April 2019 - WG-UMA - mailman.kantarainitiative.org

Looking for quick review of "UMA 101" slides for IIW first day
by Eve Maler 28 Apr '19

28 Apr '19

Hi folks-- I put together some slides to present at IIW for a requested UMA 101 session, which I have shamelessly based on UMA overview/deep dive material presented at last week's HEART webinar. I'm considering this sort of a "version 2" of the material that Maciej and I delivered to the IETF 104 meeting; it was a welcome chance to refactor it. If you have a chance to look at it quickly and comment on it by Monday afternoon Pacific time, that would be great. I'll upload the final version to our wiki and advertise it in the usual fashion. Thanks in advance! *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

The UMA business model meeting series is set up
by Eve Maler 21 Apr '19

21 Apr '19

http://kantarainitiative.org/calendars/ It starts on May 7th. We're working towards a September completion of the work, with drafts available before that. If you haven't yet been added directly to the event invitation and you want to be, please let me know. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2019-04-18
by Eve Maler 18 Apr '19

18 Apr '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18 MinutesRoll call Quorum was not reached. Approve minutes - - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> Deferred. Goings-on in the community On Apr 4, the last time we met, the UK government put out its response <https://assets.publishing.service.gov.uk/government/uploads/system/uploads/…> to the consultation it had done on the Pensions Dashboard project. Based on the acknowledgment there that UMA is required for PD success, there is an opportunity now to align UMA, OB, FAPI, PD, CIBA, OAuth, etc. – and some interested parties are currently applying resources to help do this. Don't forget about: - The HEART webinar and deep-dive workshop <https://zoom.us/meeting/register/0488db6a4250eeea7c24e00bf0acd2b8> (two hours total) on Apr 23 - The IEEE ComSoc magazine special issue <https://www.comsoc.org/publications/magazines/ieee-communications-standards…> with deadline of mid-June – "The Dawn of the Internet Identity Layer and the Role of Decentralized Identity" (Eve is one of the guest editors) - The SOUPS conference <https://www.usenix.org/conference/soups2019> – the call for posters is still open and the new PEPR conference is co-located with it (@@add link) - The new Me2B alliance <http://www.me2b.us/> – Lisa is building this community as a home for developing a code of practice and certification for ethical digital relationships – they're starting with businesses but it could branch out - IIW – here is a M2Be discount code! Me2B_IIW28_20 IETF update Opinion is mixed in the OAuth group about adoption. Eve attended the last OAuth virtual office hours meeting and discussing things more with the WG. There's not, perhaps, a deep understanding yet of the many use cases, particularly around the A-to-B flows. Eve offered a "bull session" to get any and all questions answered at Montreal (IETF 105) in July, and there was good interest in that. Alec/Identos is planning to attend as well. Who else will be there who's on today call? We're not sure if anyone else. During that call, they brought up again that the specs could change considerably if adopted. Eve assured them that the UMA WG knows the deal, and she has exhorted the UMA participants to take active part where they are committed to current design; the key consideration overall is solving for the use cases that UMA has solved for (thinking, e.g., of slide 12 in what we presented). Should we consider breaking up our specs more and contribute them in more pieces? Mike had suggested something like that. Eve hadn't been sure of that, but maybe (e.g.) Alex notes contributing token endpoint error handling as an independent piece would be a kind of valuable primitive they could adopt. Cigdem asks: Do we have feedback on which parts they're excited about? Thomas notes no one gets excited about anything until you're at IETF draft. Maybe we do want to consider the informational RFC path at first, given that there is starting to be some adoption that could welcome that level of standardization. It's not hard to then turn it into a standards-track RFC. The former could be an individual submission (maler-*) or could be adopted by the OAuth WG (oauth-*) as a work item and select specific people to read it and comment on it. The individual route is faster. If the OAuth WG remains uninterested and the world continues to demonstrate traction, we could go to the ADs (Area Director, which in the case of OAuth is Security <https://trac.ietf.org/trac/sec/wiki>; the ADs are Benjamin Kaduk and EKR) and ask to adopt. Cigdem suggests the permission ticket notion might be another area that is amenable to modularizing somehow. It's a pattern we're seeing more frequently. It's a "ticket-getting-ticket" (TGT) that functions kind of like an authorization code, or at least that's the analogy that Bertrand made and that we tried to make in the IETF 104 presentation. Is this a dangerous analogy? Ben would get it! Hannes appears to believe that the WG needs a charter change before adopting the UMA work, but we're not certain why this is the case. Let's continue to keep things open prior to Montreal, and figure out our choice of strategy by/after then. *AI:* Eve: Check with Hannes/Rifaat about the OAuth charter situation prior to Montreal. Business model update There is a winning primary time: Tuesdays at 9am PT / 10am CT / 11am ET / 4pm UK. And a winning secondary or alternate time: Fridays at 8am PT / 9am CT / 10am ET / 3pm UK. *AI:* Eve: Set up the new business model meeting series, using the same UMA WG GTM where possible. *AI:* All: If you didn't respond to the Doodle poll for this meeting series, please drop Eve a note if you want to be included in the event invitation. Fine-grained access extension This is the name that Pedro has given his extension (already documented in Keycloak documentation, but he has turned it into something that looks like an extension spec). He has send a draft to Eve but not yet to the list, but it's coming soon! If there are enough UMAnitarians around in Montreal, we could potentially have an an UMA WG F2F there and take a look at an Identos-contributed extension spec (assuming it might be contributed by then). Charter refresh discussion - The current charter <https://kantarainitiative.org/confluence/display/uma/Charter> as of 27 Feb 2018 Deferred. Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Eve 3. Cigdem Non-voting participants: - Alec - Scott - Lisa - Thomas - Colin Regrets: - Andi *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-04-18
by Eve Maler 17 Apr '19

