- WG-UMA - mailman.kantarainitiative.org

Fwd: Re: Feedback on CIBA
by Mike Schwartz 07 Jun '18

07 Jun '18

I sent this comment to MODERNA: 2. In section 6.4. "Token Error Response", There is no way for the user to fix the error if the back channel communication fails. Although you are kicking off the authentication via backchannel, if the user can switch to front channel, she may be able to resolve a problem. For this reason, I would suggest you define a "claims_gathering_endpoint" which can be returned to the client, and in which the user could then interact with the AS. Your claims gathering endpoint could be like an airline quickcode. For example, if I'm working with airline ABC, then the agent could tell me to direct my browser to https://abc.com/ciba/G5JQ2 Then you have a lot more options to fix the problem (especially if this claims gathering endpoint is on the OP, and you could put the subject through a multi-step authentication workflow).

1 0

I may be a couple of minutes late opening the bridge today
by Eve Maler 07 Jun '18

07 Jun '18

</eom> Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756)

1 0

Did some cleanup work on the business model diagrams/mappings
by Eve Maler 06 Jun '18

06 Jun '18

Not sure we'll work on this at all in tomorrow's call, but I did want to finally clean this up. Please see slides 9-12 <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…> in particular. (Remember, if you haven't accessed the deck before, I'll need to give you permission.) Basically what I've done is convert from a table/matrix approach to keeping the "spaghetti"/visual approach when delving into the particulars of the legal device-to-technical artifact mappings. A sample is below. Jim has mentioned to me that he has a good candidate use case we could POC, and I hope to see him end of next week to work on this a bit. Building up a realistic set of agreements/licenses/resulting artifacts/flows is key. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-06-07
by Eve Maler 06 Jun '18

06 Jun '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-05-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31> - Decoupled flow: continue discussion - "Force authentication"? - Poll with interval vs. use a notification endpoint? - Enterprise use cases and Gluu Gateway - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-05-31
by Eve Maler 31 May '18

31 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-05-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24>: APPROVED by unanimous consent. Pass-downs from the LC - ID Pro memberships available; let the staff know if you're interested - North America member plenary idea: 3 hours or more on Fri Oct 26 after IIW 27 in SF; potential inter-WG efforts? Early thoughts on the plenary: Mike can't make it. Decoupled flow walkthrough Client-initiated backchannel authentication (CIBA <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>) was invented by the MODRNA group. Mike observes that the OAuth password credentials grant, currently being discussed again, is sort of similar. Usage of it is discouraged but it's often a pattern of last resort. Why is it there? To provide a less-completely-horrible way to do what people would do anyway. Really? Harrumph. The grant lets you throw out the password and just deal with the token. And it lets you standardize on OAuth vs. also doing real screen-scraping. The idea in CIBA is that Bob (a call center agent or similar) wants to send a notification to the AS to authenticate Alice out of band. The phishability of both is still a big security consideration. In George's environment, the challenge is to complete the authentication loop without the call center worker party ("Bob") seeing the code or whatever. "Proof of presence" by the user seeking service ("Alice") is insufficient. A fake person pretending to be Alice shouldn't be able just to hit an Approve button. Eve has done an analysis <https://www.websequencediagrams.com/files/render?link=BKzJljUfSJShB3_no57b> attempting to map UMA to the decoupled requirements. We could dictate that request_submitted be used (See Grant Sec 3.3.6 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html#auth…>) and that could trigger a notification flow that requires a specific kind of authentication. Could this be done as a profile? Talking about "sessions" is weird, especially because it may not be about a browser at all, but a mobile authenticator app. What if the Bob side wanted to collect a set of claims? Could the UMA infrastructure for claims collection be leveraged, only in the other direction (by some AS acting on behalf of the RqP)? We're given to understand that polling is considered harmful by OB. CIBA has both polling and notification <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>. Since UMA is so asynchronous in its outlook, would it want to make use a notification endpoint on the Bob side for the Alice side to use? Do we think this approach is interesting to keep analyzing? There's interest among Mike, Bjorn, and Maciej so far. It seems to meet the " *potentially* fit for purpose" bar if we think about request_submitted. Business model device/artifact mapping Eve reviewed the current state. Enterprise use case collection Some thoughts variously from Mike and Eve: UMA and XACML are not necessarily mutually exclusive. However, organizations are struggling to avoid vendor lock-in with XACML and some are looking for new ways to scale better; XACML has challenges with that while the OAuth architecture does better. It can be valuable to do analytics over a standard policy format. David B mentioned OpenPolicyAgent.org <http://openpolicyagent.org/> at EIC, which is a policy engine framework with a policy expression format. ANSI RBAC is a standard, whereas ABAC is not a standard. Justin says, "Yes, let's kill XACML." [image: (smile)] Mike should be ready to demo the Gluu Gateway next week. Let's continue the enterprise discussion next time. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Maciej 3. Eve 4. Mike 5. Cigdem Non-voting participants: - Adrian - George - Mark - Bjorn - Nancy Lush - Lush Group - is on the HEART WG - welcome to the group! - Justin Regrets: - Tim - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-05-31
by Eve Maler 30 May '18

