- WG-UMA - mailman.kantarainitiative.org

Meeting Series on Vulnerabilities: Nov 7, 21, & Dec 5
by Alec L 07 Nov '24

07 Nov '24

Hi all, A few of us met this week and had a productive discussion about the disclosed vulnerabilities previously shared with the list. We decided to hold a series of three meetings to develop and publish a document outlining conditions and mitigations for implementers. The calls will be held on our normal bridge and time slot, Thursdays @ 1PM ET, on the following dates: Nov 7, Nov 21, & Dec 5 https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 Please reach out if you have any questions, or need help adding the meeting series to your calendar Best, - Alec Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec(a)identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/>

1 1

Disclosure of a vulnerability in UMA 2.0
by Gabriel Corona 16 Oct '24

16 Oct '24

Hi, While testing UMA 2.0, I found that the protocol was vulnerable to a vulnerability (which may not apply in some deployments). It might be interesting to start by discussing this topic off-list in order to let the implementers the opportunity to implement suitable mitigations before public disclosure. Please let me know if you would be interested. If you know the contact of any other implementers please let me know. Regards, Gabriel Corona

3 3

Agenda for UMA telecon 2024-01-11
by Alec L 11 Jan '24

11 Jan '24

https://kantara.atlassian.net/wiki/spaces/uma/pages/327581697/UMA+telecon+2… Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-07-13 <https://kantara.atlassian.net/wiki/spaces/uma/pages/227311617> - Charter Refresh and 2024 Plan Draft Charter 2024 <https://kantara.atlassian.net/wiki/spaces/uma/pages/300744705> - UK Pensions Dashboard Draft Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> - AOB Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

1 0

Agenda for UMA telecon 2023-12-14
by Alec L 14 Dec '23

14 Dec '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/291340289/UMA+telecon+2… UMA telecon 2023-12-14Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-07-13 <https://kantara.atlassian.net/wiki/spaces/uma/pages/227311617> - Charter Refresh and 2024 Plan Draft Charter 2024 <https://kantara.atlassian.net/wiki/spaces/uma/pages/300744705> - Cancelling Dec 28th Meeting, next meeting Jan 11 - UK Pensions Dashboard Draft Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> - AOB Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

1 0

Cancelling Sep 7 WG Call
by Alec L 07 Sep '23

07 Sep '23

Hi all, will have to cancel today's call, apologize for the short notice Best, - Alec

1 0

Agenda for UMA telecon 2023-06-29
by Alec L 29 Jun '23

29 Jun '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/220659713/UMA+telecon+2… UMA telecon 2023-06-29Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> - Check-in, Pensions Dashboard Use-case report - How could we use funding from Kantara? - AOB

1 0

Re: [WG-UMA] Updated invitation: UMA WG @ Thu Apr 6, 2023 1pm - 2pm (EDT) (sal@idmachines.com)
by Alec Laws 06 Apr '23

