March 2021 - WG-UMA - mailman.kantarainitiative.org

Agenda for UMA telecon 2021-04-01
by Alec Laws 31 Mar '21

31 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01 UMA telecon 2021-04-01Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> - Pensions Dashboard updates - Profiles Discussion, relationship manager draft - AOB

1 0

Draft minutes of UMA telecon 2021-03-25
by Alec Laws 29 Mar '21

29 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> Deferred Pensions Dashboard All sorted, waiting for final review & confirmation of final licenses ONC Annual Meeting, Virtual Booth https://www.healthit.gov/news/events/2021-onc-annual-meeting March 29-30 Authorization Code Grant https://groups.google.com/g/kantara-initiative-uma-wg/c/OHYcZe8l8Vs Initial Thoughts/questions: - Seems strange to get emailed a callback url, would the RqP have to open that link in the same browser? - Mixing the purpose of UMA with authentication? - Where is the response to request 2? that's a 302 to the AS - Seems to have some relationship with the OAuth device code flow to perform some out-of-band authorization of a user-agent? Similar to the CIBA discussion, more in scope as CIBA was RO authn, while this is RqP authN - Does the link need to be RqP specific? No because the token request includes bob's email as a pushed claim Assume these pre-reqs: - Alice has shared a link with Bob - Alice has setup her AS to anyone who can demonstrate control of bob(a)email.com Nice feature: - The AS can authenticate the email without a direct integration to that email provider as an issuer(IDP or for claims pushing) Suggested Changes: - RqPClient does RPT less request to RS to get the ticket - Line 2 is a uma token request with a 'request_submitted' response - 3, 4, 5 should be 'out of scope' - 6 is a uma token request that 'work', returns a token Profiles Discussion, relationship manager draft ???: Can one resource be protected by two Authorization Servers? ???: Can one resource be registered multiple times as the SAME AS? Not prevented by UMA Fedz, are there any use-cases for this? Yes, nothing prevents this THere is discussion of some of these topic here: https://kantarainitiative.org/confluence/display/uma/UMA+Implementer's+Guide#UMAImplementer'sGuide-perm-request-patternsConsiderationsRegardingResourceServerPermissionRequests <https://kantarainitiative.org/confluence/display/uma/UMA+Implementer> Should we provide additional guidance on this topic? There is also no restriction for the RS to have only 1 URI for a resource. THere was some previous discussion around wild-card in resource path, other templating - How does Alice know the URL of the resource? Collapse source UMA Resource Server Management This document extends [UMA Fedz] in order to specify the interface provided by the RS to the RO for resource management. This is achieved by introducing a Resource Management API which is used by a Resource Manager Client to view available resources and direct the AS to use for protection. ** This API could also allows the RO to - view access history - set direct policy (ie Adrian clause) - establish credentials required in AS, (smarthealth.card) Reqs: - THe RO must authenticate to the RS, in order to authorize access to this API - (this capability of the RS is implied by UMA) - The RO can see a list of resources available at this RS (either protected or not) - The RO can modify the protection of resources (ie which AS to protect) - The RO can see AS's available for protection - can the RO direct the RS to get a PAT from a new AS? This is tricky depending on how PAT's are issued (ie may require end-user redirection) Possible API Names: - resource management - resource declaration - available resources - resource access management (RAM) This document introduces the following new concepts: - Resource Management API The API presented by the RS to the Resource Manager. This API is OAuth protected - Resource Management Token (RMT) (what scope should this Access Token capture?) "uma_management" ### 1.3 HTTP Usage, API Security, and Identity Context - add link between RM API and RM Token informative The use of the `uma_management` scope when requesting a RMT may indicate to the RS's authorization server that establishment of one or more PATs with an available UMA AS is 'useful' RM -> RS: /authorize?scope=uma_protection Alice <-> RS: authenticate RS -> RS: are there any PATs available PATs for Alice? RS --> Alice: 'do you want to setup an UMA AS?' Alice -> RS: yes@ uma.as.location RS --> Alice: 302 uma.as.location/authorize The `Resource Management API` allows the Resource Owner to: - View the available resources hosted at this RS, and their current protection - View the UMA Authorization Servers available to be used to protect - Manage the UMA protection of available resources Starting Conditions: - The RS hosts resources for the RO - The RS supports resource protection from an UMA AS - The RS has a