- WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2016-03-10
by Eve Maler 10 Mar '16

10 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-10 MinutesDiscussion of Kantara's new organizational structure Is this new structure of any concern? It seems not; it's a mark of Kantara's growth and maturity. APAC-friendly meeting series Eve will reach out to those likely most affected if the series is changed to see if those people would mind if she offers ad hoc syncs instead. Roll call Quorum was not reached. Approve minutes Approve minutes of UMA telecon 2016-02-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-02-25>: APPROVED Updates from recent meetings and events *IAPP Canada:* John W was approached by an IAPP Canada organizer about doing a technical presentation, and he reached out to Andrew Hughes to help put together a panel on UMA, so as to inject more interesting technicality into the proceedings. John and Eve will sync on getting some good UMA slide fodder. 40% of the IAPP is made up of lawyers, so they'll have to go for the right level. We're looking at leveraging this into another opportunity at IAPP/CSA's "Privacy. Security. Risk." event in September. Yesterday's APAC-friendly meeting had a big focus on IAPP Canada preparations. *RSA:* Eve and Josh Alexander presented, and Eve got to spend a few minutes on UMA in the talk. She has been hearing repeatedly that UMA has been coming up in "third-party" conversations she isn't in. [image: (smile)] She has die-cut stickers to give UMAnitarians, and they got snapped up at RSA. She also had interesting side conversations about health, energy, other use cases for UMA (relevant tweet <https://twitter.com/IdentityHutch/status/705827488388100098>). *HIMSS:* Not a lot of UMA-related news. Justin gave an overview to the Argonaut and FHIR project folks, and it came up in conversation a few times. Adrian observes that they don't know of any pilots. François notes that he doesn't know of pilots either. Delegation is the key unique use case, where patients can delegate access. *Btc Expo:* Adrian heard some interesting avenues there. Andi has been hearing blockchain/UMA opportunities. *CIS:* Andi notes that there is a distributed ledger/blockchain track, and a privacy track as well. Everyone please register and book hotel rooms ASAP! (And don't forget to sign up for IIW <http://eventbrite.com/e/internet-identity-workshop-xxii-22-2016a-tickets-19…> .) Why UMA? Eve has asked Domenico (our UX and graphics editor!) to put together some material for our wiki to highlight the "Why?" of UMA for businesses as an important audience. He will share his research on the list. Eve would like to ask everyone to contribute new "collateral" to this area. The impetus was Robert asking Eve for use cases, and our finding that our Case Studies page doesn't suffice. Mike asks that we present Enterprise UMA more prominently as this is an easier sell than privacy. Therefore, Mike should contribute content. What about Pedro's use case? *AI:* Eve: Approach Pedro at Red Hat about their use case. A barrier is lack of libraries, including RS support. In fact, this has just come up on the UMA Dev list, and this is the exact purpose of the UMA Dev WG, right down to putting the emphasis on the RS. Eve also likes how Nat had published an easy Hello, World OIDC client app on his blog to show everyone how small and easy it could be. There are lots of great ways other than (boring?) slideware to document and persuade about UMA: - Pumpkin security theater - John is big on putting together an interactive whiteboard why-and-how presentation - A music video <https://drive.google.com/open?id=0B7aQF7z4Xp_yQVcxLUdiZzlLUVk> (this one is about privacy generally, from RSAC) - Other ideas <http://opencreds.org/> for presentation Issue 239 The main issue in the extension spec <http://htmlpreview.github.io/?https://github.com/KantaraInitiative/wg-uma/b…> is whether it can coexist with the main spec or whether it "stomps on" the main spec. This likely affects the extension spec title, several instances of language, and the configuration data design – it should probably invent a new endpoint that exists alongside the original endpoint. Coexistence would dictate changing our previous consensus about seeing little reason to deploy the "unenhanced" claims-gathering mechanism. Reasons for coexistence would be backwards compatibility with the existing UMA spec(s), and we still could make arguments for someone having a specialized environment that does claims-gathering and doesn't really need the enhancement. Note that the old endpoint would be marked for eventual deprecation and disabling. An important question is whether it's even possible to not support the old endpoint. George argues for it to be possible for an AS not to support the "old" endpoint on security grounds. And in fact, this could be very clean because you just don't support the "claims-gathering method" as offered by regular UMA. And now there's a draft non-normative companion doc <http://kantarainitiative.org/confluence/display/uma/Understanding+the+Sessi…>. Eve's thinking is that all vulnerabilities found in protocols such as this should come with docs like this as a kind of FAQ. *AI:* Eve: Ask the WG about one more ad hoc meeting early next week to see about finalizing decisions on spec text so we can close out the issue next week and publish. Attendees As of 18 Feb 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. François 2. Domenico 3. Andi 4. Robert 5. Maciej 6. Eve 7. Mike Non-voting participants: - Adrian - John W - Justin - Gil - Arlene - George Regrets: - Sarah - Thomas *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Why UMA for Business
by Domenico Catalano 10 Mar '16

