July 2021 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2021-07-29
by Alec Laws 29 Jul '21

29 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-29 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> , UMA telecon 2021-07-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08> , UMA telecon 2021-07-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-15> , UMA telecon 2021-07-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-22> Deferred Relationship Manager - user stories 1. As an ASO, I want to allow Alice to bring a resource management UX, in order to not provide this myself 1. Today, the AS must provide some interface for Alice to see her registered resources (uri) and the policy for each resource→RqP. Core UMA has some implication that Alice can 'bring her own AS' 2. As discussed last time, Alice may need to work with many AS's, and sometimes that is out of her control 3. A challenge may be that Alice needs to authenticate uniquely to each AS? Alice will authenticate at an IDP, and there can be federation 4. IN RM draft 1. Instead of Alice managing resources in several AS UXs, she can use her single RM to manage her resources. In some cases, the existence of multiple ASs can be hidden from her 2. The concept of the PAT is changed, such that a PAT represents the entire RS (all ROs) and the resource negotiate between the RS and AS are the types, not specific resources 1. There's not necessarily a RO specific PAT, as the RS's API may not support user context in the path, even if it does there is a challenge around getting RO specific uris to the RqP 2. ex an RS api `/me/profile` the RS get's a ticket that represents that type of resource, and during claims gathering the AS is able to determine the specific profile to return to the client. The RS learns the specific profile either by inspecting the RPT or through introspection 3. Some initial goals of RM were to make a 'zero knowledge' AS. An AS that doesn't need to see end-user identity claims. Identity federation happens to the RM, the RM then registers RqP policy against RS→RM resource ids. The AS is only learning resource ids, and conveying to the RS during specific transaction. The RS is responsible to resolve the resource id to the right RO information 4. As there are more RS specified AS's, there are also new needs for federation or mutual trust between those ASs to get back to widest possible ecosystems. This is OOS of RM but could be achieved through other governance registries or discovery services 2. As Alice, I want a way to grant Bob access to my resources without knowing the URLs, in order to a) not deal with URLs b) share more complex resources (ex not a PDF, a health record) 1. Today, all of Alices resources are registered with the AS independently, however this doesn't include any specific URI. Therefore she needs to get URIs for the RS, and somehow know which registered resource id corresponds to what URI(s). How does Alice know what at the AS means what URI to the RS? 2. In some reference impls, the RS creates a new URI that is directly linked to the registered resource. 3. rsurl.com/alice/A.pdf, rsurl.com/alice/B.pdf, rsurl.com/alice/C.pdf → registered at the AS → (type:pdf, scope) x3 → (randomid1, randomid2, randomid3). 1. the RS keeps track of relationship from public uri and internal AS registered id. The RS writes RqP policy to the AS against the randomidN. 2. This RS performs on RM behaviour instead of making Alice interact with the AS at all 4. there are also challenges exposing URIs AT ALL to Alice and Bob, if the URI includes any PI all parties can see it, even if they're not authorized. Best Practice: NO URIs are human readable 5. Today this is somewhat addressed as URIs don't leave 'digital space' we share them through copy/paste, not through analogue means 6. There are more challenge with URI sharing when the number of resource is very large or are dynamically create (such as FHIR observations created by a device) 7. Another FHIR complication is querying by time frame... 1. some ways to address through 'shortcut' scopes like 'last_three_month', 'not_before=<timestamp>' 2. This is better addressed by Rich Authorization Request. There are still challenges with UMA async, Alice can't consider all possible authorization requests ahead of time. Alice is smart but she can't see the future. 3. As Bob(RqP), I want to be able to discover resources available/shared with me, in order to not need URLs sent by Alice 4. As a Client, I want to be able to declare types I understand, in order to successfully use complex APIs 5. As an RS, I want to defer permission ticket creation, in order to a) not have to understand the Client b) not make authZ decisions (tell me don’t make me think) 6. As an ASO, I want to pre-register Clients, in order to assess their appropriateness, capability and complete non-technical activities 7. As a Client, I want to pre-register with ASs, in order to a) test my UX and technical integrations b) declare my capabilities AOB Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) Voting: 1. Alec 2. Eve Non-voting participants: 1. Scott 2. Zhen Regrets: 1. Steve <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-29>

