September 2020 - WG-UMA - mailman.kantarainitiative.org

UMA/Email proof-of-concept
by Igor Zboran 23 Feb '21

23 Feb '21

Hi all, I’ve found that the topic of healthcare is quite popular among UMAnitarians. Although AEMS has been designed as a general or enterprise-oriented system, I think that it also meets the specific needs of the healthcare sector. To demonstrate the feasibility of the UMA/Email idea, I decided to build proof of concept. The full source code will be available in the public GitHub repository https://github.com/uma-email/poc. Any help welcomed. -Igor

2 6

Agenda for UMA telecon 2020-10-01
by Eve Maler 30 Sep '20

30 Sep '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-01 Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2020-09-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-17> , 2020-09-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-24> - Issue #364 <https://github.com/KantaraInitiative/wg-uma/issues/364> - Work on separate Relationship Manager spec? - Clarify and prioritize work - UMA and UDAP followup - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2020-09-24
by Eve Maler 24 Sep '20

24 Sep '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-24 MinutesRoll call Quorum was not reached. Approve minutes - Approve minutes of UMA telecon 2020-09-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-17> Deferred. Leadership team changes Thanks to Maciej for his long and distinguished service to the Work Group as Vice-Chair! Policy Manager extension spec - Spec location <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> (unchanged from last week) and issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> (label "policymgr") - Issue backlog status report - Scope of current extension effort (new issue #364 <https://github.com/KantaraInitiative/wg-uma/issues/364>, captured after today's discussion – see the "pretty diagram" captured there) As we outlined them last week, there are three pieces, which were presented as encompassing options: 1. AS-RO API (policy manager/policy API) 2. Add the RS-RO API (manage API) 3. Add the cascading AS solution ("the"? really? [image: (smile)] ) Adrian suggests we solve the third bit and it will influence how we solve the first bit. Alec suggests the opposite. Eve has trouble even defining what the third bit is (she tried to convey it to the LC and failed, but believes she succeeded on the first two). Alec thinks this makes his point. Can Adrian define the third bit? Here is his definition: "At the time of resource registration between the RO and the RS, the RS might offer both a wide ecosystem (unrestricted AS) choice as well as a secondary AS to be picked from a federated list." It's both bring-your-own-AS and a fallback option or set of options (perhaps a timeout, just as happens with the Kantara UX's IdP choice)." This may be a valid use case, but appears to be different from the third bit we discussed last week, which was about "set math" and "RqP claims" and such. It seems to be related to impacts on how the first and second bits interact. Eve wonders if "cascading AS" is even a good term for the use case because once the RO chooses an AS for protection of that resource, there is just the one AS protecting it as usual. Can we avoid the word "cascading" except in the case of the issue #260 <https://github.com/KantaraInitiative/wg-uma/issues/260> sense? Should we pursue this new use case, which let's call *RO choice of AS at resource reg time*? Nothing in the spec says that Alice has a free choice of AS. We'll close the matter. The third bit we discussed last time was more like: The RqP goes to one AS and is redirected to some other AS for claims collection. Alec suspects we just don't need to solve this yet. (Eve suspects we'll eventually go down the rabbit hole and have to solve it, but by then we'll understand the problem better. So, win win.) UN Panel on Digital Cooperation Tim updated us on this panel's latest work. It's largely funded by the Gates Foundation. They believe there needs to be an individual's ability to control their personal information. They also believe we need a multi-stakeholder (vs. multi-lateral) approach to information governance. This was a constant theme. Could we offer resources to comment or present? ID2020 was the original relevant initiative. There may be a formal way to follow up through Kantara's liaison efforts. It seems they're broadening from identity to data control/authorization. UMA and UDAP - Eve's promised thoughts - Any others'? Eve presented a four-bubble Venn. Alec and Adrian are willing to comment seriously on it so she'll distribute it to them for comment. What about the NIST Zero Trust Architecture? How do each of these solutions account for it? Adrian will comment on that aspect. Alec will check all of the intersections. Attendees As of September 3, 2020 (pre-meeting), quorum is 5 of 9. (Michael, Domenico, Peter, Sal, Gaurav, Thomas, Andi, Maciej, Eve) 1. Michael 2. Domenico 3. Thomas 4. Eve Non-voting participants: - Alec - Adrian - Tim - Anik *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Stepping down
by Maciej Machulak 24 Sep '20

24 Sep '20

Dear all, I write this email to say that I think it's time for me to step down from the Vice-Chair role at the User-Managed Access Work Group. It's been a fantastic time and I am glad with the progress made so far on the UMA specification, implementations and overall adoption. As the interest in the technology is increasing, I think that a person with a fresh look and more time on their hands is better suited to fill that role and to support Eve in running the group. For the last few months my focus has been primarily on my work at HSBC and I couldn't contribute to the efforts of the group as much as I wanted. Having said the above, I will continue to participate in the work group calls when possible, provide feedback and support the adoption of UMA itself - it is, after all, helping to create a more secure and more privacy-oriented world. Lastly, it has been an absolute pleasure to work with all of you - thank you for this time! Kind regards, Maciej -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +48 602 45 31 66 (PL)

4 3

Agenda for UMA telecon 2020-09-24
by Eve Maler 23 Sep '20

23 Sep '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-24 Date and Time - *Alternate-week Thursdays 10am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2020-09-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-17> - Leadership team changes - Policy Manager extension spec - UMA and UDAP - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2020-09-17
by Eve Maler 23 Sep '20

