March 2019 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2019-03-28
by Eve Maler 28 Mar '19

28 Mar '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28 MinutesRoll call Quorum was not reached. Approve minutes - - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> Deferred. KNOW Identity recap KNOW has largely been a "panel conference", which is good for people who don't know a lot yet and want to get broad knowledge fast. George went to a blockchain panel. He heard the statistic 19, or perhaps 25, methods of registering DIDs. When you resolve it you get a JSON-LD defined schema. Every method can define within that schema its own methods of how that namespace works. IOW, it is a unique namespace. So, a thousand flowers are obviously still blooming. This is over and above Verifiable Credentials. George was on a panel about standards, with Sarah Squire and others. There was a good breadth of experience there. He believes this method doesn't *solve* privacy, but may *enable* privacy. It's a mindset change. For example, Google doesn't technically need any Verifiable Credentials. It just needs a consistent DID. (But their business model needs more...) Sovrin is adding a layer of private DIDs where you *don't* resolve them to get the public key and they *don't* (he thinks) go on the chain. It's all peer-to-peer. He was unclear how key rotation works at this point. There is continuing evolution, innovation, etc. at this point given the use cases they're trying to solve. Adrian adds that he's been a part of the VC/DID work for some years and is glad to hear George bring this discussion here. He believes federation has reached its limits in terms of privacy. This new work is assigning DIDs to edges – to relationships – by virtue of the pseudonymous identifier. (Eve asks: Is that like pseudonymous identifiers in federation, though?) IETF 104 recap and next steps Eve's take, informed by debriefing Pedro who was in the room (we hope he can join us next week to discuss more in person): The audience was a little overwhelmed by both the amount of content and the comprehensiveness of the specs. Ludwig had sort of warned us about the "wall of text" effect. They did seem to be examining the proposition in good faith. Tony suggested simply using the token exchange <https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16> spec. We understand where he's coming from in terms of the token semantics, but believe there would still have to be quite a lot of specification along the lines of exactly what we've done. FedAuthz would still have to exist to achieve the "wide ecosystem" goal. The UMA Grant spec might be able to accommodate those semantics, but still with a lot of work. Does it make sense to open up UMA to using token exchange? We mentioned this as a possibility explicitly, but also suggested constraints on changing UMA based on the experience of existing implementers and deployments. Would they be interested in the wide-ecosystem use cases? There is a little bit of that in the distributed OAuth work, whose future is uncertain. OIDF might be taking that up. Dynamic client registration has some of that. The healthcare world is driving some of this conversation on the client side (looking at the "patient designee" language in some of the regs). *Standardizing elements of the software statement* so that Bob's client can be onboarded under Bob's signature dynamically as required is something that would push things forward in a wide ecosystem. This doesn't inherently require DIDs or OIDC. It just requires standardizing the bold part. Interop planning *AI:* Eve: Gather enough implementers to discuss the "state of interop" and put together this session. Who will speak? What is the content? Charter refresh The current charter <https://kantarainitiative.org/confluence/display/uma/Charter> as of 27 Feb 2018 has us producing mostly business model outputs. We still are on the hook for some of those. With the contributions made, there are IETF-directed activities it behooves us to do. Maybe we shouldn't edit and close a new 2019-era charter until we know the OAuth WG's plans for certain. Work items for us could include: - "Operational" interop work - Business model work - Could include harmonizing with DID/VC group efforts – Adrian notes that he writes papers on business model topics in those venues - Any profile/extension work of interest to a "horizontal" UMA2 community (until such time as UMA2 might possibly get opened up for serious revision in IETF – could take a long while) Use cases of interest to potentially tackle, whether here or in IETF: - RS-offline use case, a la the ACE C-to-RS flow - Incorporating (profiling for?) PoP and other stronger tokens vs. just bearer - Privacy-enhanced AS represented by a "wallet" (a la the Identos demo/preso <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-11-08…> ) - Are we ID-agnostic enough? Do we handle "ZKP identities" for Alice sufficiently well? - Speaking of ZKP, does our claims collection model accommodate Alice specifying a policy saying "Bob has to be 'over 18'" and enable ZKP for proof? Meeting schedule We are meeting *Thu Apr 4* but not *Thu Apr 11*. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Maciej 4. Eve Non-voting participants: - Thomas - Adrian - George - Nancy - Tim Regrets: - Lisa *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-03-28 (still in summertime skew)
by Eve Maler 27 Mar '19

27 Mar '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28 Date and Time - *Thursdays 6am PT (during "summertime skew", till Mar 31: 1pm UK, 2pm CET)* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> - IETF 104 recap and next steps - Interop planning - Charter refresh - Meeting schedule - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Last call for comments, please: final slides being turned in tomorrow
by Eve Maler 21 Mar '19