30 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-31 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-05-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24> - Decoupled flow walkthrough - Business model device/artifact mapping - Gluu Gateway demo and enterprise use case collection - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

UMA-related EIC presentations uploaded
by Eve Maler 24 May '18

24 May '18

Hi folks-- You can find my EIC presentations on the wiki: - Kantara pre-conference showcase WG update <https://kantarainitiative.org/confluence/download/attachments/17760302/UMA%…> - Leveraging UMA's Power for Compliance and User Control <https://kantarainitiative.org/confluence/download/attachments/17760302/EIC1…> (this was the one requested during today's call) Both are currently highlighted on the wiki home page. Please feel free to use them and to spread the word. (If you need original PowerPoint versions for some reason, please get in touch with me -- however, I have tried to eliminate fancy animations so that they're easy to print.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Draft minutes of UMA telecon 2018-05-24
by Eve Maler 24 May '18

24 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24 MinutesRoll call Quorum was reached. Approve minutes MOTION: Andi moves: Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>, UMA telecon 2018-04-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12>, UMA telecon 2018-05-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-10>: APPROVED by unanimous consent. Business model and use cases - - RUFADAA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…>++ scenarios – Eve will have some visual representations – how to "spec" all this? Is IRM a new concept? Who invented it? Kantara has an IRM WG <https://kantarainitiative.org/confluence/display/irm>; it produces Reports and isn't super-active at the moment. The notion is that something like "IRM" is needed to distinguish higher-order changes than the UMA protocol can detect, e.g., in sub-scenario 3, when Johnny is able to manage his own resources; Alice's PATs for managing Johnny resources (and any associated downstream artifacts) should be killed but not her PATs for managing her own resources. Only some repository that tracks the distinction can do that. It doesn't have to be a graph DB. A 40th state has just enacted RUFADAA! Our theory is that these are all variously painful problems for which UMA-enabled services would be valuable solutions. The visualizations should help us start to have the conversations to figure out how painful/valuable. How would consents be managed? What would the "Online Tool" do to enable the solution? Kathleen notes that HL7 has a project around FHIR and are planning to reach out to Kantara. ONC has an Informed Consent pilot, where they're recruiting children and young adults and trying to figure out this "children aging-in" piece. There's a Resource type call Questionnaire Question Response, and there's a Compound Consent. The Origo <https://www.origo.com/news/PensionsDashboardArchitecture.aspx> use case seems to be applicable to a bunch of other financial areas, and potentially to healthcare as well, but in the US, the challenge is discoverability, and HEART doesn't touch the third rail of discovery. Would an "opt-in" discovery service that Alice permissions the use of be viable? (This is for HEART to take up, perhaps.) How would the legal devices and technical artifacts interact? The tokens wouldn't contain the devices; they probably need to point to them through URLs. We aren't talking about NEW contracts in addition to ones that (say) the end-user resource owner would agree to. However, there might be additional clauses we recommend they contain to be protective of privacy rights. AIs: - Tim: Reach out to Uniform Law Commission contacts - Eve: Finish all known business model scenarios to date - Eve: Reach out to Origo to share status - Eve: Share EIC slides with the WG (DONE) - Kathleen: Share links to HL7 work UMA and Open Banking - Analyze relevance of UMA for "decoupled" use cases (deferred again) Next time - Gluu Gateway demo - Brainstorm on enterprise UMA use cases Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Andi 3. Eve 4. Mike Non-voting participants: - Kathleen - Nancy - Tim Regrets: - Thomas - Mark *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-05-24
by Eve Maler 23 May '18

23 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>, UMA telecon 2018-04-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12>, UMA telecon 2018-05-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-10> - Business model and use cases - RUFADAA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…>++ scenarios – Eve will have some visual representations – how to "spec" all this? - UMA and Open Banking - Analyze relevance of UMA for "decoupled" use cases - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Additional news I forgot to mention on today's call: OpenMedReady
by Eve Maler 10 May '18

10 May '18

Some news (in which my company is involved) came out last Thursday regarding a new effort called OpenMedReady. The headline on its website, openmedready.org, is: "Data provenance, security, privacy and consent in remote patient monitoring", and UMA is mentioned as one of the key specs underlying it. One way to think of it is as a healthcare IoT initiative layered on top of existing standards and profiles. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0