10 Mar '16

Hi all, I've researched a little bit about "Why Business needs UMA”. In attach a draft presentation, where I've gathered some ideas extracted and elaborated from the following resources: Customer Data: designing for transparency and trust <https://hbr.org/2015/05/customer-data-designing-for-transparency-and-trust> Social Physics and the data driven society <http://sites.nationalacademies.org/cs/groups/pgasite/documents/webpage/pga_…> New deal on Data <http://civics.com/NewDealOnData/> Extreme Trust <http://www.extremetrustbook.com/excerpt.html> The logic flow of the presentation is as follow (Know Why, Know How, Then What :-) WHY (Business Driver) Explosion of Digital technologies produces a vast quantities of data. Consumers appreciate data sharing if it can lead to products and services that make their life easer… Example (Nest, Medtronic, UBER) How social network can Make us smarter (Social Physics research by Pentland helps us to understand how idea flow from person to person through the mechanism of social learning and ends up shaping the norms, productivity and create output for companies, cities and societies). Business needs to use personal data to create best services and products, or for creating new stream of revenue. CHALLENGES Risk of Abuse increases tension and reduces the trust between consumers and companies. HOW Towards an Extreme Trust as competitive advantage New Deal on Data: approach that build trust Examples (Facebook beacon, Metadistretti e-monitor) WHAT User Managed Access: Business Value Proposition Template Target personas (template) Use Case (template) I hope it help for future extensions. Thanks. Domenico

2 1

Reviewing our issue #239 materials and considering a new mitigation idea
by Eve Maler 10 Mar '16