UMA PAT at one or more UMA ASs (try to bring this into the profile, not as a starting condition) Step 0 The Resource Manager obtains an OAuth Access Token valid for use at the Resource API. The Access Token must allow the RS to determine the RO's resources. - is there a purpose for NOT the RO to use this interface? Is this 'delegation' too early in Step 1 (Get Info) The RM obtains a list of UMA AS's available for resource protection, and a list of available resources Step 2 (Update Protection) The RM directs the RS to modify the resource protection either - putting an unprotected resource under protection at a specific AS, possibly only registering specific scopes - removing the protection of a resource at an AS. The RS will no longer honor RPTs for this resource from that AS - modify the protection of a resource, such as to add or remove scopes ## Available Resources Endpoint The API available at the available resources endpoint enables the resource manager to have knowledge of the resources hosted by the resource server for the resource owner. \_rs_id is a resource server defined identifier for a resource. Before a resource is registered at an AS, there is no handle/reference available (unless the RS provides one) GET /my-resources/ ``` [ { "_resource_id" "ABC", "resource_scopes":[ "view", "http://photoz.example.com/dev/scopes/print" ], "description":"Collection of digital photographs", "icon_uri":"http://www.example.com/icons/flower.png", "name":"Photo Album", "type":"http://www.example.com/rsrcs/photoalbum", // uri/location of the resource? protected_at: (optional) [ { // (_id in UMA Fedz) // does the RMT need to know this value? yes since this resource can be registered multiple times at an AS "authorization_sever_resource_registration_id" : "_as_issued_id_for_resource_ABC" "authorization_server" : "as_identifier", "registered_scopes" : [ "view" ], "user_access_policy_uri" : url (optional) } ] }, ] ``` Protected Resources ``` [ { "_resource_id" "ABC", "authorization_sever_resource_id" : "_as_id" "authorization_server" : "as_identifier", "registered_scopes" : [ "view" ] }, { "_resource_id" "ABC", "authorization_sever_resource_id" : "_as_id_2" "authorization_server" : "as_identifier_2", "registered_scopes" : [ "view", " http://photoz.example.com/dev/scopes/print" ] } ] ``` /authorization-servers/:id/resources ``` [ { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id" "registered_scopes" : [ "view" ] }, { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id_2" "registered_scopes" : [ "view", " http://photoz.example.com/dev/scopes/print" ] } ] ``` In dashboard world, rs_id = PeI (pension identifier) - to confirm, is the PeI the same as the as_id? ie is it created by the RS or the AS RS_1 holds pension A with identifier a RS_1 registers pension A single person, single resource, single rs: can have multiple resource registration, eg with different scopes Resource = Patient Registered Resource 1: Just the Patient Object Registered Resource 2: The Patient + Sub Objects ### Available Resource Description A registered resource is a JSON document that extends the resource description from [UMA Fedz 3.1 Resource Description](1) with the following parameters: authorization_server OPTIONAL A string identifying the authorization server that protects this resource ** could also be the AS policy uri from resource registration? (1 https:// docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0.html#re… ) #### List Available Resource Descriptions #### Update Available Resources Description ## Authorization Server Endpoint The API available at the authorization server endpoint enables the resource manager to view and manage the authorization servers available for resource protection. The resource owner may allow resource protection only through the set of available authorization servers. ***note***: a challenge here is that it's quite difficult for this interface to create a relationship between an AS/RS because how the PAT is issued (ie could be interactive) Currently this is a 'dynamic' API since it conveys information to Alice about whether a specific AS is available for use in other protection APIs (ie is there an active/historical PAT for this AS). If this is static, Alice won't know if she can use that AS for protection THe list of AS's may also be specific to the RO. Bob may have registered AS1, while Alice uses AS2 ### Authorization Server Description #### List Authorization Server Description GET /my-authorization-servers/ ``` [ { as_url: "http://authserver_id.ca" has_as_pat: true }, { as_url: "http://authserver_id2.com" has_as_pat: false } ] ``` POST /my-as/:one/resource ``` { _rs_resource_id: scopes: [] } ``` vs POST /my-resource/:abc/authorization-server ``` { _as_id: scopes: [] } ``` AOBAttendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Eve 2. Peter 3. Michael 4. Alec Non-voting participants: 1. Nancy 2. Colin 3. Scott 4. Ian 5. Tim Regrets:

