- WG-UMA - mailman.kantarainitiative.org

Article: "Why protecting privacy is a losing game today—and how to change the game"
by Thomas Hardjono 20 Jul '18

20 Jul '18

Dear UMAnitarians, You might find this article interesting: "Why protecting privacy is a losing game today—and how to change the game". https://www.brookings.edu/research/why-protecting-privacy-is-a-losing-game-… Best -- thomas --

5 6

W3C Workshop on Permissions and User Consent Sep 18-19 in San Diego
by Eve Maler 17 Jul '18

17 Jul '18

https://www.w3.org/Privacy/permissions-ws-2018/cfp.html Note that there's also Consumer Identity World Sep 19-21 in Seattle. (I'll be speaking there in the Kantara workshop session.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-07-12
by Eve Maler 12 Jul '18

12 Jul '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-07-12 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-06-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-14>: Deferred. Vermont's new law David worked on Vermont's new S.269 <https://legislature.vermont.gov/assets/Documents/2018/Docs/ACTS/ACT205/ACT2…> ensconcing Personal Information Protection Companies (PIPC) (see the news <http://www.gravelshea.com/wp-content/uploads/2018/06/Blockchain-Terrain.pdf>). The law sets up a basic framework for PIPCs, but there is a lot of room for the specifics. Tim had a role in the work as well. Sec. 5 in the law calls for a FinTech Summit to be held, and the Department of Financial Regulation to take further steps. There could be appetite for learning how UMA can provide value in separating "personal information" services from "protection" services. Thomas served as a moderator at the DC blockchain caucus. The blockchain startup CEOs mentioned Vermont as leading in the area of "blockchain sandboxes", but being blocked at the federal level. Propy is a new company in Vermont doing <https://blog.propy.com/propy-announces-first-us-pilot-with-vermont-23ec0b2d…> land registry/real estate recording. Because of the US blockages, the first POC was in Ukraine. What about UMA with and/or vs. DIDs? Eve's recent answer when asked: "I know of a couple of projects that combine them, and I consider them complementary. UMA has long had a design principle about being “ID-agnostic” (see the Charter <https://kantarainitiative.org/confluence/display/uma/Charter>) and it seems to work. Also, the actual consent, permissioning, and access control mechanisms built into SSI-type systems, as far as I can see, aren’t directly related to their blockchain tech but are part of the rest of their app stack. So they [the consent/permissioning/access control mechanism] could be proprietary, OAuth/UMA-based, etc." More specifically, UMA has several places where identifier/claim sources come into play: How a RO identifies themselves to the RS, how a RO identifies themselves to the AS, how the AS gathers claims from the RqP interactively, and how the client conveys a claim token to the AS token endpoint. Mike notes that a DID is a reference to what UMA calls a claim token and, we think, doesn't specify a format. The BSC DG report <https://kantarainitiative.org/file-downloads/report-from-the-blockchain-and…> has a figure illustrating the role of blockchain tech (potentially necessary, but always insufficient) in an app stack. Leadership team elections The current leadership team roster is here <https://kantarainitiative.org/confluence/display/uma/Leadership+Team>. *MOTION:* Sal moves: Eve to serve as chair for another annual term and Maciej to serve as vice-chair for another annual term. APPROVED by unanimous consent. New issue 361 Next time we open up the specs, we'll take a look at this. Discuss/compare financial and health "multi-portal problem" use cases - Discuss/compare HEART <http://openid.net/wg/heart/> use case Alice Shares Clinical Records With Her Spouse <http://openid.net/wordpress-content/uploads/2018/07/AliceSharesClinicalReco…> and Origo use case (see their architecture <https://www.origo.com/news/PensionsDashboardArchitecture.aspx> description, adoption <https://www.origo.com/news/Bringing_Pension_Industry_On_Board_Pensions_Dash…> recommendations, and performance testing <https://www.origo.com/news/Pensions_Dashboard_Scalability_Release.aspx> news) for cross-sector implications of the "multi-portal problem" - May relate to issues 53 <https://github.com/KantaraInitiative/wg-uma/issues/53> (Assess interest in making AM a formal client of APIs for policy servers, interaction services, etc.) and 106 <https://github.com/KantaraInitiative/wg-uma/issues/106> (Have an API to let an RS register the user’s sharing preferences/policies directly) Maybe new UMA infrastructure (Eve had been imagining that you need a formal policy API and a "consent API access token" or CAT!) isn't strictly necessary, at least for now. Looking at the Origo solution (see the two-part UK Pensions Dashboard scenario in the "Legal role definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>" slides), its Pensions Dashboard service is the unique client app that then presents a policy-setting service to the RO. It needs the two-step approach that Origo uses, but it works for then sharing with RqPs who aren't equal to Alice, and for centralized policy setting with a client where the business climate (as in US healthcare today) wouldn't be friendly to each AS not working with competitor RS's running policy interfaces. This solution may be a common design pattern. AI: Eve: Intro Nancy and David in email to pursue the topic further prior to the next call (which is *July 26*). Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Maciej 3. Eve 4. Mike Non-voting participants: - Thomas - Nancy - Bjorn - David Thelander - lawyer - licensed in Vermont, SEC background, Gravel & Shea, blockchain and identity trust companies Regrets: - Domenico *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-07-12
by Eve Maler 11 Jul '18