10 Mar '16

Maciej has prepared a new version of the extension spec, and it's now on GitHub <http://htmlpreview.github.io/?https://github.com/KantaraInitiative/wg-uma/b…>. And thanks to input from Sarah, I've put together a companion non-normative document on the UMA wiki <http://kantarainitiative.org/confluence/display/uma/Understanding+the+Sessi…> . In writing the final part of the companion document, I started thinking about a potential new mitigation idea when it came to describing why strong authentication *after* claims-gathering wouldn't work: I suddenly wasn't sure that strong auth doesn't work in all circumstances. *N.B.:* With this inquiry, note that my goal isn't to delay getting the word out about this whole thing! It's simply to consider any mitigation that might be reasonable, and discard it expeditiously if it doesn't fit. So I'm hoping we can examine it in our call and: a) reject it as unsuitable, b) reject it as technically suitable but failing some other criterion, or c) accept it as an alternate or additional mitigation. So here goes. Given the following: - The cycle of trust elevation (need_info) is repeatable, according to AS needs. (Which gives an interestingly flexible mechanism.) - Only trust elevation that uses the requesting party claims endpoint is susceptible to session fixation. ...I started wondering whether it *might* be viable to suggest the following as a mitigation: - The policy conditions include both some claim(s) being supplied and, *afterward*, Bob being able to authenticate, to some level of strength, as Bob. (That is, there is a certain authentication_context and identity required, whether explicitly in an error_details hint, or implicitly. Currently we only have an in-band way to indicate authentication hints, not the required identity.) Notice that a precondition for the attack is that Eve and Bob each have their own AATs, even though their clients have identical client IDs; this gives a hook for transaction context differentiation. The theory is that, if Eve were to initiate the session, phish Bob to gather his credentials, and then take over again after he's done, Eve would fail the second policy condition because she can't authenticate as Bob -- unless she also stole his credentials, and that's a different attack entirely. And if Bob started the session legitimately, then of course Eve missed her chance to phish him and he can pass the strong-auth trust elevation test himself. Recall that elevating trust through authentication_context is basically like refreshing/strengthening the AAT. If anyone wants to squeeze identity out of an AAT, it's best to use OIDC vs. plain OAuth for it. My investigations showed that using an AAT for trust elevation is not unknown -- in fact, it's known to both Gluu and ForgeRock, in cases where you expect the AS to serve as the IdP for the requesting party as well as the resource owner. I suspect there may be privacy considerations to doing this in other topologies that should be carefully examined -- such as, could a requesting party's "AAT identity" compromise him somehow if it is used as part of trust elevation in addition to "claims-based RqP identity" at the AS? I thought this was incontrovertibly true once, but I haven't been able to re-prove it to myself... That's probably enough/too much food for thought for now, from me. I know others will want to jump into the thread before the meeting with more. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-03-10
by Eve Maler 09 Mar '16

09 Mar '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-10 Date and Time - *Thu Mar 10,* 9-10am PT (*N.B.:* North America will change to Daylight Savings Time next week; this week is normal but *NEXT WEEK WILL BE ABNORMAL*) - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-02-25 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-02-25> - Quick reports from sync meeting, RSA, and HIMSS - (And don't forget to sign up for IIW) - Consider new mitigation thought on issue #239 and review draft extension spec and non-normative doc - Proposal for new "Why UMA?" wiki area - Charter-bashing <https://docs.google.com/document/d/1cv7MLdpC1SMubREbZX7L8E4YUPCAzKPwOCFBky6…> (if anyone has done any homework...) - AOB - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: APAC-friendly sync 2016-03-10
by Eve Maler 09 Mar '16

09 Mar '16

- *Thu Mar 10* at APAC-friendly times - Voice: Skype: +99051000000481, room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - See the UMA calendar for additional dial-in and timing details (e.g., the call time = *Wed Mar 9 4pm PT*): http://kantarainitiative.org/confluence/display/uma/Calendar If you wish to be added to the calendar invitation, send me a note. If you wish to be added to our Skype chat group to receive reminders before I open the bridge, include your Skype handle. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. Others besides those in APAC-ish regions are welcome to join. This sync series has been useful for some who have a standing conflict with our weekly WG calls. However, the sync series doesn't "count towards quorum" if you're a voting participant. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: [KI-LC] Real (and Open) Consent Workshop Announcement
by Eve Maler 06 Mar '16