17 Apr '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-18 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> - IETF update - Business model update - Fine-grained access extension - Charter refresh discussion - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-04-11
by Eve Maler 10 Apr '19

10 Apr '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-11 Date and Time - *Thursdays 6am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> , 2019-03-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-28> , 2019-04-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04> - IETF update - Business model update - Fine-grained access extension - Charter refresh discussion - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Reinvigorating our business model work: a plan
by Eve Maler 10 Apr '19

10 Apr '19

Tim (our Legal Editor) and I have just met, and I'd like to propose a way forward for producing our second business model report. We'd like to: - Focus it on use cases that illustrate each of our mappings from business relationships (and changes in those relationships) to UMA technical artifacts -- we can refine as necessary - Publish it by September -- moving quickly is a priority - Find a time when interested parties can meet apart from the main Thursday WG flow -- like our old Legal meeting series As a reminder, here is the main "Legal role definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>" deck. Please respond in this thread or directly to me and Tim with your interest and questions. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

5 11

Fwd: [Openid-specs-heart] ONC HEART webinar 2019 April 23 1:30 - 3:30 PM EST
by Eve Maler 04 Apr '19

04 Apr '19

FYI, folks -- please feel free to register, join, and spread the word. I'll be leading the UMA-specific portions of the webinar and online workshop. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message --------- From: Debbie Bucci <debbucci(a)gmail.com> Date: Mon, Apr 1, 2019 at 6:04 AM Subject: [Openid-specs-heart] ONC HEART webinar 2019 April 23 1:30 - 3:30 PM EST To: <openid-specs-heart(a)lists.openid.net> Hello all, Please join us for recent HEART updates and spread the word *ONC’s HEART Profiles Webinar & Workshop – Registration Open* Join ONC for a HEART (Health Relationship Trust) Profiles Webinar and Workshop to learn about the recently updated HEART profiles and participate in a short, technical workshop about the HEART protocols and how they compare and contrast with other efforts. HEART <https://click.connect.hhs.gov/?qs=9bccb28cc91647c7447fb638ecb0e1a0f177c8e14…> is a set of profiles, created in partnership with the OpenID Foundation, that enables consumers to control how, when, and with whom their clinical data is shared. The HEART model builds on existing state-of-the-art security and adds additional components to ensure that patient clinical data is securely exchanged. *Date & Time*: April 23, 2019 at 1:30pm ET Register <https://click.connect.hhs.gov/?qs=9bccb28cc91647c7c1087da1288ea5348b9730cd8…> _______________________________________________ Openid-specs-heart mailing list Openid-specs-heart(a)lists.openid.net http://lists.openid.net/mailman/listinfo/openid-specs-heart