11 Jul '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-07-12 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-06-14 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-14> - Leadership team elections: chair, vice-chair for annual term - Note: New issue 361 <https://github.com/KantaraInitiative/wg-uma/issues/361>: OAuth AS metadata spec is final (no action now) - Discuss/compare HEART <http://openid.net/wg/heart/> use case Alice Shares Clinical Records With Her Spouse <http://openid.net/wordpress-content/uploads/2018/07/AliceSharesClinicalReco…> and Origo use case for cross-sector implications of the "multi-portal problem" - May relate to issues 53 <https://github.com/KantaraInitiative/wg-uma/issues/53> (Assess interest in making AM a formal client of APIs for policy servers, interaction services, etc.) and 106 <https://github.com/KantaraInitiative/wg-uma/issues/106> (Have an API to let an RS register the user’s sharing preferences/policies directly) - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Indian Consent Tech Framework
by Adrian Gropper 08 Jul '18

08 Jul '18

See attached. I'm involved in various (health) data infrastructure policy groups for India. I consistently try to steer them in the direction of UMA. This document is referenced in relation to India Stack and National Health Stack for India. There's a lot going on and it seems to be moving quite quickly. I'm looking for allies and help with comments as might come up. -- Adrian

1 0

No meeting tomorrow (Jun 21) / leadership team elections
by Eve Maler 20 Jun '18

20 Jun '18

Let's not meet tomorrow after all. Key folks are too busy with Identiverse prep and travel, and our agenda is a little too short to justify going ahead with it. So we won't meet again until *Jul 12*. The online calendar is here <https://kantarainitiative.org/confluence/display/uma/Calendar> for your reference. I'd like to remind voting participants that our *Chair and Vice-Chair positions are coming due for re-election*; currently these positions are filled by me and Maciej, respectively. You can see the entire leadership team roster here <https://kantarainitiative.org/confluence/display/uma/Leadership+Team>. If you'd like to put in nominations, please send them to me ahead of time -- or you can bring them up on the call if you like -- and we'll be holding elections on the 12th (assuming we're quorate). Let me know if you have any questions. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Lighter UMA Work Group meeting schedule for the summer
by Eve Maler 19 Jun '18

19 Jun '18

As mentioned in last week's meeting, we are not meeting on June 28 (just after Identiverse) or July 5 (just after the US Independence Day holiday). We are meeting June 12. After that, I have removed meetings every other week from the calendar through August 30. Enjoy! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-06-14
by Eve Maler 14 Jun '18