06 Mar '16

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Mark Lizar - OCG <m.lizar(a)openconsentgroup.com> Date: Fri, Mar 4, 2016 at 12:59 PM Subject: [KI-LC] Real (and Open) Consent Workshop Announcement To: Kantara Leadership Council Kantara <lc(a)kantarainitiative.org> Hi LC, FYI - Please pass on. *** Dear Colleagues, I am very happy to announce the the next workshop in our year long series of events on Consent & Design at Digital Catapult in London. *We would like to invite you to attend on March 21, from 10am to 4pm.* Here is a link to sign up and more information: <https://www.eventbrite.co.uk/e/real-consent-consent-design-tickets-22274347…> *As we are all aware consent as it currently managed online is broken and doesn’t provide people real consent. * The next workshop in the series is mapping the landscape of Consent & Design. We will be hosting some industry speakers, mapping design elements, then delving into how design aspects effect the metrics of usable consent. A topic well discussed in our first workshop <https://www.linkedin.com/groups/8484951/8484951-6111199357825007621>. The event series aims to produce a Real Consent Cookbook *for implementation, design and evaluation *of modern consent. *We will also focus on topics such as consent trust metrics, and how real consent can hep to build trust frameworks*. *We are also open to hear your suggestion in this space. If you have a topic you would like to see covered in our upcoming discussion, please let us know. * We invite you to (re) join a new LinkedIn Group <https://www.linkedin.com/groups/8484951>, specific to Real Consent topic. (to keep discussion going between workshops) Which is where you can find a summary of the last workshop. Planned Workshops: March 21: Consent & Design May 27: Trust & Consent Sept 26: Consent & Design Metrics We are proudly sponsored by the @Kantaranews and @DigitalCatapult #PDT - but we are still looking for sponsorship of the cookbook and the lunch at the workshops. If you are interested in either or both please get in touch. Kind Regards, Mark Lizar Executive Director Open Consent Group Email: m.lizar(a)openconsentgroup.com Mobile: +447738382658 Twitter: @smartopian _______________________________________________ LC mailing list LC(a)kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/lc

1 0

Reminder: No WG or legal meeting this week
by Eve Maler 02 Mar '16

02 Mar '16

Too many people traveling. Hope everyone is having a fun and productive time! Good seeing a few of you at the Non-Profits on the Loose party last night! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Re: [WG-UMA] Draft minutes of UMA telecon 2016-02-18
by Eve Maler 28 Feb '16