23 Sep '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-17 MinutesRoll call Quorum was reached. Approve minutes *MOTION:* Moved by Andi: Approve minutes of UMA telecon 2020-07-09 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-07-09> , 2020-07-16 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-07-16> , 2020-07-23 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-07-23> , 2020-07-30 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-07-30> , 2020-08-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-08-06> , 2020-08-13 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-08-13> , 2020-08-20 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-08-20> , 2020-08-27 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-08-27> , 2020-09-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-03> , 2020-09-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-10> . *APPROVED* by acclamation. Thank you to Andi for his stalwart service! Policy Manager extension spec - Let's get formal about working on this spec - Discuss adopting a timeline/schedule for it - Its current name is Policy Manager, and it's described as an extension - It resides in GitHub <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> - Please use GitHub issues <https://github.com/KantaraInitiative/wg-uma/issues> with appropriate labels to raise issues with it - There is a new "*policymgr*" issue label unique to this spec but there are other labels you can use for further categorization - As a habit, please review the spec and try to provide major comments and questions in email ahead of calls The status of this draft is "editor's draft". If the voting participants of the WG vote to approve it, it becomes a "WG draft". It could then proceed to various levels of Kantara approval. Regarding our issue backlog, it appears there is a cleanup step we need to perform. Then we need to review them all for substantive issues we would like to bring forward from the backlog. We have a process for step 1 and we'll proceed to step 2 when we have backlog clarity. *AI:* Andi and Eve: Work through the issue backlog cleanup step, reaching out to Alec and Kate as required. Andi will set up a call with Eve to start the process. *AI:* Eve: Add descriptions to all of the issue labels. Eve's promise to the WG: Agendas 24 hours or more ahead of time, highlighting what spec text has changed in that timeframe from the previous call. Eve's ask: Any issues/comments to be framed in terms of "being the solution": New text proposals, new sets of options, etc. Our first formal issue, likely, should be scope. It's hard to decide a timeline until we decide that. The current draft only has the RO-AS component (policy API). Let's call that option 1. Option 2 would also include the RO-RS component (manage API). Option 3 would also include the cascaded AS component ("trusted claims"), where there is a hierarchical directive about claims collection. The policy languages could still be internal to each source and don't have to be standardized, but new set math would have to be specified around a new source that we can think of as "trusted claims". *AI:* Alec: Put in a new issue around extension scope for policymgr label, using the three-option language and including the pretty diagram in the issue. Authorization-Enhanced Email System draft - Brief discussion of Authorization-Enhanced Email System: any next steps? Igor's document (see this WG list email thread <https://groups.google.com/g/kantara-initiative-uma-wg/c/F6ikWQCDEwo>, ironically enough at several levels) is about, instead of sending large attachments through SMTP, pushing a link to an UMA-protected resource and having mail clients pull the attachments as UMA clients performing REST pulls. Eve suggests trying to use some of the graphical patterns of the draft in our auxiliary materials because they would be particularly helpful for conveying the "trusted claims" concept, at the very least. In the world of health IT, SMIME has been used/tried for secure messaging, with mixed results. Sal notes: It's a little like REST SMIME. Let's refer to this as "AEMS" (authorization-enhanced mail system). *AI:* Everyone who is invested in this type of use case: Please put together thoughts on how to make the case for solving it in this fashion and to whom to make it. What to do about GNAP Liaison question raised by Adrian. We've discussed this before; what action is being requested? He provides a MyData Korea call doc link <https://docs.google.com/document/d/1kZ7_Skcn4zb3zOfEu7XZDrYAmLR1T_pbBoSk8AE…> – the call is at 9pm ET tonight. He also asks what our relationship is to UDAP <http://www.udap.org/>. Let's put this on the agenda for next week; Eve will put thoughts together. Attendees As of September 3, 2020 (pre-meeting), quorum is 5 of 9. (Michael, Domenico, Peter, Sal, Gaurav, Thomas, Andi, Maciej, Eve) 1. Michael 2. Domenico 3. Sal 4. Thomas 5. Andi 6. Eve Non-voting participants: - Alec - Nancy - Adrian - Scott - Kate Downing (OSS veteran, startup veteran, ex-Deloitte, available to help!) - Vlad *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 4

Agenda for UMA telecon 2020-09-17
by Eve Maler 16 Sep '20

16 Sep '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-09-17 Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Policy Manager extension spec - Authorization-Enhanced Email System draft - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Authorization-Enhanced Mail System
by Igor Zboran 16 Sep '20

16 Sep '20

Hello UMAnitarians, I'd like to ask if someone from WG UMA would be interested to participate in the Authorization-Enhanced Mail System proposal. Please see the attached document. It is an early draft proposal I've been working on for over a month. Please send your questions, comments and suggestions to the WG-UMA mailing list. Regards Igor Zboran

3 4

The technical components of interoperability as a tool for competition regulation
by Adrian Gropper 13 Sep '20

13 Sep '20

Thank you @Paul-Olivier Dehaye !! This https://osf.io/6er3p/ is by far the best paper on interoperability I’ve ever seen.On the last two paragraphs on p28 you will see much of what is proposed with Gold Button: https://docs.google.com/document/d/1kZ7_Skcn4zb3zOfEu7XZDrYAmLR1T_pbBoSk8AE… I. Brown paper does not capture the idea of a sustainable self-sovereign agent very clearly nor does it understand how self-sovereign communities can reduce the importance of regulation to the overall goal of human-centered tech. It does get a lot of things right including the importance of IETF and W3C and Free / Libre software. - Adrian

2 1

Agenda for UMA telecon 2020-09-10
by Alec Laws 10 Sep '20

10 Sep '20

Date and Time Alternate-week Thursdays 10am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Relationship Manager profile AOB Best, - Alec

1 0