14 Jun '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-06-07 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07>: APPROVED by unanimous consent. Michigan Health Information Exchange The Michigan HIE had a connectathon with a use case that was very UMA-like. A patient who has just reached the age of 18 is able to share info with another app or whoever she wants, using her right of access. The use case involves using filters and labels so that HPV information doesn't reach her parents. It's a healthcare + education use case. Upcoming meeting planning - Meet Jun 28 right after Identiverse? - No meeting July 5 - Should we reduce the meeting schedule over July/August? - Who might attend a Kantara plenary on Fri Oct 26 (just after IIW)? Potential cross-group agenda items (e.g. IRMWG, CISWG, CMWG...)? No meeting Jun 28, no meeting Jul 5, chop out some meetings in Jul and Aug. Who might be available for a Kantara plenary? Chris Blanton from Gluu, Adrian, Eve, possibly Maciej. Adrian has tried to bring the SSI and Kantara communities together. Gluu has demonstrated that a "SSI claim" can be used to satisfy policy, and IIW itself can be used for discussing combining UMA and SSI to the extent that this is of interest, or if there are challenges that are arising. On the other hand, there are potentially opportunities not yet being exploited. Other cross-group agenda items Eve had thought of were along the lines of the "cradle-to-grave scenarios" and solving them with suitable application of IRM workflows and throwing off receipts, but we haven't gotten any farther than that. UMA and Decentralized Identity Foundation Adrian has been advocating for UMA being a component of DIF <http://identity.foundation/>'s "hub" role. Kim Cameron spoke on this at EIC18. Let's start to take a look at what this might mean over the summer. Decoupled flow Deferred. Enterprise use cases/Gluu Gateway Mike showed a demo; find it here <https://github.com/GluuFederation/gluu-gateway/tree/master/gg-demo>. It uses Kong underneath. Question: Kathleen: Can it handle scopes like HEART has? The Gluu take is that scopes map to policies on the Gluu Server. An UMA scope might be something like "OutSideUS", and the policy is a Python script. The policy provides context: Who is the subject? What is the client? It could call an external RBAC or XACML PDP. The gateway (proxy) is really simple; it's the PEP; it doesn't know anything about that. (See the documentation <https://gluu.org/docs/gg/>.) It introspects the token and caches the results. So if an API comes with whatever scope design, can it handle that and map to policy as necessary? Yes. You can switch from "UMA Resources" (settings for resources with their scopes) to "OAuth Scope Security". Mike is seeing a lot of consumer use cases for the gateway these days, and use with microservices. What is the business case? - Proxy for APIs for internal and external services that are containerized - Centrally enforce access - Rate limiting for DoS protection, billing, etc. UMA2 masterclass materials Eve walked through the draft slides for the masterclass she and Mike are doing at Identiverse. The "federated authorization" language is challenging to people, so it's now "externalized" authorization. People will review the deck more before Monday. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Maciej 3. Eve 4. Mike Non-voting participants: - Scott - Bjorn - Kathleen - Adrian - Tim - Nancy Regrets: - Andi - Cigdem *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Who is responsible for Client Registration?
by Adrian Gropper 14 Jun '18

14 Jun '18

Folks, This issue has come up as I am looking into issues raised by the recently announced API access to individual's Medicare records: https://bluebutton.cms.gov/developers/#production-api-access To frame the issue, under current US law, the patient has an unrestricted right to directed access (patient can specify any address for the record to be sent to directly) to their own data, at least when the access is via paper or fax. The question is how will patient-directed access work on top of a FHIR API. For example, the policy for registering an OAuth client to the production Open.Epic FHIR API, is accessible to anyone willing to assume the role of "developer" and holding a valid credit card. The Client registration process is tedious and takes up to 24 hours, but otherwise unrestricted. The process for registering a client to the Medicare production API (link above) is considerably more tedious and expensive. It involves a claim that you're a US corporation, a link to a privacy policy, a telephone conference, and up to two weeks delay. Which brings up my UMA question: Who is responsible for RqP's (Bob) Client Registration (OAuth or UMA)? (1) Is it the patient, because under patient-directed access the patient takes all responsibility for Bob's actions? (2) Is it Bob, because he is presumed to have the responsibility for his own Client and patient Alice has no real way to know much about Bob's client? (3) The Resource Server is responsible but highly constrained in its actions by HIPAA and the API Task Force that say that patient-directed Client access can be denied only in the case of security violations like a DoS attack? What is the current situation with or without Dynamic Client Registration in OAuth and UMA? Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: https://patientprivacyrights.org/donate-3/

2 2

Agenda for UMA telecon 2018-06-14
by Eve Maler 13 Jun '18

13 Jun '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-14 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-06-07 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-06-07> - Upcoming meeting planning - Meet Jun 28 right after Identiverse? - No meeting July 5 - Should we reduce the meeting schedule over July/August? - Who might attend a Kantara plenary on Fri Oct 26 (just after IIW)? Potential cross-group agenda items (e.g. IRMWG, CISWG, CMWG...)? - Decoupled flow if new data - Enterprise use cases/Gluu Gateway - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0