28 Feb '16

Interesting indeed. In the WG call yesterday, we talked about focusing on four UMA topics at IIW, and one of them was our legal "model text" work. I would love to learn more about how these domains are used in practice, and see where the business-legal frictions might come into play if they were used as authorization servers. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Sat, Feb 20, 2016 at 9:23 AM, Phillip J. Windley Ph.D. <windley(a)gmail.com > wrote: > BYU and several other schools do a Domain of One’s Own project with > students. BYU has about 2000 domains right now (these are com, org, net, > and us domains that the student picks and owns and can take with them after > graduation). The point is to teach students about managing their own online > identity independent of the administrative identities they get elsewhere > (the school, Facebook, Gmail, etc.) and give them experience in being > independent digital citizens. The domains are used for everything from > class projects to rock bands. > > As part of that effort we’ve been working on ways the domain could host > applications the student might use to interact with the school and other > entities. As a counterpoint to our University API project, we also have a > Personal API project. The first applications will likely be student > profiles and portfolios. > > The question about manage authorizations always comes up. I always have > imagined that the domain (standard Cpanel-based hosting account) would have > some kind of AS running in it, but have never worked through the details. > So, FWIW, there’s another personal AS scenario. > > On Feb 20, 2016, at 9:51 AM, Eve Maler <eve(a)xmlgrrl.com> wrote: > > I agree with you both that it's technically feasible for a single person > to run a personal AS. > > From a practical "ecosystem growth" standpoint, I wonder whether certain > other service/app operators might have some (irrational? perceptual?) issue > with dealing with an AS whose Operator is the Authorizing Party. We already > know certain RS's (*coff* hospitals) are nervous to outsource authorization > to a third party at all (the genesis of the Binding Obs work). > > I wonder if the best shot for people running their own personal AS's might > actually be a "smart home hub". We're already seeing home VPN devices > billed as "privacy" products, along with other devices that control > multiple other IoT thingies. > > Eve Maler (sent from my iPad) | cell +1 425 345 6756 > > On Feb 19, 2016, at 7:53 AM, John Wunderlich <john(a)wunderlich.ca> wrote: > > Adrian; > > Owning/operating an AS is not unrealistic technically. It’s unrealistic In > the same way that most people CAN change their own oil in their cars, but > don’t. > > I suspect that most people’s view - even after an explanation of how UMA > works - is that it would be too much trouble to own/manager their own AS. > If/when the AS becomes an app on their phone, or a key fob with a one > button press functionality, (assuming that carrying your AS with is a good > thing) then the case would be different - and would suggest a separation of > AS from IdP(s). > > Sincerely, > *John Wunderlich* > *(@PrivacyCDN)* > > <PastedGraphic-4.tiff> <http://privacybydesign.ca/> > <http://privacybydesign.ca/> > > > <http://privacybydesign.ca/>Privacist & PbD Ambassador > <http://privacybydesign.ca/> > > > > > On Feb 19, 2016, at 10:14, Adrian Gropper <agropper(a)healthurl.com> wrote: > > John, > > We seem to agree that the AS is naturally separate from whatever IdPs and > credential brokers will evolve. > > The opportunity to own one's AS in the cloud is more realistic every day. > A microservices architecture like AWS Lambda can expose HTTPS endpoints > with Let's Encrypt certificates without the hassle of managing OS and OS > security for a VM. AWS Lambda can run a personal UMA AS written in Node or > Python (like HIE of One) using almost no resources and might cost less than > the $10 / year that I pay for the personal domain. I see an UMA AS becoming > like the email forwarding service offered for free by some registrars with > just a more complex user interface. > > Adrian > > On Fri, Feb 19, 2016 at 9:54 AM, John Wunderlich <john(a)wunderlich.ca> > wrote: > >> It seems to me that this elides several use cases. If we set aside the >> currently unrealistic expectation that each person will own one or more >> AS’s, then the most likely location for a self-owned AS is in the home, or >> in a cloud service provided to the individual (a cloud home so to speak). I >> can see where I’ll want to use an authoritative IdP for some kinds of >> transactions and