06 Apr '23

Hi Adrian, that would be a great topic for an upcoming call. We've had an "UMA + GNAP" investigation on our work backlog for a while. Would you be able to facilitate a discussion? https://datatracker.ietf.org/wg/gnap/about/ (for everyone's reference) Best, - Alec On Thu, Apr 6, 2023 at 2:12 PM Adrian Gropper <agropper(a)healthurl.com> wrote: > All, > > IETF GNAP seems to be months away from Last Call. Is it worth having a > session on why the world needs both UMA and GNAP? > > - Adrian > > On Thu, Apr 6, 2023 at 1:24 PM Salvatore D'Agostino <sal(a)idmachines.com> > wrote: > >> Regrets, not going to make it to today >> >> IDmachines >> 1264 Beacon Street, #5 >> Brookline, MA 02446 >> +1 617.201.4809 >> @idmachines >> ------------------------------ >> *From:* Google Calendar <calendar-notification(a)google.com> on behalf of >> UMA WG <grt94kc567d3p039i0shdq8fcc(a)group.calendar.google.com> >> *Sent:* Thursday, April 6, 2023 1:14:47 PM >> *To:* gauravs_mailbox(a)yahoo.com <gauravs_mailbox(a)yahoo.com>; Andrew >> Hindle <andrew(a)hindleconsulting.com>; bjorn.hjelm(a)verizonwireless.com < >> bjorn.hjelm(a)verizonwireless.com>; Domenico Catalano < >> domenico.catalano(a)gmail.com>; Maciej <maciej.machulak(a)gmail.com>; Scott >> Fehrman <scott.fehrman(a)forgerock.com>; peter.davis(a)airsidemobile.com < >> peter.davis(a)airsidemobile.com>; cigdem.sengul(a)gmail.com < >> cigdem.sengul(a)gmail.com>; lalevasseur(a)ieee.org <lalevasseur(a)ieee.org>; >> adam.bradley(a)unifysolutions.net <adam.bradley(a)unifysolutions.net>; >> tsreiniger(a)gmail.com <tsreiniger(a)gmail.com>; nancy.lush(a)lgisoftware.com < >> nancy.lush(a)lgisoftware.com>; Eve Maler <eve.maler(a)forgerock.com>; >> michaelamanfi(a)hotmail.com <michaelamanfi(a)hotmail.com>; mike(a)identos.ca < >> mike(a)identos.ca>; carlos_a_garcia(a)optum.com <carlos_a_garcia(a)optum.com>; >> kay(a)kantarainitiative.org <kay(a)kantarainitiative.org>; mike(a)gluu.org < >> mike(a)gluu.org>; steve.venema(a)forgerock.com <steve.venema(a)forgerock.com>; >> Salvatore D'Agostino <sal(a)idmachines.com>; agropper(a)healthurl.com < >> agropper(a)healthurl.com>; hardjono(a)mit.edu <hardjono(a)mit.edu>; >> patrick.parker(a)empowerid.com <patrick.parker(a)empowerid.com>; >> daniela.poehn(a)unibw.de <daniela.poehn(a)unibw.de>; >> karim.boucetta(a)oxyliom-solutions.com < >> karim.boucetta(a)oxyliom-solutions.com> >> *Subject:* Updated invitation: UMA WG @ Thu Apr 6, 2023 1pm - 2pm (EDT) ( >> sal(a)idmachines.com) >> *When:* Thursday, April 6, 2023 1:00 PM-2:00 PM. >> *Where:* >> https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 >> >> UMA WG >> Dial-in and screenshare: See meeting locationThis is the WG meeting held >> every two weeks at 10am PT/noon CT/1pm ET/6pm UK/7pm CET (with suitable >> shifts for "summertime skew" twice a year, US time zone >> >> This event has been updated >> Changed: description >> >> Description >> CHANGED >> Dial-in and screenshare: See meeting location >> >> >> This is the WG meeting held every two weeks at 10am PT/noon CT/1pm ET/6pm >> UK/7pm CET (with suitable shifts for "summertime skew" twice a year, US >> time zones being dominant). >> >> Agenda and previous minutes: >> https://kantara.atlassian.net/wiki/spaces/uma/pages/4849687/Meetings+and+Mi… >> <https://www.google.com/url?q=https%3A%2F%2Fkantara.atlassian.net%2Fwiki%2Fs…> >> >> Time zone converter: www.thetimenow.com/time-zone-converter.php >> <https://www.google.com/url?q=http%3A%2F%2Fwww.thetimenow.com%2Ftime-zone-co…> >> >> UMA WG calendar: >> https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar >> <https://www.google.com/url?q=https%3A%2F%2Fkantara.atlassian.net%2Fwiki%2Fs…> >> >> To request an invitation to this meeting, or an ad hoc meeting at a time >> friendlier to your schedule, please contact the WG chair. >> >> Dial by your location >> +1 253 215 8782 US (Tacoma) >> +1 301 715 8592 US (Washington DC) >> +1 312 626 6799 US (Chicago) >> +1 346 248 7799 US (Houston) >> +1 646 558 8656 US (New York) >> +1 669 900 9128 US (San Jose) >> Find your local number: https://zoom.us/u/adwkesaBp >> <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FacJB0i8eEk&sa=D&us…> >> When Thursday Apr 6, 2023 ⋅ 1pm – 2pm (Eastern Time - Toronto) >> Location >> https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 >> View map >> <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fj%2F99487814311%3Fpwd%…> >> Guests >> gauravs_mailbox(a)yahoo.com >> Andrew Hindle <andrew(a)hindleconsulting.com> >> bjorn.hjelm(a)verizonwireless.com >> Domenico Catalano <domenico.catalano(a)gmail.com> >> Maciej <maciej.machulak(a)gmail.com> >> Scott Fehrman <scott.fehrman(a)forgerock.com> >> peter.davis(a)airsidemobile.com >> cigdem.sengul(a)gmail.com >> lalevasseur(a)ieee.org >> adam.bradley(a)unifysolutions.net >> tsreiniger(a)gmail.com >> nancy.lush(a)lgisoftware.com >> Eve Maler <eve.maler(a)forgerock.com> >> michaelamanfi(a)hotmail.com >> mike(a)identos.ca >> carlos_a_garcia(a)optum.com >> kay(a)kantarainitiative.org >> mike(a)gluu.org >> steve.venema(a)forgerock.com >> Salvatore D'Agostino <sal(a)idmachines.com> >> agropper(a)healthurl.com >> hardjono(a)mit.edu >> patrick.parker(a)empowerid.com >> daniela.poehn(a)unibw.de >> karim.boucetta(a)oxyliom-solutions.com >> View all guest info >> <https://calendar.google.com/calendar/event?action=VIEW&eid=Nmg1cDAzYWhjaDUx…> >> Reply for sal(a)idmachines.com >> Yes >> <https://calendar.google.com/calendar/event?action=RESPOND&eid=Nmg1cDAzYWhja…> >> No >> <https://calendar.google.com/calendar/event?action=RESPOND&eid=Nmg1cDAzYWhja…> >> Maybe >> <https://calendar.google.com/calendar/event?action=RESPOND&eid=Nmg1cDAzYWhja…> >> More options >> <https://calendar.google.com/calendar/event?action=VIEW&eid=Nmg1cDAzYWhjaDUx…> >> >> Invitation from Google Calendar <https://calendar.google.com/calendar/> >> >> You are receiving this email because you are an attendee on the event. To >> stop receiving future updates for this event, decline this event. >> >> Forwarding this invitation could allow any recipient to send a response >> to the organizer, be added to the guest list, invite others regardless of >> their own invitation status, or modify your RSVP. Learn more >> <https://support.google.com/calendar/answer/37135#forwarding> >> >