2 1

Agenda for UMA telecon 2021-03-25
by Alec Laws 25 Mar '21

25 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25 UMA telecon 2021-03-25Date and Time - *Primary-week Thursdays 10:00am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> - ONC Annual Meeting, Virtual Booth Update - Authorization Code Grant - Pensions Dashboard, any updates - AOB - Alec

1 0

UMA Authorization Code Grant – General-Purpose
by Igor Zboran 24 Mar '21

24 Mar '21

Hi all, this is not related to AEMS and it should work in general. [image: image.png] -Igor

1 0

UMA Authorization Code Grant
by Igor Zboran 23 Mar '21

23 Mar '21

Hi all, The UMA Authorization Code Grant defines a mechanism for user-to-user (sender-to-recipient) delegation of access. Figure 1 provides the schematic flow for the UMA Authorization Code Grant by which the sender (Resource Owner) delegates the Requesting Party Client to access the sender's resources on behalf of the recipient. [image: image.png] Figure 1. Regards -Igor

2 3

Draft Minutes of UMA telecon 2021-03-18
by Alec Laws 18 Mar '21

18 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18 MinutesRoll call Quorum was reached. Approve minutes - Approve minutes of UMA telecon 2021-02-04, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> , UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> , UMA telecon 2021-02-25, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25>UMA telecon 2021-03-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-04> , <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25>UMA telecon 2021-03-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-11> Eve Moves to approve, Andi seconds. Motion Passes! ONC Annual Meeting, UMA Content For a Virtual Booth https://www.healthit.gov/news/events/2021-onc-annual-meeting March 29-30 Deadline for content submitted is Mar 24 Pensions Dashboard, any updates Have an agreed path and licenses Profiles Discussion, relationship manager draft UMA Resource Server Management This document extends [UMA Fedz] in order to specify the interface provided by the RS to the RO for resource management. This is achieved by introducing a Resource Management API which is used by a Resource Manager Client to view available resources and direct the AS to use for protection. ** This API could also allows the RO to - view access history - set direct policy (ie Adrian clause) - establish credentials required in AS, (smarthealth.card) Reqs: - THe RO must authenticate to the RS, in order to authorize access to this API - (this capability of the RS is implied by UMA) - The RO can see a list of resources available at this RS (either protected or not) - The RO can modify the protection of resources (ie which AS to protect) - The RO can see AS's available for protection - can the RO direct the RS to get a PAT from a new AS? This is tricky depending on how PAT's are issued (ie may require end-user redirection) Names: - resource management - resource declaration - available resources - resource access management (RAM) This document introduces the following new concepts: - Resource Management API The API presented by the RS to the Resource Manager. This API is OAuth protected - Resource Management Token (what scope should this Access Token capture?) "uma_management" ### 1.3 HTTP Usage, API Security, and Identity Context - add link between RM API and RM Token The `Resource Management API` allows the Resource Owner to: - View the available resources hosted at this RS, and their current protection - View the UMA Authorization Servers available to be used to protect - Manage the UMA protection of available resources Starting Conditions: - The RS hosts resources for the RO - The RS supports resource protection from an UMA AS - The RS has a UMA PAT at one or more UMA ASs (try to bring this into the profile, not as a starting condition) Step 0 The Resource Manager obtains an OAuth Access Token valid for use at the Resource API. The Access Token must allow the RS to determine the RO's resources. - is there a purpose for NOT the RO to use this interface? Is this 'delegation' too early in Step 1 (Get Info) The RM obtains a list of UMA AS's available for resource protection, and a list of available resources Step 2 (Update Protection) The RM directs the RS to modify the resource protection either - putting an unprotected resource under protection at a specific AS, possibly only registering specific scopes - removing the protection of a resource at an AS. The RS will no longer honor RPTs for this resource from that AS - modify the protection of a resource, such as to add or remove scopes ## Available Resources Endpoint The API available at the available resources endpoint enables the resource manager to have knowledge of the resources hosted by the resource server for the resource owner. ``` [ { "_rs_id" "ABC", "resource_scopes":[ "view", "http://photoz.example.com/dev/scopes/print" ], "description":"Collection of digital photographs", "icon_uri":"http://www.example.com/icons/flower.png", "name":"Photo Album", "type":"http://www.example.com/rsrcs/photoalbum", }, ] ``` Protected Resources ``` [ { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id" "authorization_server" : "as_identifier", "registered_scopes" : [ "view" ] }, { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id_2" "authorization_server" : "as_identifier_2", "registered_scopes" : [ "view", " http://photoz.example.com/dev/scopes/print" ] } ] ``` /authorization-servers/:id/resources ``` [ { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id" "registered_scopes" : [ "view" ] }, { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id_2" "registered_scopes" : [ "view", " http://photoz.example.com/dev/scopes/print" ] } ] ``` In dashboard world, rs_id = PeI (pension identifier) - to confirm, is the PeI the same as the as_id? ie is it created by the RS or the AS single person, single resource, single rs: can have multiple resource registration, eg with different scopes Resource = Patient Registered Resource 1: Just the Patient Object Registered Resource 2: The Patient + Sub Objects ### Available Resource Description A registered resource is a JSON document that extends the resource description from [UMA Fedz 3.1 Resource Description](1) with the following parameters: authorization_server OPTIONAL A string identifying the authorization server that protects this resource ** could also be the AS policy uri from resource registration? (1 https:// docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0.html#re… ) #### List Available Resource Descriptions #### Update Available Resources Description ## Authorization Server Endpoint The API available at the authorization server endpoint enables the resource manager to view and manage the authorization servers available for resource protection. The resource owner may allow resource protection only through the set of available authorization servers. ***note***: a challenge here is that it's quite difficult for this interface to create a relationship between an AS/RS because how the PAT is issued (ie could be interactive) Currently this is a 'dynamic' API since it conveys information to Alice about whether a specific AS is available for use in other protection APIs (ie is there an active/historical PAT for this AS). If this is static, Alice won't know if she can use that AS for protection THe list of AS's may also be specific to the RO. Bob may have registered AS1, while Alice uses AS2 ### Authorization Server Description #### List Authorization Server Description ``` [ { as_url: "http://authserver_id.ca" has_as_pat: true }, { as_url: "http://authserver_id2.com" has_as_pat: false } ] ``` Cheers, - Alec