identities - health (hospital as IdP) and finance (bank as >> IdP) - but I can see multiple scenarios involving social identity where I >> would want to self assert to have the capability for multiple (disposable) >> identities. This isn’t just the case for teenagers and trolls, but would >> also be the case for human rights workers and democracy activists in any >> number of countries. >> >> Sincerely, >> *John Wunderlich* >> *(@PrivacyCDN)* >> >> <PastedGraphic-4.tiff> <http://privacybydesign.ca/> >> <http://privacybydesign.ca/> >> >> >> <http://privacybydesign.ca/>Privacist & PbD Ambassador >> <http://privacybydesign.ca/> >> >> >> >> >> On Feb 18, 2016, at 19:47, Eve Maler <eve(a)xmlgrrl.com> wrote: >> >> A question to Adrian about the goal of making an AS lighter and more >> generic so that each individual can own one: Do you think it's likely that >> the AS function and the IdP function are likely to remain entirely >> separate, and not be co-located in at least some instances? (I'm guessing >> your answer will be yes, because you've separated out the "lightweight AS" >> and the "RS-as-IdP" roles here, but I may be wrong.) >> >> >> >> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >> >> >> On Thu, Feb 18, 2016 at 11:05 AM, Adrian Gropper <agropper(a)healthurl.com> >> wrote: >> >>> To be clear, my suggestion about IdP in the #wideeco is for the #wideeco >>> AS to be given the option of using the RS as Bob's IdP. That is very >>> different from the RS being the IdP and AS if that's how I read the >>> minutes. >>> >>> In general, I'm looking for ways to make the AS lighter and more generic >>> so that each individual can own one. In the HIE of One brand #wideeco >>> model, the UMA AS is also always an OpenID Connect Client so that any RS >>> that chooses to support OIDC Dynamic OP can offer this as part of the >>> resource registration agreement with a #wideeco AS. This also enables the >>> AS to register other well-known IdPs like Google and make these available >>> as a NASCAR to Bob. As blockchain ID catches on (onename >>> <https://bitcoinmagazine.com/articles/onename-launches-blockchain-identity-p…> >>> and uPort >>> <https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-browser-b133a83fe…>), >>> the #wideeco AS will be able to offer this as an option as well. >>> >>> Adrian >>> >>> >>> >>> On Thu, Feb 18, 2016 at 1:09 PM, Eve Maler <eve(a)xmlgrrl.com> wrote: >>> >>>> Great meeting, all! >>>> >>>> >>>> http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-02-18 >>>> MinutesRoll call >>>> >>>> Quorum was reached. >>>> Approve minutes >>>> >>>> Minutes of UMA telecon 2016-01-07 >>>> <http://internetidentityworkshop.com/> approved. >>>> Issue #239 >>>> >>>> - *Proposal:* Regardless of other decisions, develop a >>>> non-normative analysis of the attack and mitigations; revise as appropriate >>>> depending on other decisions taken (Sarah has this AI already) >>>> >>>> Proposal accepted. >>>> >>>> - *Proposal:* Develop an extension specification, Enhanced >>>> Claims-Gathering Security Extension, to require cycling of the permission >>>> ticket when using the claims-gathering extension >>>> >>>> Sal and Eve just discussed in email whether a stronger authentication >>>> mitigation would work. Session fixation happens after victim >>>> authentication, so it wouldn't help. >>>> >>>> Robert mentioned to Eve offline that Wikipedia has some comments on >>>> session fixation that might be useful. Eve believes that since the >>>> permission ticket gets passed in UMA JSON messages, the countermeasures >>>> there may not apply, but we could look (for purposes of the non-normative >>>> analysis if ultimately nothing else). >>>> >>>> - *For discussion:* Consider also handling issue #167 in this >>>> extension if it has a security rationale >>>> >>>> If the AS uses the flexibility to give a new endpoint, then there's the >>>> danger of giving an attacker new information outside of the discovery >>>> document that it didn't have before, which is a degradation of security. If >>>> the AS doesn't avail itself of the flexibility, then it doesn't seem to add >>>> anything. In any case, we're not thinking of a security rationale for >>>> adding this feature to the extension. In any case, it sounds like taking up >>>> #167 as part of the extension work doesn't meet our "#security use case >>>> bucket" goals, so we'll defer that till such time as we take up "#simplify >>>> use case bucket" work. >>>> >>>> *Consensus:* We want to write and publish the extension specification. >>>> >>>> - *For discussion* (thanks Andi for these two new bullets!): >>>> Consider updating the UMA