2 1

Draft minutes of UMA telecon 2023-03-16
by Alec L 16 Mar '23

16 Mar '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/167018497/UMA+telecon+2… Agenda - Approve minutes since UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> - Review WG Call Times - Upcoming Conference Content (EIC & Identiverse) - IDPro knowledge base / general UMA articles - Check-in, Pensions Dashboard Use-case report - AOB Attendees - NOTE: As of Sept 15, 2022, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 4 of 6. (Peter, Sal, Alec, Eve, Steve, Sophia) - Voting: - Alec - Peter - Non-voting participants: - Hanfei - Regrets: - Steve Quorum: No Meeting Minutes Approve previous meeting minutes - Approve minutes of UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> UMA telecon 2023-01-19 <https://kantara.atlassian.net/wiki/spaces/uma/pages/137462845> , UMA telecon 2023-02-02 <https://kantara.atlassian.net/wiki/spaces/uma/pages/145522689> , UMA telecon 2023-02-09 <https://kantara.atlassian.net/wiki/spaces/uma/pages/148734016> , UMA telecon 2023-02-17 <https://kantara.atlassian.net/wiki/spaces/uma/pages/152633345> , UMA telecon 2023-03-02 <https://kantara.atlassian.net/wiki/spaces/uma/pages/158400513/Copy+of+UMA+t…> , UMA telecon 2023-03-09 <https://kantara.atlassian.net/wiki/spaces/uma/pages/163872769> - Deferred - no quorum Topics Review WG Call Times Upcoming Conference Content (EIC & Identiverse) Pensions Dashboard / Open Banking Use-case report, initial discussion Draft will be worked on here: Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> We spent some time cleaning up the intro section, next steps are with Hanfei and Alec IDPro knowledge base / general UMA articles Wikipedia Article Refresh <https://kantara.atlassian.net/wiki/spaces/uma/pages/145817605> AOB - mDL and VC in UMA, current experiences and challenges - one VC challenges is the schemas that drive interop! could Kantara hold a group that curates and publishes these schemas (mdocs/vc schemas/etc) - data schema standardization is nessecary for interop! - the FI WG did some of this for SAML a “few” years ago - scope: industry agnostic data schemas, no bias to any governemnts, a unified identity schema - right to export data requires a common vocabuarly to the be useful

1 0

Regrets today
by Peter Davis 09 Mar '23

09 Mar '23

I know it last minute, but I won’t be able to join the UMA call today. Alec, often this time slot is just the 2 of us, so … I think last call we discussed revisiting call times. Was that discussed, and I missed it? Peter Davis CTO/CPO - Airside Mobile

2 1

Draft notes from UMA 2021/01/26
by Alec L 30 Jan '23

30 Jan '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/140607489/UMA+telecon+2… Agenda - Approve minutes since UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> - Julie Use-case, move from draft to v1 - IDPro knowledge base / general UMA articles - discuss updates - Pensions Dashboard Use-case report - AOB Attendees - NOTE: As of Sept 15, 2022, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 4 of 6. (Peter, Sal, Alec, Eve, Steve, Sophia) - Voting: - Peter - Alec - Sal - Non-voting participants: - Hanfei - Regrets: - Steve Quorum: No Meeting Minutes Approve previous meeting minutes - Approve minutes of UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> UMA telecon 2023-01-19 <https://kantara.atlassian.net/wiki/spaces/uma/pages/137462845> - Deferred - no quorum TopicsJulie Use-case, move from draft to v1 Alec’s going to publish a v1 and upload the PDF to our confluence page Pensions Dashboard / Open Banking Use-case report, initial discussion Draft will be worked on here: Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> UK Pensions is separate from openbanking in general, however, it’s in the same financial vertical and shows a real UMA application IDPro knowledge base / general UMA articles AOB How could an app be an RS or AS, universal links starts to help with this issue however there are other considerations e.g. the client requests must originate from the same device/browser, otherwise, it’s routed to the single backend server and not the user’s installed app Could we profile or create an IG around using notice & consent receipts with an UMA AS, e.g. to present terms and purposes to be accepted by the RqP/RO. This comes back to having a defined language for policy vs leaving it open to the AS https://transparencylab.ca/ is hosting a workshop tomorrow (Jan 27) about transparency performance indicators and how they can be related to a controller credential, something that people make

1 0