21 Mar '19

This is rev 7 -- the final is due *tomorrow*. ...But I think we're pretty much there. Ludwig Seitz was kind enough to send me some comments and I have incorporated quite a few changes in response. Maciej and I are meeting Saturday to prep; we've got 27 substantive slides, 31, if you count the optional ones, so presentation timing will be a bit tight! Pedro stands ready to offer a follow-on discussion session Monday evening if anyone there is interested. Thanks, all! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Rev 5 of the UMA IETF deck - consider this near-final
by Eve Maler 19 Mar '19

19 Mar '19

If you have comments, please make them very specific, with exact wording changes if possible. I'll also be distributing this to a few other key people for comments. Thanks! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Rev 4 of the UMA IETF deck for tomorrow's ad hoc call
by Eve Maler 18 Mar '19

18 Mar '19

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA ad hoc telecon 2019-03-19
by Eve Maler 18 Mar '19

18 Mar '19

This is a reminder that we have our ad hoc meeting TOMORROW at our “usual” time for two hours to continue to work on the IETF slides. There is a calendar entry for it. I will send out fresh slides before then. No meeting Thursday. Special thanks to Domenico for providing a new diagram to order! Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 1

Draft minutes of UMA telecon 2019-03-14
by Eve Maler 14 Mar '19

14 Mar '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecon 2019-02-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-28> APPROVED by unanimous consent. Legal Editor role is up for re-election We decided to make this an annual term (though it could be indefinite if we want). Tim R is willing and happy to continue to serve. *MOTION:* Maciej moves: Tim Reiniger to serve in the Legal Editor role for another annual term. APPROVED by unanimous consent. Congratulations to Tim, and thanks! He asks that we think to include the legal/business concepts (and him) whenever speaking opportunities come up in the northeast corridor (Boston/NY/DC). IETF presentation prep People can let Eve know if they want to be added to the UMA WG calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> invitations she has created. Eve and Maciej will do the actual presentation; he is still figuring out if he will be there in person and should know imminently. If Maciej can make it in person, it's a great opportunity to offer a Monday evening discussion session, but if he's not there, we'll let Pedro decide if he wants to do the same. We worked on rev 4. Domenico will help with a new "marvelous spiral" graphic based on the ASCII-art one in the fedauthz spec that distinguishes the grant (upper) and fedauthz (lower) halves. Identiverse interop session status (Not discussed during the meeting.) Andi is going to find a short session for us to share interop results, whether that is in "matrix" form reflecting private one-on-one testing work done to date or any new work reflecting a test harness. Let's continue to discuss and work on this as we get closer. Meeting schedule No meeting at the regular date/time next week (Thu Mar 21) as Eve suddenly has travel. She will schedule a two-hour ad hoc time block on Tuesday starting at our "regular" hour (6-8am PT – note that we are still in "summertime skew") for final IETF presentation work. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Peter 3. Maciej 4. Eve 5. Mike 6. Cigdem Non-voting participants: - Nancy - Thomas - George - Alec - Tim - Colin - Lisa *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-03-14
by Eve Maler 12 Mar '19

12 Mar '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14 Date and Time - *Thursdays 6am PT (during "summertime skew", till Mar 31: 1pm UK, 2pm CET)* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-02-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-02-28> - Legal Editor role <https://kantarainitiative.org/confluence/display/uma/Leadership+Team> is up for re-election - IETF presentation prep - Identiverse interop session status - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

New draft of slides explaining UMA spec contributions - please provide feedback
by Eve Maler 12 Mar '19

12 Mar '19

Sorry for taking so long to send a new draft. Lots of relatively new content here. There has been some discussion in a separate thread about ACE/offline-flows implications, and I've tried to hint at how we can expand on those topics here. Cigdem and George (and any others), would you like to provide some slide content or thoughts that I can incorporate into the main file, or how would you like to work this? Gluu folks, might you have anyone able to at least dial in remotely to the Prague meetings? I think it would be valuable to share your long historical perspective on UMA implementation and deployment with everyone. If you can't, hoping you can at least comment on the deck. We have a call on Thursday this coming week, which I hope will provide a good opportunity for more discussion and honing. I'd like to send out another draft for wider review after that. Thanks. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2

IETF 104 OAuth sessions are now on the UMA WG calendar / summertime skew
by Eve Maler 11 Mar '19

11 Mar '19

https://kantarainitiative.org/confluence/display/uma/Calendar If you would like me to include an invitation to you on these calendar entries, please send me a note. The entries have links that explain how you need to register ahead of time for remote participation. As of this week and until March 31, we're in the "summertime skew" period where the US has sprung forward but Europe has not done so yet. The Monday (Mar 25) is the day we're presenting, and the time zone works out pretty well for people in the US. Beware that the Thursday (Mar 28) is not all that great. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0