February 2021 - WG-UMA - mailman.kantarainitiative.org

Draft Minutes for UMA telecon 2021-02-25
by Alec Laws 02 Mar '21

02 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25 Minutes Roll call Quorum was NOT reached. Approve minutes Approve minutes of UMA telecon 2021-02-04, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11>, UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> Deferred Pensions Dashboard, any updates All positive. No major changes, IPR issues are progressing. PDP may contribute their profiles directly to 'Kantara' (ie not the WG) to avoid challenges with the RAND license UMA continues to be required by the program UMA/Email proof-of-concept https://github.com/uma-email/poc <https://github.com/uma-email/poc> How does this compare with existing 'secure messaging' products? This is made to ride onto of the existing SMTP/IMAP protocols. There is a POC/demo available here: https://www.federizer.org/ <https://www.federizer.org/> Is there a path to having this attachment protocol as an extension to the existing SMTP protocol <https://tools.ietf.org/html/rfc5321>? Would have to work through IETF. Do the two mail services both have to support the extension? likely yes, maybe need a discovery mechanism. If the recipient doesn't support could fallback from claims pushing to interactive claims gathering. However, this pushes the RqP authentication question as the senders AS would need to allow federation to the RqP email domain. This could use the 'Trusted Claims" profile, however there is no standard way that a mail server must authenticate the user? ie not all are OIDC providers. This would need further exploration. Profiles Discussion, relationship manager Three "real" use cases to design around A resource server that holds Alice's data, however does not have an end-user authentication mechanism. A resource server that can authenticate Alice (somehow), and wants to offer resource managed integrated in other client applications FPX profile: the RS offers an OAuth API to authenticate the end-user, the RS like (1) would federate to another IDP (Trusted Claims??) PDP profile: The RS offers an AT protected 'find' API. The AS, after getting Alice's consent, hits the find API with Alice's verified claims, packaged in the AT, at every registered Pension Provider RS. If the RS has pensions for Alice, it needs a PAT to start registering resources with. It "exchanges" the AT provided by the PFS with the AS for a RS-audience PAT. The RS can then register the found pensions. Since the RS and the AS are in a secure eco-system and the RO is authenticated to the AS at the time of the resource discovery , the RS can use temporary credentials specific to the RO at the AS to obtain the PAT. It is proposed that the AS will issue an authorization token for use by the RS for grant type "urn:ietf:params:oauth:granttype:jwt-bearer" as in [RFC7523] Section 2.1 Can to two interactions use the same APIs mechanisms? GET /resources → returns available resources for Alice \{ as defined by UMA Fedz with the addition of an optional "authorization_server" attribute, which points to the specific AS this resource is currently registered with } POST /resource/_id/ \{ at_as: url_to_my_AS } GET /authorization_servers → return list of supported authorization servers, either for Alice or in general This is where the intersection between UMA (API based resource) and w3c VC issuance starts to work. GET /resources == GET /credential offers, POST /resource_to_as = issue me this credential. This also comes around to wallet = personally controlled UMA AS. How can we design to support many Authorization Servers (ie a wide-ecosystem!)? The PFS was built to not exclude many AS's. A AS's would be hosted out of the gate, however the expectation is towards the more "open-finance" model where many Financial Institutions would host an AS for their customers/users. The 'governance registry' (as specified in the report) and federated identity service becomes the common trust sources for the ecosystem. How woudl pension rsources previously registered at one AS, be moved to a second one? What if the AS is the 'gateway' to the service where Alice wants to make her pension available Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Micheal Alec Non-voting participants: Scott Ken Ian Anik Nancy Colin Regrets: Eve Andi