1 0

Agenda for UMA telecon 2021-07-29
by Alec Laws 29 Jul '21

29 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-29 UMA telecon 2021-07-29Date and Time - *Alternate-week Thursdays 10:00am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> , UMA telecon 2021-07-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08> , UMA telecon 2021-07-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-15> , UMA telecon 2021-07-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-22> - Relationship Manager - user stories - AOB

1 0

Draft Minutes of UMA telecon 2021-07-22
by Alec Laws 22 Jul '21

22 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-22 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> , UMA telecon 2021-07-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08> , UMA telecon 2021-07-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-15> Deferred Relationship Manager - user stories Challenges: - *Alice must know the RS exists* - *The RS may not be able to trust ANY AS* - The RS MUST provide UX for the user to receive URLs - The AS MUST provide UX to establish policy - Alice must collect and share resource URLs with Bob - The Client must understand the type of the resource at the URL - The RS must determine the acceptable scope for the client from a URL - The AS may not be able to trust ANY Client Which motive these stories: Alice=RO, Bob=RqP, RM=Relationship Manager, RSO=Resource Server Operator, ASO=authorization server owner Medical Records has a complex joint-custodian/owner situation. Alice is the subject of the record, however the RS has a responsibility to protect the records. Today all EMRs do typically have authorization setup for internal (ie staff) access to information. A separate UMA AS could be used to manage patient access to their records to other consumer health applications. This AS can be trusted by more than one EMR so that the health apps dont' have to integrate with each EMR (and vice versa). What does this mean for Bob, Hosp 1 trust ASa and ASb, and Hosp 2 trusts ASb, ASc. Bob needs to understand which AS's can facilitate his access to which Hospitals, and therefore may use different ASs. 1. As Alice(RO), I need a way to discover available RSs, in order to learn about resources I own 1. Today in UMA, it 'assumed' that Alice i) knows of the RS, and the the RS can expose ii) those URLs to Alice in some way 2. Is this analogous to the web without search engines? you have to know explicit links to all your documents 3. There are two challenges, Knowing custodian of resources and knowing the specific locations of those resources 4. In the RM draft, 1. it assumes that Alice knows the custodian. However the list of custodians are registered either at the AS or with a different registry (discovery information for RM, can facilitate Dynamic Client Registration, eg RS trusts AS, so RS trusts RM) the relationship manager can also be a conformance profile manager for the RS 2. the custodian tells Alice the specific urls of her resources through the API 2. As an RSO, I need to trust a limited set of compliant ASs, in order to meet my obligations to protect resources 1. Today, An RS is meant to trust any AS brought forward by a RO (ByoAS) over that RO's resources 2. For a 'regulated' RS/custodian, it can't delegate authorization to ANY AS.. The RS may have 1 AS that allows edit scopes, while it may be more open to patient read 3. In the RM draft 1. The RS doens't need to register every specific resource with an AS, the specific resource information is conveyed to the RM and then to the AS. Instead the RS has a more general trust in the AS "I trust you to issue access tokens at all". 2. There are two bits of an RS given our a resource i) the access token was issued by an AS it trusts ii) the access token conveys information that was given the to the RM (the return trip to the RS includes proof from the RO) (ALEC MAKE A PICTURE) 3. As Alice, I need a way to work with many ASs, in order to use ones required by my RSs 1. Today in UMA, Alice works with her AS and brings it to each RS that holds her resources. In a world where the RS restricts or sets the available ASs, Alice has a greater need to work with more than one AS. If Alice does work with multiple ASs, it's implied that each AS offers it own UX/authentication, this is not ideal for Alice. 2. In the RM draft, 1. a RM has an API with the AS, and can work with multiple ASs by design 2. The RM is the RO nexus between RSs and ASs, which the AS is the nexus between RSs and RPs (ALEC MAKE A PICTURE) 4. As an RSO, I want to allow Alice to bring a resource management UX, in order to not provide this myself 1. Today, the RS must provide some interface for Alice to see her available resources (uri) and which resource is registered at each AS 2. We're talking about the UXO=user experience owner 3. this might be a good place to put into use the blinding identity taxonomy https://docs.kantarainitiative.org/Blinding-Identity-Taxonomy-Report-Versio… in relationship manager... it could check to see if these are necessary and if possibly blinded.. 4. In the RM, 1. *Alice has a single place to manage all her resource i) see all available resources across all RS ii) see all registered resources at which ASs iii) manage policy of those registered resources at each AS* 5. As an ASO, I want to allow Alice to bring a resource management UX, in order to not provide this myself 1. Today, the AS must provide some interface for Alice to see her registered resources (uri) and the policy for each resource->RqP 6. As Alice, I want a way to grant Bob access to my resources without knowing the URLs, in order to a) not deal with URLs b) share more complex resources (ex not a PDF, a health record) 7. As Bob(RqP), I want to be able to discover resources available/shared with me, in order to not need URLs sent by Alice 8. As a Client, I want to be able to declare types I understand, in order to successfully use complex APIs 9. As an RS, I want to defer permission ticket creation, in order to a) not have to understand the Client b) not make authZ decisions (tell me don’t make me think) 10. As an ASO, I want to pre-register Clients, in order to assess their appropriateness, capability and complete non-technical activities 11. As a Client, I want to pre-register with ASs, in order to a) test my UX and technical integrations b) declare my capabilities AOB Sal touched up the ANCR notes from last week UMA telecon 2021-07-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-15> Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) Voting: 1. Steve 2. Alec 3. Sal 4. Andi Non-voting participants: 1. Kay 2. Scott Regrets:

1 0

Agenda for UMA telecon 2021-07-22
by Alec Laws 21 Jul '21

21 Jul '21

1 0

Draft Minutes of UMA telecon 2021-07-15
by Alec Laws 16 Jul '21

16 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-15 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> , UMA telecon 2021-07-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08> Deferred ANCR/UMA initial understanding https://groups.google.com/g/kantara-initiative-uma-wg/c/EzbI7kjc_MU/m/NLX_0… Short flow 1. Alice visit's Bob's Organization(site/service) website 2. Bob returns a notice that references a third party registry 3. Alice is able to independently lookup Bob's notice from the registry 4. Alice requests a notarized receipt from the registry, including Bob's notice and her Rights (eg the law's of the country she lives in) 5. Alice includes this receipt in requests as she interacts with Bob's service 6. Bob is able to use the receipt token to interact with Alice's information, either in requests for authorization/information (eg as a token/claim) ANCR current state: documentation of the receipt: Bob's notice, Alice's rights assertion, the notarized ANCR receipt Next steps: Getting ANCR receipt fields to be part of the ISO 27560 consent receipt 1.2 spec, publish within Kantara. Move from receipt definition to flows/protocol integrations The receipt creates transparency for Alice to discover and understand the sites/services terms, controller, etc. Steps 1-5 would be part of a Browser/extension implementation and could be broadcasted through headers (for example). Alice could include in her notarized receipt where BOb's service could discover her information, eg her UMA Auth server or relevant resource locations. >From initial contact, Alice is able to monitor service term changes through the registry. The 'registry' doesn't necessarily need to be a 3rd party, the site itself could host this to achieve the transparency outcome. Self assertion like this can still reference third parties, who don't need to know about ANCR. For example in the UK there is a public business registry with the Controllers listed, the site itself can reference that endpoint. Can a service be registered with multiple registries? yes ANCR is having an off cycle meeting 1130(?) Monday. They usually meet Wednesday at 1030ET Advanced Notice and Consent Receipt: Advanced Notice & Consent Receipt - ANCR-WG <https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=14080…> Anyone attending HIMSS? IDENTOS will have some representation there (not Alec), presenting their TrustSphere project in BC Has Kantara ever provided funding support to attend/present posters/papers? Kantara is open for funding requests, if interested please reach out to Alec(or any WG chair) and they'll help with the request to the Leadership Council. Largely attendance have been self-funded Relationship Manager - user stories Review the Diagram: https://groups.google.com/g/kantara-initiative-uma-wg/c/WAnizgl08Fg/m/YjflL… Last week we got into the details and questions around discovery. It may not need to be part of the core UMA AS function, and could be a 3rd service specification (with some intersection to the ANCR registry concepts) Implementing the UMA spec is not enough, need to have use-cases to fill the gaps and details (and to 'get creative'). This has made interop challenging between implementations. There's a bunch of work around UMA that are required to show implementation. Maybe a simple interop profile around a use-case would allow us to show us working together. One example, who owns + stores the PAT. Communicating the handle (uri) from RO to RqP AOB Please welcome Kay Chopard as the new Kantara Executive Director! Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) Voting: 1. Steve 2. Alec 3. Sal Non-voting participants: 1. Zhen 2. Scott Regrets:

1 0

Agenda for UMA telecon 2021-07-15
by Alec Laws 15 Jul '21

15 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-15 UMA telecon 2021-07-15Date and Time - *Alternate-week Thursdays 10:00am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> , UMA telecon 2021-07-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08> - ANCR/UMA initial understanding - Relationship Manager - user stories - AOB Best, - Alec

1 0

Draft minutes of UMA telecon 2021-07-08
by Alec Laws 09 Jul '21

09 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> Deferred Relationship Manager - user stories Review the Diagram: https://groups.google.com/g/kantara-initiative-uma-wg/c/WAnizgl08Fg/m/YjflL… Discussion Recording (split into 4 parts) 2021-05-20 13.24 UMA Working Group Part 1.mp4 <https://kantarainitiative.org/confluence/download/attachments/147488962/202…> 2021-05-20 13.24 UMA Working Group Part 2.mp4 <https://kantarainitiative.org/confluence/download/attachments/147488962/202…> 2021-05-20 13.24 UMA Working Group Part 3.mp4 <https://kantarainitiative.org/confluence/download/attachments/147488962/202…> 2021-05-20 13.24 UMA Working Group Part 4.mp4 <https://kantarainitiative.org/confluence/download/attachments/147488962/202…> Here's a token and here's where to go: OIDC distributed claims. Existing mechanism to pair and endpoint with a token Want to be able to still share a URL and have flow work. This is a discovery mechanism, has many privacy implications, eg user understanding what the policy means. How does the user really know what will happen, do we need a notification mechnism to allow review ahead of the disclosure? We don't nessicarily want it to be a revocation after the data is shared. In this case the consent needs to be just in time, eg Alice is notified about the specific request based on the more general policy. This is back to the CIBA/liberty alliance interaction service, where the the AS can reach out to the RO. One the client side this is handled by the request_submitted token response. How would discovery be layed on top of the existing protocol (vs overload). Discovery creates AS-first (or discovery server-first) flows - exposing the UMA Fedz resource API to the client - two step process, the client/RqP are first identified to the AS, to get access to an AS hosted resource API - A discovery endpoint, the client goes there first and then gets a ticket to use with a token endpoint - who hosts discovery endpoint? can is cross AS's, it is discovery only for the UMA protected URL, where each URL can be independantly protected. - pass in the resource id (eg resource indicators) to the token endpoint with a PCT We are separating discovery from existing UMA flow/roles, it can be co-located with an AS or entire separate service, in future could be colocated with RM (Alice shares he RM url instead of specific URLS) In UMA, I pick an AS, all of my/Bob's services go through my AS to get authZ to my resources. Reality has shown there are likely 3/4 different ASs → this is one purpose of the RM, to be a layer that serves Alice directly. Comes down to where agreegation happens, and who knows about it, how this makes Alice's life easier to manage her distributed information. We are seperating the policy of discoverability from the authorization to access, they have different policy needs. If these are different, why allow discovery? Because Alice wants transparency and want to understand the different risks. Knowing that Alice takes landscape photos may be discovery, while access to specific photos may want to be controlled. This goes back to a general policy around discvoery (all photographers can discover) vs the specific RqP (only selected photographers can access specific photos, tiered access) Discoverability works well where there are a small amount of URLs, however in complicated APIS, there could be 100+. There can be expansion to 'wildcard' urls or types of resources vs the specific URI. RS first access lacks mechanisms for intent. The RS must extrapolate from a single request the scope of resources to includes in the permission ticket. Discovery allows client/RqP to speak to there intent, eg as a client I can understand only specific resource types, however the RS can't know this ahead of time. We want to match the granted resources to the intent/capability of the Client. Bob can show up and declare what privacy obligations he'll uphold, and leave the notarized receipt with the AS for Alice to follow up with eg Data Controller information. Rather than audit trail, the receipt is meant to be one-time signal that be compared over time and allows the identification of policy change. On all resource accesses the AS receives a new and comparable-to-previous receipt. I'm a health care system or photo sharing systems, the site needs to standalone. The could be cases where an RS is trying to add authz capabilities, this can be delegated to the UMA environment without major changes to the core RS. UMA needs to work for both scenarios. *The interesting questions always comes back to liability, if the AS is the authority and the RS releases the wrong data, the AS still needs to take the liability. *The RS is the data custodian, and they always have liabity/responsibility to the RO. If company A uses UMA as technology for RS/AS/RM/Discovery, then there is little liability question, it's all in the same place. Once the ecosystem is wider, where company A holds the data, and delegates authZ to an AS of company B, now the liability split is less clear. When PDP did the dashboard, there is an idea of consent boundaries. Anything happening at the RP on behalf of the RO, has a separate consent boundary, between teh client software and the RqP. The ANCR would allow Bob/Client to create the notice receipt to the discovery mechnism so that Alice is able to see what terms we're accepted. >From RqP perspective, access is based on presented claims, to meet Alice's policy. Bob wants to set his terms for sharing those claims with an AS(?) The policy within the AS is not-specified, the ANCR could be a profiled claim type for Alice/Bob to both understand the legal requirements/expectations for the claim handling. Purpose is to reduce the cognitive load on Alice/Bob to understand the terms, having a common vocabulary vs ad-hoc TOSs. As an RqP, I can define an ANCR receipt, in order to specific my requirements for claims handling. THis could be a claims presentation to the AS. There are two privacy rights that need to be balanced: Alice→arbitrary client vs Bob→arbitrary AS. In ANCR, there is a cyber rights notary, when Bob wants access he see's Alice's preestablished policy. AOB Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) Voting: 1. Thomas 2. Alec 3. Domenico 4. Sal Non-voting participants: 1. George 2. Ian Regrets: 1. Eve 2. Nancy <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08>