Core spec in some way to point non-normatively to >>>> the extension spec, and/or mention it from the UIG >>>> - *For discussion* (possibly at a later juncture): Consider >>>> if/when/how to fold the extension into a future UMA version (likely to be >>>> captured as a GitHub issue) >>>> >>>> The WG itself can self-approve a technical specification, and the LC >>>> can approve that group output. (Are these "WG Reports"? Eve will check with >>>> the LC.) In other words, this could remain at a level sort of equivalent to >>>> an IETF I-D and not progress to an "RFC" level before it eventually gets >>>> absorbed into a later version of the UMA Core spec. We do want to recommend >>>> that everyone using the claims-gathering endpoint use this approach, but it >>>> all depends on the timing of any new UMA "V.next" version. We basically >>>> need to defer the decision about its "track" until we execute on the rest >>>> of our roadmap. >>>> >>>> *AI:* Eve, Domenico, Maciej: Write the extension spec. >>>> >>>> Can we publish these by next Thursday? Let's give the old college try. >>>> We want to publish and publicize the draft docs at the same time. >>>> Wide ecosystem challenges >>>> >>>> Eve presented a set of high-level statements that describe the dual >>>> nature of the challenges. Eve/James and Maciej will share some material on >>>> the challenges. >>>> >>>> John observes that it's an ouroboros – a snake eating its own tail (or >>>> as Eve likes to call it, the bubble under the wallpaper that you can move >>>> but you can't remove). >>>> >>>> Some discussion arose about different solutions, e.g.: >>>> >>>> - UMA-protected user claims endpoint ("UserInfo") >>>> - Agreed-on central authority (e.g. hospital) serving as a claims >>>> endpoint/AS (?) – akin to the question that has arisen over the last >>>> decade-plus about "who's the IdP" >>>> >>>> The group agreed to collect all the potential solutions "without fear >>>> or favor" and then analyzes how well they solve the challenges. >>>> Attendees >>>> >>>> As of 16 Feb 2016, quorum is 6 of 10. (François, Domenico, Kathleen, >>>> Sal, Thomas, Andi, Robert, Maciej, Eve, Mike) >>>> >>>> 1. Eve >>>> 2. Kathleen >>>> 3. François >>>> 4. Domenico >>>> 5. Sal >>>> 6. Mike >>>> 7. Maciej >>>> >>>> Non-voting participants: >>>> >>>> - John W >>>> - Sarah >>>> - Adrian >>>> - George >>>> - Scott >>>> - Mark >>>> - >>>> >>>> >>>> >>>> *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>>> >>>> >>>> _______________________________________________ >>>> WG-UMA mailing list >>>> WG-UMA(a)kantarainitiative.org >>>> http://kantarainitiative.org/mailman/listinfo/wg-uma >>>> >>>> >>> >>> >>> -- >>> >>> Adrian Gropper MD >>> >>> PROTECT YOUR FUTURE - RESTORE Health Privacy! >>> HELP us fight for the right to control personal health data. >>> DONATE: http://patientprivacyrights.org/donate-2/ >>> >> >> _______________________________________________ >> WG-UMA mailing list >> WG-UMA(a)kantarainitiative.org >> http://kantarainitiative.org/mailman/listinfo/wg-uma >> >> >> >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they are >> addressed. If you have received this email in error please notify the >> system manager. This message contains confidential information and is >> intended only for the individual named. If you are not the named addressee >> you should not disseminate, distribute or copy this e-mail. Please notify >> the sender immediately by e-mail if you have received this e-mail by >> mistake and delete this e-mail from your system. If you are not the >> intended recipient you are notified that disclosing, copying, distributing >> or taking any action in reliance on the contents of this information is >> strictly prohibited. >> > > > > -- > > Adrian Gropper MD > > PROTECT YOUR FUTURE - RESTORE Health Privacy! > HELP us fight for the right to control personal health data. > DONATE: http://patientprivacyrights.org/donate-2/ > > > > > This email and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the system manager. > This message contains confidential information and is intended only for the > individual named. If you are not the named addressee you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately by e-mail if you have received this e-mail by mistake and > delete this e-mail from your system. If you are not the intended recipient > you are notified that disclosing, copying, distributing or taking any > action in reliance on the contents of this information is strictly > prohibited. > > <signature.asc> > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > http://kantarainitiative.org/mailman/listinfo/wg-uma > > >

