- WG-UMA - mailman.kantarainitiative.org

2022 Charter - draft for review
by Alec Laws 30 Jun '22

30 Jun '22

Hi all, It's time for us to re-charter! We reviewed a draft this week: https://kantara.atlassian.net/wiki/spaces/uma/pages/4850242/Draft+Charter+2… Please reply with any feedback or items you'd like to work on this year We'll look for a quorum to adopt this on our July 14th call -- voting members, please let me know if you can't attend that day Cheers, - Alec

1 0

Draft minutes of UMA telecon 2022-06-30
by Alec Laws 30 Jun '22

30 Jun '22

https://kantara.atlassian.net/wiki/spaces/uma/pages/14352423/UMA+telecon+20… Meeting MinutesApprove previous meeting minutes - Approve minutes of UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> , UMA telecon 2022-04-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-06> , UMA telecon 2022-04-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-14> , UMA telecon 2022-04-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-21> , UMA telecon 2022-05-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-05> , UMA telecon 2022-05-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-12> , UMA telecon 2022-05-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-19> , UMA telecon 2022-05-26 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-26> , UMA telecon 2022-06-02 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-06-02> , UMA telecon 2022-06-16 <https://kantara.atlassian.net/wiki/spaces/uma/pages/14352385/UMA+telecon+20…> - *Quorum* - *Eve moves to approve, Peter seconds! motion passed* Topics Identiverse Recap Industry self-reflection - is identity a dual use technology? seems to be true of anything, needs to stay mindful always - Identity as a surveillance tool - Shifting of the surveillance to the wallet passkeys - aka WebAuthn aka FIDO - would this work on linux or open source OS? mDL GAIN (global assured identity network) - https://gainforum.org/ and whitepaper: https://gainforum.org/GAINWhitePaper.pdf - starting a poc effort at openid: https://openid.net/gainpoc/ - lead to a new effort 'open wallet foundation', open source wallet GNAP - general audience struggles with: correlation handles, claims pushing - the added value needs to overcomes the pain of change - options make specs hard to understand (and test!) - can we show simple uma flows, uma cookbook? - eg just auth code flow (no claims pushing), just claims pushing (no auth code) as profiles - or profiles that remove optionality of path names, make interop testing easier - good designs for resource registration against FHIR (or open banking/FPX) Shared Signals & Events - https://openid.net/wg/sse/, https://datatracker.ietf.org/group/secevent/about/ - "what happens when identity people develop webhooks" - SSE is main protocol, CAEP defines events to be sent IDPro - getting a lot of traction - should we try to create an UMA knowledge base articles? YES Healthcare - not a ton of content - new HEART whitepaper "The Global Open Health Movement: Empowering People and Saving Lives by Unlocking Data <https://openid.net/wordpress-content/uploads/2022/06/OIDF-and-the-Health-Wh…> " Home Page Refresh Draft New Home Page <https://kantarainitiative.org/confluence/display/uma/Draft+New+Home+Page> Charter Refresh Draft Charter 2022 <https://kantara.atlassian.net/wiki/spaces/uma/pages/4850242/Draft+Charter+2…> draft completed, will socialize on the list for feedback AOB - US is working on federal privacy legislation! A rights/responsibilities framework without requirements Potential Future Work Items / Meeting Topics - Confluence clean up, archive old items and promote the latest & greatest - Review of the email-poc correlated authorization specification - A financial use-case report (following the Julie healthcare template) - either open banking or pensions dashboard - openbanking is to FHIR(data model) as FAPI is to SMARTonFHIR(authZ protocol profile) - mDL + UMA - UMA + GNAP https://oauth.xyz/specs/ - would we have an UMA GNAP version (eg extension of GNAP or UMA? UMAonGNAP) - will GNAP meet all the UMA outcomes? - IDPro knowledge base articles - UMA 2 playground/sandbox - eg https://developers.google.com/oauthplayground/, https://www.oauth.com/playground/ Upcoming Conferences - IIW 35, November 15 - 17 - Gartner and Federal ID coming up soon