2 3

Re: [WG-UMA] AEMS in less than 300 words
by Ilyah Simuni 25 Feb '21

25 Feb '21

Igor, Interesting idea for AEMS implementation. Wondering if you have done threat modeling on this architecture. I see a lot of potential attack vectors that might break the protocol. One concern is that the policy is separate from the email, so enforcement must be coded in the exchange protocol, which might not work as intended. Regards, ilyah -----Original Message----- From: WG-UMA <wg-uma-bounces(a)kantarainitiative.org> On Behalf Of wg-uma-request(a)kantarainitiative.org Sent: Thursday, February 25, 2021 10:46 AM To: wg-uma(a)kantarainitiative.org Subject: WG-UMA Digest, Vol 140, Issue 13 Send WG-UMA mailing list submissions to wg-uma(a)kantarainitiative.org To subscribe or unsubscribe via the World Wide Web, visit https://kantarainitiative.org/mailman/listinfo/wg-uma or, via email, send a message with subject or body 'help' to wg-uma-request(a)kantarainitiative.org You can reach the person managing the list at wg-uma-owner(a)kantarainitiative.org When replying, please edit your Subject line so it is more specific than "Re: Contents of WG-UMA digest..." Today's Topics: 1. Agenda for UMA telecon 2021-02-25 (Alec Laws) 2. AEMS in less than 300 words (Igor Zboran) ---------------------------------------------------------------------- Message: 1 Date: Thu, 25 Feb 2021 08:38:15 -0500 From: Alec Laws <malcolm.laws(a)gmail.com> To: "wg-uma(a)kantarainitiative.org WG" <wg-uma(a)kantarainitiative.org> Subject: [WG-UMA] Agenda for UMA telecon 2021-02-25 Message-ID: <DD680E9B-5818-4335-AAC1-D970D34D4233(a)gmail.com> Content-Type: text/plain; charset="us-ascii" https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25 UMA telecon 2021-02-25 Date and Time Alternate-week Thursdays 10:00am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>, UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11>, UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> Pensions Dashboard, any updates UMA/Email proof-of-concept Profiles Discussion, relationship manager AOB - Alec

2 1

AEMS in less than 300 words
by Igor Zboran 25 Feb '21

25 Feb '21

Hi UMAnitarians, Please see the attached document. It is an excerpt from the upcoming draft-01. Regards -Igor

1 0

Agenda for UMA telecon 2021-02-25
by Alec Laws 25 Feb '21

25 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25 UMA telecon 2021-02-25 Date and Time Alternate-week Thursdays 10:00am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>, UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11>, UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> Pensions Dashboard, any updates UMA/Email proof-of-concept Profiles Discussion, relationship manager AOB - Alec

1 0

UMA/Email proof-of-concept
by Igor Zboran 23 Feb '21

23 Feb '21

Hi all, I’ve found that the topic of healthcare is quite popular among UMAnitarians. Although AEMS has been designed as a general or enterprise-oriented system, I think that it also meets the specific needs of the healthcare sector. To demonstrate the feasibility of the UMA/Email idea, I decided to build proof of concept. The full source code will be available in the public GitHub repository https://github.com/uma-email/poc. Any help welcomed. -Igor