2 1

Agenda for UMA telecon 2021-07-08
by Alec Laws 07 Jul '21

07 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-08 UMA telecon 2021-07-08Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> , UMA telecon 2021-07-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01> - Relationship Manager - user stories - AOB We'll continue to review the stories/challenges from this email: https://groups.google.com/g/kantara-initiative-uma-wg/c/WAnizgl08Fg/m/YjflL… Cheers, - Alec

1 0

Draft minutes of UMA telecon 2021-07-01
by Alec Laws 01 Jul '21

01 Jul '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-07-01 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-06-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-10> , UMA telecon 2021-06-17 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-17> , UMA telecon 2021-06-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-06-24> Deferred Relationship Manager - user stories As RqP Bob(reserach), I want to be able to request access to a set of Alice's resources (heath information) directly from Alice's AS without knowledge of their location(health record repositories), because I don't have to bother getting or caring about all the locations from Alice first (since there is no direct relationship between Alice and the researcher) A reseacher may discover health records that have been authorized for them to access, without needing a direct relationship with the RO. In this case, Alice can mark her resources at the AS as being approved for someone with a specific claim. THis isn't a specific consent, ie to a specific RqP, instead she's specifying the claims that the RqP must present (such as a particular study, or researchers from specific IDPS). How she knows which avaialble studies/research institutes would have to be part of the trust ecosystem known to the AS. The AS can define the size of this ecosystem. The rule at the AS *"I Alice allow people with claim=researcher from idp=[baylor, acme] to access these specific health resources=[A@RS1, B@RS2, Immz@RS2]"*. This next component of this is how that Client/RqP can understand the scheme/type of the resource being accessed. The Client should be requesting and receiving resources that are useful to it and not other ones (data minimization). This reflects the "three layers or interop", ecosystem, protocol, schema. If 3/3 aren't there things don't work... How granular can these rules be (resource type, specific resource, resource + scopes) be? , "my health record = patient/*.*" "read my heath record *.read" FHIR has some ability to be queried in graph-y ways, however usually it's very scope based. in SMARTonFHIR, the whole RS is the Resource and you specific scopes for specific "patient.read oberervation.read ..." then you can further apply confidentiality (conf/*) or sensitivity scopes (sens/*), however those apply to the entire set of scopes. In genetic disease, the gene has a list of many mutations that could be queries, relevant to specific conditions. Or the entire gene, or types of how that gene is captures (microarray, single cell experiment). ANother example where the client/RqPs ability to understand and use the data should be assessed before giving access to the data. They might only need to know if there is a specific mutation, not the whole sequence. Or a set of genes relevant to breast cancer. There is a need to understand the purpose before giving more holistic information, it depends on the person who is investigating Is the gene the resource? Resource=(gene), scopes=(diseaseA, diseaseB, phenotypeD, specific-featureC, single-cell-experiment). The client/rqp can be filtered against the avaialbe gene resources based on those scopes. There are vocabularies that are standardized through industry that would help create this language to drive interoperability (the schema level interop) What audit capabilities would Alice have to see who/what institutes actually access her information? The AS should be able to provide this, and the RS would be able to provide even more specificity. Alice must be able to understand up front what level of audit she will receive. There is a dichomoty of behaviour a) people who wont' check and b) people who will and take action