org. You received this email because you are a member of International Association of Privacy Professionals (IAPP) or you provided your email address to us. We respect your right to privacy; view our privacy statement <http://info.iapp.org/u/VaZt002zd80M000Eu7F8GU0>. Manage Email Subscriptions <http://info.iapp.org/u/SZ0M0z0au070UE82800dFuH> Unsubscribe <http://info.iapp.org/u/K00F7EZ00udI0vza828U0M0> You cannot unsubscribe from IAPP listserv emails via this link. To unsubscribe from the *IAPP Privacy List* or *IAPP Women Leading Privacy List*, please use the unsubscribe links at the bottom of those emails. _______________________________________________ LC mailing list LC(a)kantarainitiative.org https://kantarainitiative.org/mailman/listinfo/lc

1 0

No Thursday UMA WG meeting until Nov 21 / RAR
by Eve Maler 07 Nov '19

07 Nov '19

When we come back, I'd like to take a look at the current state of transactional and XYZ specs and see if we can puzzle out equivalent flows for what we can already accomplish. I'm particularly interested to see how RAR stacks up. Has anyone gotten experience with it yet? *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

Notes from 2019-11-05 UMA business-legal framework telecon
by Eve Maler 06 Nov '19

06 Nov '19

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2019-11-05 Attending: Eve, Nancy, Tim (regrets: Cigdem, Andi) We have been dealing with the "multiple RRAs" state table as if there is always and only a single DS. For simplicity, perhaps we should continue in this vein. It would be insanely complex to imagine that there are multiple DS's as well. The "co-equal rights" question is about resource administration rights specifically. However, a number of real-life use cases have the "multiple DS" situation: joint bank accounts where both account holders should have exactly equal rights, etc. In implementation, this is a problem and is generally handled badly, in that one person is made "primary" and the other(s) "secondary. In some use cases this divide is appropriate (main householder vs. other people in the household for digital streaming services), but for things like a joint bank account or other spouse-type membership accounts, both/all holders should really be co-equal – until such time as there is a divorce or other split and the number of DS's goes back down to exactly 1. What if two brothers share a bank account and one of them has to be removed from managing it for malfeasance and the other brother is managing it for the two of them, somewhat like in the Gravity Payments case? To clarify whether we need to focus on multiple-DS use cases and whether they are sufficiently valuable to solve, Eve will ask an FSI/bank expert to join us at our next meeting. Nancy will do the same for a genomic data expert. The current use cases that we've mentioned under State 3 in the table ("joint bank account each with equal access, joint tenancy") look like they're not actually correct because they probably refer to multiple DS's, so we have to sort out whether we're going to treat multiple DS's or not, and move the use cases over if so. *AI:* Nancy and Eve: Find experts to join our next call to establish existence and priority of multiple-DS use cases in different sectors. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Attending IETF 106 remotely
by Eve Maler 04 Nov '19

04 Nov '19

If anyone is in the same boat as I am and can't attend IETF 106 (in Singapore) in person, you may want to register to attend remotely. There is a new "txauth" BOF to discuss Justin's XYZ draft that will be meeting, and the OAuth WG will be discussing the RAR and PAR drafts among other things. All are relevant to our interests. Here is the remote registration link: https://www6.ietf.org/registration/ietf106/remotereg.py *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: UMA business-legal framework telecon 2019-11-05
by Eve Maler 04 Nov '19

04 Nov '19

We meet *8am PT* on Tuesdays at https://global.gotomeeting.com/join/857787301 -- see our calendar here <https://kantarainitiative.org/confluence/display/uma/Calendar>. Please see our notes page <https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not…> for previous notes and handy links. We'll continue to work through our GDoc. This time we'll get to the RRA (resource rights administrator)-centered states, state changes, and use cases. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0