2 6

Draft minutes of UMA telecon 2021-02-18
by Alec Laws 18 Feb '21

18 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18 Minutes Roll call Quorum was NOT reached. Approve minutes Approve minutes of UMA telecon 2021-02-04, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> Deferred LC Presentation Review Another Common Theme: interop theme, need standards based implementations of the protocol (UMA) + the ability to apply specific profiling/configuration choices example, how the RS would request a PAT (interactive/token push) custom/implementation specific interop of data formats needs for conformance of specific implementations (protocol,data) Should we rekindle the conformance suite/testing conversation? Could we start with conformance to a specific implementation profile and generalize afterwards? This reduces the scope of the testing, provides something concrete Reintroduce the relationship manager/policy manager/wallet profiles Discussed the 4 potential profiles Trusted claims is interesting in context to a public/private collaboration. Where data may need to move from public to private or vis-versa in known ways. There are challenges open public IDPS to private sector parties/use-cases. More public sector parties are creating identity/credential services. This also comes up in us health care as there is a need to exchange data between sectors, it's hard to agree on who's idp to trust. There is a lot of push back against using "social" provider (eg Google) to provide end-user (ex Patient) credentials. This is a big industry challenge. Where is the push back? The lack of identity proofing, or the security of the credential? Google spend WAYYY more to secure that credential that any single hospital/impl likely could. Seems like a partner education challenge to the benefits: user convenience, increased (delegated) security, no need to manage user passwords. As a (health acre) RP, they may end up need to support many many IDSP, this could push orgs the "other way" to centralize these features, if only for operational simplicity. Even if google is the CSP, each org that accepts it is building a new IDP and enriching the user account with local data/identifiers, useful to downstream providers. Are healthcare providers building their own Identity stacks? This should be strongly discouraged. Most health care systems seems to buy and install their own, instead of relying on external. Nancy & Alec's impl both federated authenticate and layer on identity proofing capabilities. The CSP does not have the right identifiers in every context, some proofing must be layered on. IDPS that come with proofing capabilities are beneficial, but can't meet all needs (eg to find/bind to a medical record number) There is a lot of public sector effort to define national trust framework: eg in UK https://www.gov.uk/government/publications/the-uk-digital-identity-and-attr… <https://www.gov.uk/government/publications/the-uk-digital-identity-and-attr…> The interop of IDPs is the main focus of the Kantara Identity Assurance WG <https://kantarainitiative.org/confluence/display/IAWG/WG+-+Identity+Assuran…>, which helps ensure the compatibility of different CSPs/IDPs against 800-63-3. If this topic interests, please checkout that WG! Pensions Dashboard, any updates Pensions Dashboard Program has released some documents as they build towards their procurement https://www.pensionsdashboardsprogramme.org.uk/2021/02/11/passing-pensions-… <https://www.pensionsdashboardsprogramme.org.uk/2021/02/11/passing-pensions-…> https://www.pensionsdashboardsprogramme.org.uk/2021/02/18/identity-call-for… <https://www.pensionsdashboardsprogramme.org.uk/2021/02/18/identity-call-for…> Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Sal Alec Michael Domenico Non-voting participants: Vlad Nancy Ian Scott Colin Tim George Regrets: Eve <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18>

1 0

UMA WG presentation during Leadership Council
by Alec Laws 17 Feb '21

17 Feb '21

Hi all, Please find the slides presented to all members during the Leadership Council call today attached The topic was: “New UMA profiles in progress, from industry back into the WG" Best, - Alec

1 0

Agenda for UMA telecon 2021-02-18
by Alec Laws 17 Feb '21

17 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> UMA telecon 2021-02-18 Date and Time Primary-week Thursdays 6:30am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>, UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> Reintroduce the relationship manager/policy manager/wallet profiles Pensions Dashboard, any updates AOB - Alec

1 0

[Participate: Weds Feb 17, 12 Eastern] 30min WG/DG Update - New in 2021!
by elizabeth＠kantarainitiative.org 11 Feb '21

11 Feb '21

Greetings, First, apologies in advance for cross posting. If you are participating in more than one Group, you will receive this more than once! You are invited to join the first 30minutes of the monthly Leadership Council call (typically the 3rd Wednesday for the month) to hear from WG/DG representatives on the current status of their work. We greatly look forward to your attendance, questions and comments. The meeting link is here: <https://www.google.com/url?q=https://global.gotomeeting.com/join/112012805& sa=D&source=calendar&ust=1613499348900000&usg=AOvVaw2GmED_8avxmfdX7QvULQ9B> https://global.gotomeeting.com/join/112012805 Full call-in details are shown at the end of this email. We are trying something new in conjunction with the Leadership Council calls. The first 30 minutes are open to all - we'll have a discussion leader inform us about an interesting topic relevant to your contributions at Kantara. This initiative is in response to your feedback last year asking for greater cross-working group sharing, for greater co-ordination and synergy. You are more than welcome to stay on to observe the proceedings of the LC call that follows straight after if you wish. We start this new initiative with the User Managed Access (UMA) WG Topic: New UMA profiles in progress, from industry back into the WG Speaker: Alec Laws, UMA WG Vice Chair, from IDENTOS Alec has been a software developer and solution architect his entire career. He's recently been interested in the many ways that technology can be used to solve real-world identity and privacy challenges. IDENTOS' products have embraced User Managed Access with a focus on allowing people to have greater control of their identity and health care data. The LC Agenda is below: . Roll Call . IPR announcement . Agenda Approval . Minutes Approval . Executive Director Update . Work/Discussion Group Updates . Work Group Administration: Federation Interoperability, FIRE + HIAWG . Identifier Registry Presentation - Tom Jones https://trustregistry.org/ . Discussion on Kantara's current IPR options and copyright notices. . Board of Directors Liaisons Update: Andrew Hughes, Ken Dagg . Upcoming Conferences: Identiverse, EIC 2021, Identity Week series, Connect:ID, Identity North Series, others . AOB .............................. Full call-in details: <https://www.google.com/url?q=https://global.gotomeeting.com/join/112012805& sa=D&source=calendar&ust=1613499348900000&usg=AOvVaw2GmED_8avxmfdX7QvULQ9B> https://global.gotomeeting.com/join/112012805You can also dial in using your phone. United States: +1 (646) 749-3129 Access Code: 112-012-805 More phone numbers Australia: +61 2 9087 3604 Austria: +43 7 2081 5427 Belgium: +32 28 93 7018 Canada: +1 (647) 497-9350 Denmark: +45 32 72 03 82 Finland: +358 923 17 0568 France: +33 170 950 594 Germany: +49 692 5736 7317 Ireland: +353 15 360 728 Italy: +39 0 247 92 13 01 Netherlands: +31 207 941 377 New Zealand: +64 9 280 6302 Norway: +47 21 93 37 51 Spain: +34 932 75 2004 Sweden: +46 853 527 827 Switzerland: +41 225 4599 78 United Kingdom: +44 20 3713 5028 Kind regards, The Kantara Staff Team <https://kantarainitiative.org/> <https://signup.e2ma.net/signup/1889513/1769625/> Receive Kantara News & Updates <https://kantarainitiative.org/about/10th-anniversary/> Kantara Initiative, <https://edufoundation.kantarainitiative.org/> Kantara Educational Foundation & <https://kantarainitiative.eu/> Kantara Europe