on this information. *ANCR intersection,* when the CLient is granted access lodge a consent receipt for Alice's records? This CR can be pushed as a claim (json) for Alice to understand how the Client will treat her data, who to contact etc Alice is delegating some interrogation of Clients to the AS, the blanket consent statement can't consider all Client terms (since Alice isnt' present at that time), There is a need for Bob to know the AS at which to request access from As RqP Bob(financial advisor), I want to be able to request access to a set of Alice's resources (pension information) directly from Alice's AS without knowledge of their location(specific pension providers), because I don't have to bother getting or caring about all the locations from Alice first (since this is cumbersome to Alice and the Advisor) The rule at the AS *"I Alice allow people with claim=advisor, myadvisor(a)advisingcompany.com <myadvisor(a)advisingcompany.com> from idp=[advisor idp] to access these specific pension resources=[A@PP1, B@PP2]"*. The resources available in this rule are the registered resources from an earlier discovery/registration step (both cases). This also allwos the RS to not guess what resources and scopes the Client needs based on the inititial request with the URL (RPT-less request), the AS has a much clearer idea about the Clients capability and what specificifally has been granted after claims gathering has occured. Reviewing the Diagram: https://groups.google.com/g/kantara-initiative-uma-wg/c/WAnizgl08Fg/m/YjflL… Is there an alternative where Alice tells the AS, my resources are here (RS)? This could be the AS as RelationshipManageer, where the RM reaches out to the RS to read the available resources. The challenges is still in PAT establishment. Could Alice create policy before resources are registered? This is getting closer to delegation/consent vs protocol level UMA Interop Testing Deferred AOB Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) Voting: 1. Peter 2. Alec 3. Domenico Non-voting participants: 1. Zhen 2. Ian 3. Scott Regrets: 1. Steve

1 0

Relationship Manager User Stories
by Alec Laws 01 Jul '21

01 Jul '21

Hi, as requested have collected the user stories we've looked at around the Wallet/ Relationship Manager drafts for discussion tomorrow From: https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-11-19 As RqP Bob, I want to be able to request access to a set of Alice's resources directly from Alice's AS without knowledge of their location, because I don't have to bother getting or caring about all the locations from Alice first. As client C used by RqP Bob, want to be able to request access to a set of Alice's resources directly from Alice's AS on Bob's behalf without knowledge of their location, because I don't have to retrieve the locations first. — From: https://groups.google.com/g/kantara-initiative-uma-wg/c/f0g98sr22Rw/m/M5jK9… As a RO, I want to manage my resources independently of each individual RS (UMA core prop) As an AS, I want to decouple the consent management UX from the authorization services, As a RO, I need a personally controlled user-agent (UMA Wallet) to manage my key material, in order to maintain personal-agency in ecosystems As a RO, I want to authorize a "UMA Wallet" to manage RS resources, so that I have a single view into my available RS's and Resources As a RS, I need Alice to authenticate in order to determine which resources she can manage, in order to ensure appropriate management access As a RS, I need Alice to establish credentials (pub key), so that I can trust externally asserted policy was issued with Alice AS a RS, I need to trust delegations signed by Alice's key, so that Alice can allow Bob (other keys...) or <<claims gathering condition>> to access her resources As a RS, I may delegate resource management user experience, so that I can focus of my core service to the RO As an RS, I need to know which AS(s) Alice wants to use, in order to delegate access control (uma core) As an AS, I want to delegate RqP identification to a UMA Wallet, so that - a RqP can choose their private key and consent management provider - I can avoid directly holding or seeing a users personal details Best, - Alec

1 1