2 1

Notes from UMA legal telecon 2016-02-25
by Eve Maler 26 Feb '16

26 Feb '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes 2016-02-26 - Resource owners and those acting on their behalf: what language do we need to support the distinction? Any additional use cases? Any additional insight on technical design patterns? - We said we'd try to conclude this decision-making process by this week, and then move on to the decisions about RS actions in contradiction. Attending: Eve, Adrian, Ann, Andrew, Mark, Sal, Kathleen, John Kathleen had summarized it in our WG call yesterday that this is an "owner" and an "on behalf of" problem. Adrian asks: Is it clear that there need to be separate credentials for these two roles (something like subject and custodian)? Kathleen's work at HL7 includes three roles: the *subject* of consent directive (of governed information), the *grantor* (the consentor who grants access), and the *grantee* (the one to whom access is delegated). Eve is familiar with a project where UMA is being contemplated where subject and delegate are the terms used, where she suspects (*subject* +*grantor*) and *grantee* map perfectly onto Kathleen's terms, and she knows they map exactly onto UMA's *RO* and *RqP* terms. Let's put the "third term" aside since it seems there's no controversy about the mappings (for the moment), and concentrate on the "split RO" nature of the use cases in front of us. Do we have to distinguish "who logs in to the AS" vs. "who logs in to the RS only"? Adrian asks: In our use cases from last week, are there separate credentials? We need to know the exact UMA design pattern we're looking at to know the answer, because otherwise the specific identity ecosystem in place is unknown. Andrew suggests: Is the question really about whether the RSO cares who the ASO is? Let's say a hospital IT department is the RSO and the healthcare insurer (Eve adds: or EHR SaaS vendor or government agency or whatever...) is the ASO. Going back to the key issue: Adrian presumes that the AS presents a certificate and the RS gets to look at that certificate and see if it trusts it. But Eve points out this is off-track for the subject of this call. Any AS cert is for the whole AS. Let's return to (*subject*+*grantor* ). Regarding the terms coming from HL7, FHIR is taking this nomenclature work even farther. Eve wonders: Could subject and grantor suffice as terms for us, even if the subject isn't even literally the data/PII subject? Like, e.g., what if the "subject" created the digital artwork that is being sold and the grantor is managing access to the painting on behalf of the subject because they're no longer legally competent to be party to contracts? In health, a donor or cadaver might not be donating data, but body parts! (?) The current theory/hope is that *Subject* could be a good new term for the "true resource owner" who might not be legally competent or might not be in a position to manage resource access at the AS. (Note that "control" is the verb we use on the UMA marvelous spiral architecture diagram to denote what the RO does at the AS.) If we need to get more specific in any of our model clauses regarding resources that truly contain PII, perhaps we need to clarify in the definition that UMA allows for resources not to contain PII, and then define a more specific term, *Data Subject* or *PII Subject* or *Resource Subject* (as discussed in notes below), specifically for resources that do contain it. (Do we also have to define the term *Resource* and/or *Protected Resource* in our model definitions?) More current theory/hope: *Grantor* could be a good new term for the "guardian" of a legally incompetent Subject, or designated "proxy"/"agent" for a legally competent Subject, who exclusively manages resource access at the AS on their behalf. [Added after the call:] Eve's theory about the UMA design pattern in this case is this: The Grantor is the *only one* that interacts with the AS (e.g., logs in there, creates policies, etc.) If the Subject is capable of managing resources in an online fashion ("manage" is the verb we use on the UMA marvelous spiral architecture diagram to denote what the RO does at the RS, but also the verb we use to denote what the RqP does at the client), then in fact what could happen is that the Grantor sets up policies for the Subject to become an RqP to their own resources, accessing them through RS-that-is-also-a-C, and requiring that the Subject use the same AS as the Grantor to enable full Grantor oversight capabilities. (This is a known limitation due to #wideeco realities.) More current theory/hope: We could replace *Authorizing Party* with Subject and Grantor. More current theory/hope: *Grantee* could be a good new term for Requesting Party. *AI:* Kathleen: Share HL7-based definitions of subject and grantor (and grantee) with UMA WG so we can try out definitions for our own purposes. (ISO standard basis for the definition – what is the ISO number? -- can't be shared because they're not free standards.) *AI:* Adrian: Work with Kathleen to capture the "joint control" of painting resource example and share with the list. *AI:* Eve: Add GitHub issues for the new model definition ideas. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-02-26
by Eve Maler 26 Feb '16

26 Feb '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-02-26 - Resource owners and those acting on their behalf: what language do we need to support the distinction? Any additional use cases? Any additional insight on technical design patterns? - We said we'd try to conclude this decision-making process by this week, and then move on to the decisions about RS actions in contradiction. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1