1 0

Draft Minutes of UMA telecon 2021-02-11
by Alec Laws 11 Feb '21

11 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11 Minutes Roll call Quorum was NOT reached. Approve minutes Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04> Connect.ID 2021 Call for Speakers (Oct 5-6) https://www.terrapinn.com/exhibition/connect-id <https://www.terrapinn.com/exhibition/connect-id/?utm_source=pardot&utm_medi…> Please make sure to submit your application before 26th February: https://www.terrapinn.com/exhibition/connect-id/apply-to-speak.stm <https://www.terrapinn.com/exhibition/connect-id/apply-to-speak.stm> Other upcoming identity/security conference (checkout https://kantarainitiative.org/events/ <https://kantarainitiative.org/events/>): Identity Week Asia Identity Week UK PDP Update PD Program has sent across some proposed license changes. Currently in-review by Kantara AEMS Update There has been some work towards an POC here: https://github.com/uma-email/poc <https://github.com/uma-email/poc> Check it out and get involved! UMA WG Presentation to All-Members 1200-1230 EST Next Wednesday Feb Topic: Industry UMA profiles bring new work to our group Alec will share the slides with the list ahead of this session sat/sun/monday UMA and FAPI discussion con't There has been some reach out to FAPI around our interest in exploring this in the WG. If anyone is interested in leading this item please reach out to Alec or the mailing list. Other profiles next steps What's inside the Wallet? Wallet as an RS? AS? With information (identity + other credentials) stored at the Wallet, does it become an RS for me? With the Wallet, the 'subject' is in the data-flow, more OIDC like. An RS supports more 'delegation' or other requesting parties. Wallet may 'push' to endpoint more than allowing a RP to 'pull' data, specifically a mobile device is hard to be setup as an 'endpoint'. How would push work? RP needs new information, calls an authorization endpoint. The AS routes to the smartphone (how? must be through some web service). The wallet receives a token to hit the RP API with the requested information. One angle is that if the Wallet is an RS, to a client there is no difference. The RP receives a token and can redeem it for the requested information. In the PD profile the dashboard is a normal UMA client. Maybe the 'Wallet' profile can be positioned similarly, where the API being requested is the 'policy api' hosted by the AS. The policy api would expose the registered resources and the associated policies. In the current profile, the RO would need to return to the AS to modify policy (eg invite a new advisor), or see pending requests to their pensions from an advisor. Another interesting overlap between the wallet profile + PD profile is the need to discover RS's that may not have UX or a user credential. Topic for next week, re-introduce wallet/resource manager profiles with the additional pensions dashboard use-case as context. Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Peter Alec Michael Non-voting participants: Ian Colin Regrets: Sal Andi Eve

1 0