1 0

Agenda for UMA telecon 2021-03-18
by Alec Laws 17 Mar '21

17 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18 Head's up that we are in the 'summertime skew' period where we have already started daylight savings time in NA and it hasn't started everywhere. Please double check your calendars :) Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04> , UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> , UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> , UMA telecon 2021-02-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25> , UMA telecon 2021-03-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-04> , UMA telecon 2021-03-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-11> - ONC Annual Meeting, Virtual Booth Update - Profiles Discussion, relationship manager draft - Pensions Dashboard, any updates - AOB Best, - Alec

1 0

Draft minutes of UMA telecon 2021-03-11
by Alec Laws 11 Mar '21

11 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-11 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-02-04, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> , UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> , UMA telecon 2021-02-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25> Deferred ONC Annual Meeting, UMA Content For a Virtual Booth https://www.healthit.gov/news/events/2021-onc-annual-meeting March 29-30 Need to be available at the Booth for the duration of the day (8-5?), can have an "afk" video. Same content platform at dev days, videos+pdf uploads. Colin/Nancy/Alec will cover the booth. *If you're available to help, please reach out!* Planning to repurpose + modify the first half of the UMA in healthcare webinar <https://kantarainitiative.org/download/uma-21st-century-health-information-…> from summary 2020. Will layer on Kantara in general content (existing + new working groups) + specific ONC value alignment Want to showcase highlight UMA + Identity + Consent Receipt(?). A main Kantara Intro: https://youtu.be/iVyP95_OyCM If you have a demo relevant to health care and want it included, please reach out! Airside may have a relevant demo for healthcare to add. Forgerock has a FHIR + UMA demo to add. Patient Centric Solutions has an identity + UMA demo with ID.me, can show off the transparency (granularity) of sharing. Identos case study will cover their project for Identity + UMA in Ontario. Nancy/Alec will be meeting again next Tuesday at 10AM EDT to iterate on the content, please reach out if you'd like to join in Health care can become confused by the range of identity and authorization offerings. Need to show a clear message about how it works together toward a 'wide' ecosystem to bring these disparate approaches together. UMA can support many types of granularity, by resource but also by sensitivity. The data model is all there with FHIR and UMA can easily apply 'arbitrary' authorization slices over it. Pensions Dashboard, any updates Agreements to reference UMA and link to a Kantara hosted (but not UMA WG) hosted page with the profiles and design documents. Finding the right balance between making it open to serve the procurement needs and properly protect everyone Profiles Discussion, relationship manager Continue discussion on how an RS can get a PAT issued, given that the RO is interacting through a API (not directly at the RS). In the PDP profile, the relationship manger API would be used directly from the AS (co-located with the AS), however this isn't the same in the IDENTOS implementation. RS API needs oauth protection, so the Relationship manager has a valid token directed to the RS Relationship manager API. This is NOT the PAT, since it's aud is the RS not the AS. The relationship manager API is derivative of the Resource Registration API, however it's the available vs already registered resources. GET /authorization_servers → list of registered authorization servers. This is easiest way to avoid the topic... assumes that Alice has previously interacted with the RS to have PATs available. If there is no way for Alice to directly interact with the RS this falls apart. Identos currently avoids by having static RS→AS registration and an RS=RO model for PAT issuance, but don't like this. It's organization custodial model vs the *real* RO who is Alice. Need to separate the resource rights administrator from the actual data subject (RO), in this case it's still not the RS=RO, it's RRA=RO. There are *many* RRA's in the model, the RO is a RRA, the RO can delegate some capabilities to another RRA, the RS may apply policy as an RRA during policy setting or resource disclosure. This layered RRA model get's complicated fast, although it's pervasive in normal B2B2C cases (data subject, controller, processor). All the entities in the system perform AS, RS and sometime RRA functions at different times Summertime Skew Head's up to our non-North American members! Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Peter 2. Eve 3. Alec Non-voting participants: 1. Tim 2. Colin 3. Nancy Regrets: 1. Ian 2. Ken