1 0

Agenda for UMA telecon 2022-06-30
by Alec Laws 29 Jun '22

29 Jun '22

https://kantara.atlassian.net/wiki/spaces/uma/pages/14352423/UMA+telecon+20… UMA telecon 2022-06-30Date and Time - Primary-week Thursdays 06:30am PT; *Secondary-week Thursdays 10:00am PT* - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes since UMA telecon 2022-03-31 <https://kantara.atlassian.net/wiki/spaces/uma/pages/4850139/UMA+telecon+202…> - Charter Refresh - Home Page Refresh - AOB

1 0

Cancelling June 23rd meeting
by Alec Laws 23 Jun '22

23 Jun '22

Hi all, cancelling tomorrow’s call as many folks are unavailable, including myself. Will get back to our regularly scheduled program starting next week! Best, - Alec

2 1

Draft Minutes of UMA telecon 2022-06-16
by Alec Laws 16 Jun '22

16 Jun '22

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-06-16 Attendees - NOTE: As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) - Voting: - Peter - Alec - Non-voting participants: - Scott - Regrets: Quorum: NoMeeting MinutesApprove previous meeting minutes - Approve minutes of UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> , UMA telecon 2022-04-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-06> , UMA telecon 2022-04-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-14> , UMA telecon 2022-04-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-21> , UMA telecon 2022-05-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-05> , UMA telecon 2022-05-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-12> , UMA telecon 2022-05-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-19> , UMA telecon 2022-05-26 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-26> , UMA telecon 2022-06-02 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-06-02> - *Deferred–no quorum* Topics Home Page Refresh Draft New Home Page <https://kantarainitiative.org/confluence/display/uma/Draft+New+Home+Page> Charter Refresh Draft Charter 2022 <https://kantarainitiative.org/confluence/display/uma/Draft+Charter+2022> UMA 1 (2012?) now at UMA 2 (2018), what's the roadmap from today? - biggest 1→2 change was to be more 'oauth-y' and to remove confusing concepts - does anyone use the PCT... or make can we make options more explicitly optional? - can UMA be even *more* OAuth compatible? one UMA challenge is that clients can't just take existing libraries - OIDC writes profiles of OAuth, we're not fully bw-compatible - do we have some bets as to when GNAP will start to supercede OAuth, should we create the UMAonGNAP version? - clarify who hosts the AS, and why? with OAuth it's clear that an RS needs an Oauth AS associated/co-located with it - how can we make the UMA value more clear (earlier in someones understanding), the RO is in control - it takes a long time to get people to understand or have their 'a-ha' moment as to why UMA is the right solution - how can we enable UMA implementors to more easily get here with customers? - the marketing part of why it exists, why you need it - Need to move away from technical and into a more 'marketing' or evangelism mode - control of access to user, lots of industry shift here (patient-centric, open banking, verifiable creds - Could we have an open survey - Do you know what UMA is? - Why don't you use UMA? Marketing & non-technical explanation of value, OAuth backwards compatibility, Survey We're AT the UMA 'early adopters' point, how can we transition to wide usage?

1 0

Agenda for UMA telecon 2022-06-16
by Alec Laws 15 Jun '22

15 Jun '22

Hi all, apologies for missing last week's call :( Please find the agenda for tomorrow below. Best, - Alec https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-06-16 UMA telecon 2022-06-16Date and Time - Primary-week Thursdays 06:30am PT; *Secondary-week Thursdays 10:00am PT* - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes since UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> - Charter Refresh - Home Page Refresh - AOB

1 0

Agenda for UMA telecon 2022-06-02
by Alec Laws 01 Jun '22

01 Jun '22

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-06-02 UMA telecon 2022-06-02Date and Time - Primary-week Thursdays 06:30am PT; *Secondary-week Thursdays 10:00am PT* - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes since UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> - Charter Refresh - Home Page Refresh - UMA/UDAP/etc comparison - Let's add a row for GNAP/mDL - AOB