1 0

Draft minutes of UMA telecon 2019-04-04
by Eve Maler 04 Apr '19

04 Apr '19

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-04-04 MinutesRoll call Quorum was not reached. Approve minutes - - Approve minutes of UMA telecon <http://Approve minutes of UMA telecon 2019-03-14, 2019-03-28>2019-03-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-03-14> Deferred IETF updates Further updates: Cigdem talked to people post-ACE group meeting about her UMA group involvement, and they were pleased. Ludwig and Hannes were positive. Our inclusion of desired next steps was good. Eve reached out to Hannes (OAuth co-chair) in email and they discussed. He mentioned that a next step for him would be to talk to the AD about a charter change and put out a call for adoption of the documents (presumably the UMA docs and other new ones) on the list. Pedro was on-site. The presentation was so detailed that it may have overwhelmed a bit. People may not have really understood the use cases and motivation behind it. Doing more work around this would really help. There are some solutions in other specs that have some overlap. In ACE there is the offset info piece. Should the mechanism align with the permission ticket, or not? Cigdem talked to Ludwig about it, and they were thinking that it's just different from UMA. However, the new AS discovery solution happens at the same time as UMA's permission ticket flow, and that could be interesting to look at. Hannes suggested that a specific draft on this particular communications path for resource servers/clients/tickets (or other). Some of our language continues to be confusing. Someone asked at the presentation why it was "RPT" (that is – *requesting party* token), and maybe we should have just called it simply "access token". Though George points out that we could consider it to have a somewhat different semantic: it has different contents, and it's strongly bound to more entities. Thomas adds: Because the token's entitlements (permissions) are targeted to a requesting party, it's important for the client to be able to reuse the RPT for access to multiple resources. The philosophical argument about calling it something same or different helping the case may be a different matter. The top most confusing topics: permission ticket flow and claims collection flows. - *Permission ticket:* In hindsight, given that we're seeing others with this use case/challenge, UMA is not so complicated. Torsten L presented this <https://bitbucket.org/openid/fapi/src/master/Financial_API_Lodging_Intent.m…> related to FAPI recently, and "Lodging Intent" relates to UMA – except it doesn't involve human interaction. The AS sends the RS to get claims from the client. See the last slide here <https://datatracker.ietf.org/meeting/104/materials/slides-104-oauth-sessa-s…>. Fine-grained or richer authorization requests, a la the Keycloak extension, are where they seem to be going. Call it "pulled claims" through the RS. - *Claims collection:* This is a great place to do a better job on the use cases, and maybe we can also add flowcharts and/or state diagrams – something along those lines! If we support our docs getting adopted, we would need to advocate for them. Those who, especially, are comfortable reading OAuth-related specs and commenting should strongly consider joining the OAuth WG <https://tools.ietf.org/wg/oauth/charters>(joining the list and being active) – and attending the thrice-yearly meetings – and advocating for the desired direction for the specs. If someone says it's possible to just take OAuth as it is now, maybe with a series of smaller specs, to solve the use cases we have, we might have to have that demonstrated to us to show that it's interoperable. IIW preparation Eve is going to "spell" George and is doing the UMA 101 session this time. She will revise the OAuth presentation and we'll improve along the lines we've discussed above. Any profiles/extensions work to consider in the short term Should we look at standardizing the Keycloak extension as discussed above, since it's a pattern that may very well be broadly useful? Sounds like yes. Also, how is the IDENTOS extension going? Is that something they would like to bring to the WG? Sounds like it's moving in that direction. Charter refresh discussion - The current charter <https://kantarainitiative.org/confluence/display/uma/Charter> as of 27 Feb 2018 Deferred. Planning upcoming business model work AI: Eve: Reach out to the lawyerly contingent to find out when they can attend and dedicate one or more whole sessions to this topic. Q2 meeting schedule - We are meeting *Thu Apr 4* but not *Thu Apr 11* (already cancelled). - Need to cancel *Thu Apr 25*. - Need to cancel *Thu May 2* due to IIW. - Need to cancel *Thu May 16* due to EIC. - Need to cancel *Thu Jun 6*. - Need to cancel *Thu Jun 27*. Come to the ZZ Auth and the Love Tokens (and others?) gig at the closing party! Attendees As of 18 Oct 2018, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Domenico, Peter, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Eve 3. Cigdem Non-voting participants: - George - Lisa - Nancy - Scott - Alec - Adrian - Thomas Regrets: - Andi - Domenico *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2019-04-04
by Eve Maler 04 Apr '19

04 Apr '19

(I haven’t created a wiki page for this yet... Traveling today.) Let’s discuss: - IETF updates (hoping Pedro can join us, but I have other updates even if not) - Charter refresh discussion (depends on the above to a degree) - Any profiles/extensions work to consider in the short term - Planning upcoming business model work - Q2 schedule Please let me know if you have other items, or details on these items. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

2 2