1 0

Agenda for UMA telecon 2021-03-11
by Alec Laws 11 Mar '21

11 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-11 UMA telecon 2021-03-11Date and Time - *Alternate-week Thursdays 10:00am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04> , UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> , UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> , UMA telecon 2021-02-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25> , UMA telecon 2021-03-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-04> - ONC Annual Meeting, Virtual Booth Update - Pensions Dashboard, any updates - Profiles Discussion, relationship manager - AOB Cheers, - Alec

1 0

Draft minutes of UMA telecon 2021-03-04
by Alec Laws 04 Mar '21

04 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-04 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-02-04, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> , UMA telecon 2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> , UMA telecon 2021-02-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-25> Deferred ONC Annual Meeting, UMA Content For a Virtual Booth https://www.healthit.gov/news/events/2021-onc-annual-meeting (free registration for attendees) March 29-30. If you're interesting in helping at the booth or there's any UMA content that you'd like shown related to healthcare use-cases, please reach out to Alec Not clear exactly how the booth works at this time, eg what content we can upload or when we need to be 'available'. Maybe a very short demo (5mins) would works well, advertise as a reason to visit the booth. Pensions Dashboard, any updates Very close, all good news. Have a path forward to address any IPR/license concerns. General question, would Kantara be on the hook for any vulnerabilities caused by profiling or implementations? In dashboard use-case, risk is a Bad user can see Alice's pensions data. Aside from the 'risk profile' of the use-case, the protocol was what is being 'relied' on to secure the resources. However, the protocol creator can't(?) be liable and our license should protect Kantara and the UMA WG(?). The responsible party is the operator or implementor. The protocol can't cover all use cases, and this why best practices and implementers guides are provided in addition to the core specs. The current licensing conversation is about confirming that Kantara and/or Origo can't prevent the open use of UMA and the specific profile by the implementors in the Dashboard Program. Kantara need to balance that need with our needs to protect ourselves from the above. There are specific objections to the RAND policy. Should UMA consider changing its IPR? Quite difficult to do for an open group given all the previous contributions. There has been some 'transfer' of ownership between Kantara WGs with different IPR policies (RAND → NAC(?)). Had to get all the contributors to the original WG to agree to this. Is there something Kantara can do to better support this program (and hopefully all the new UMA WG members)? For example, revive the UMA test-suite conversations? Part of the challenge with the UMA test suite is how broad the cases are, maybe a test suite around this specific profile reduces that scope to get this off the ground. There is a demo AS that implements a proof of concept of the pensions dashboard (~2018), any further assistance that could be offered to the PDP would need to be based on the new iteration of the profile. However, this would be a first step to build a PDP RS conformance suite? .Our test suites should have specific 'modes' for the different profiles (HEART, PDP) UMA/Email proof-of-concept https://github.com/uma-email/poc Igor was able to respond to some of our questions from last week: https://kantarainitiative.org/pipermail/wg-uma/2021-March/006124.html Profiles Discussion, relationship manager Is there any purpose for a single RS to be protected by many ASs? For different RO's: yes. Is there any purpose for a single RS to be protected by many ASs for a single Resource Owner? These use-cases are more 'theoretical', and there is no limitation in the core UMA design. Maybe the RS would only support specific AS's for certain resources (eg high sensitivity) How would a RS get a RO specific PAT in this mode? RS must be a client of the AS. PAT protects an 'offline' API, so there is preference to a long-lived token to reduce the frequency that Alice must re-establish the relationship. The more AS's a RS is registered at for Alice, the more she'll have to re-establish the PAT. PFS@AS → RS: AT, access token with demographics (JWT) Is this a discovery mechanism at the RS? RS → AS: POST /token body = AT AS --> RS: PAT So in this use case, the AS "tells' the RS to get a PAT. Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Alec 2. Eve 3. Michael 4. Domenico Non-voting participants: 1. Nancy 2. Scott 3. Tim 4. Ian 5. Colin

1 0