1 0

Draft minutes of UMA telecon 2022-05-26
by Alec Laws 26 May '22

26 May '22

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-26 Agenda - Approve minutes since UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> - UMA/UDAP/etc comparison - Let's add a row for GNAP/mDL - Charter Refresh - AOB Attendees - NOTE: As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve) - Voting: - Alec - Non-voting participants: - Scott - Nancy - Regrets: Quorum: NoMeeting MinutesApprove previous meeting minutes - Approve minutes of UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> , UMA telecon 2022-04-06 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-06> , UMA telecon 2022-04-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-14> , UMA telecon 2022-04-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-21> , UMA telecon 2022-05-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-05> , UMA telecon 2022-05-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-12> , UMA telecon 2022-05-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-19> - *Deferred–no quorum* Topics UMA/UDAP/etc comparison - https://docs.google.com/spreadsheets/d/1UWxhLoLFsVNmHulGvyS_3vx5hF9u2reFXT3… - Let's add a row for GNAP - https://datatracker.ietf.org/wg/gnap/documents/ - https://oauth.xyz/ - Could also add a row for mDL 18013-5 (online/offline/hybrid) - https://www.aamva.org/getmedia/c4fe2a21-91ff-449d-9df3-5a7e33cf3a8e/mDL-Imp… Julie Use-case Report - progress update on resolving feedback - Link to V0.3 Working Group Draft: Julie Use-case Report <https://kantarainitiative.org/confluence/display/uma/Julie+Use-case+Report> Charter Refresh Draft Charter 2022 <https://kantarainitiative.org/confluence/display/uma/Draft+Charter+2022> AOB me, delegate ?user=delegate Does the RqP need to know the owner? No Does UMA support group membership policy? Yes Alice has a resource R registered at her A, she delegates control to Bob, allowing Bob to 're-share' R with Sam. If Alice shares a resource R with Bob, Bob should not be able to share R with Sam Delegation of Control (administration): Alice allows Bob to create policies over her resources (R, S, T) Delegation of Access (sharing): Alice allows Bob to access her resources (R, S) resource = R, scopes = (a, b, c), owner = O Explicit Policy (opt-in): O says R can be accessed by ANYONE who provides a (name, email) ← eg to download some whitepaper Implicit(default) Policy (opt-out): AS has a policy that all R of type can be access by ALL doctors Implicit Policy: AS will allow any Doctor to access any resource if they assert the scope 'btg' Implicit Policy: As will allow any RqP who is an Owner to access their own resources Implicit policy is (today) broadly agreed to by the Owner when the agree to the ASs Terms of Service. Implicit Policy may allow an *explicit* opt-out by an owner. Explicit Opt-out: O say doctor E can't access any of her resources National Policy > State Policy > Local Policy > (Implicit) Organizational Policy >* actual policy *< subject/owner/administrator Policy (Explicit) Should we have have more impl guidance around Group Policy? It's supported in the spec, however most of our public information is Alice→Bob sharing

1 0

Agenda for UMA telecon 2022-05-26
by Alec Laws 25 May '22

25 May '22

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-05-26 UMA telecon 2022-05-26Date and Time - *Primary-week Thursdays 06:30am PT;* Secondary-week Thursdays 10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes since UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> - UMA/UDAP/etc comparison - Let's add a row for GNAP/mDL - Charter Refresh - AOB

1 0

Agenda for UMA telecon 2022-04-14
by Alec Laws 13 Apr '22

13 Apr '22

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-04-14 UMA telecon 2022-04-14Date and Time - *Primary-week Thursdays 06:30am PT; *Secondary-week Thursdays 10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes since UMA telecon 2022-03-31 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2022-03-31> - Julie Use-case Report - review feedback - Content for Kantara Workshop at European Identity Conference - AOB

1 0