- WG-UMA - mailman.kantarainitiative.org

UMA-based Pensions Dashboard Programme final standards approved and being used
by Eve Maler 20 Mar '25

20 Mar '25

I’m subscribed to the UK Pensions Dashboard Programme emails, and saw a notice today that all of its related standards, including the “technical standards” (among which are its UMA profiles), were approved for use as of March 13th. <https://www.pensionsdashboardsprogramme.org.uk/standards/technical-standards> pensionsdashboardsprogramme.org.uk<https://www.pensionsdashboardsprogramme.org.uk/standards/technical-standards> [X]<https://www.pensionsdashboardsprogramme.org.uk/standards/technical-standards> They also announced on March 5th that three ecosystem participants have successfully connected. <https://parliamentlive.tv/event/index/6c8b9018-cc69-4510-960d-ce001147cb0f> [share.jpg] Parliamentlive.tv<https://parliamentlive.tv/event/index/6c8b9018-cc69-4510-960d-ce001147cb0f> parliamentlive.tv<https://parliamentlive.tv/event/index/6c8b9018-cc69-4510-960d-ce001147cb0f> Pretty cool! [VF Logo Light Green Mix (on Dark BG) for email sig.png] Eve Maler, president and founder Cell and Signal +1 (425) 345-6756<tel:+1-425-345-6756>

3 2

Security Notification: Pass the permission ticket vulnerability
by Alec L 19 Mar '25

19 Mar '25

Hi, This is a notice of an identified vulnerability in the UMA 2 specification. Please refer to the attached documents for full details, including recommended next steps for mitigation if your implementation is affected. Many thanks to Gabriel Corona for his efforts in finding, documenting and explaining these issues to us! Please reach out if you'd like to discuss further, Best, - Alec *Am I impacted?* You are probably not impacted if UMA clients only interact with known resource and authorization services. You might be impacted if the following are true: * the UMA client is able to start flows with any UMA resource server * the UMA client is able to start flows with any UMA authorization server * the authorization server supports open dynamic registration of clients, without any pre-registration process or requirements for the client. In this case, you probably can't be sure that the client isn't a malicious AS Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec(a)identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/>

3 4

Meeting Series on Vulnerabilities: Nov 7, 21, & Dec 5
by Alec L 07 Nov '24

07 Nov '24

Hi all, A few of us met this week and had a productive discussion about the disclosed vulnerabilities previously shared with the list. We decided to hold a series of three meetings to develop and publish a document outlining conditions and mitigations for implementers. The calls will be held on our normal bridge and time slot, Thursdays @ 1PM ET, on the following dates: Nov 7, Nov 21, & Dec 5 https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 Please reach out if you have any questions, or need help adding the meeting series to your calendar Best, - Alec Alec Laws CTO Engineering | IDENTOS Inc. [image: mobilePhone] (647)-822-1529 [image: emailAddress] alec(a)identos.ca [image: twitter] <https://twitter.com/identos_inc> [image: linkedin] <https://www.linkedin.com/company/identos-inc/>

1 1

Disclosure of a vulnerability in UMA 2.0
by Gabriel Corona 16 Oct '24

16 Oct '24

Hi, While testing UMA 2.0, I found that the protocol was vulnerable to a vulnerability (which may not apply in some deployments). It might be interesting to start by discussing this topic off-list in order to let the implementers the opportunity to implement suitable mitigations before public disclosure. Please let me know if you would be interested. If you know the contact of any other implementers please let me know. Regards, Gabriel Corona

3 3

Agenda for UMA telecon 2024-01-11
by Alec L 11 Jan '24

11 Jan '24

https://kantara.atlassian.net/wiki/spaces/uma/pages/327581697/UMA+telecon+2… Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-07-13 <https://kantara.atlassian.net/wiki/spaces/uma/pages/227311617> - Charter Refresh and 2024 Plan Draft Charter 2024 <https://kantara.atlassian.net/wiki/spaces/uma/pages/300744705> - UK Pensions Dashboard Draft Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> - AOB Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

1 0

Agenda for UMA telecon 2023-12-14
by Alec L 14 Dec '23

14 Dec '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/291340289/UMA+telecon+2… UMA telecon 2023-12-14Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-07-13 <https://kantara.atlassian.net/wiki/spaces/uma/pages/227311617> - Charter Refresh and 2024 Plan Draft Charter 2024 <https://kantara.atlassian.net/wiki/spaces/uma/pages/300744705> - Cancelling Dec 28th Meeting, next meeting Jan 11 - UK Pensions Dashboard Draft Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> - AOB Alec Laws CTO Engineering | IDENTOS +1 (647) 822-1529 <+1+(647)822-1529+color=> alec(a)identos.ca <https://identos.ca/> [image: twitter] <https://twitter.com/aleclaws> [image: linkedin] <https://www.linkedin.com/in/aleclaws/>

1 0

Cancelling Sep 7 WG Call
by Alec L 07 Sep '23

07 Sep '23

Hi all, will have to cancel today's call, apologize for the short notice Best, - Alec

1 0

Agenda for UMA telecon 2023-06-29
by Alec L 29 Jun '23

29 Jun '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/220659713/UMA+telecon+2… UMA telecon 2023-06-29Date and Time - Every other Thursday @ 1:00ET/10:00am PT - Screenshare and dial-in: https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 - United States: +1 346 248 7799, Access Code: 994 8781 4311 - See UMA calendar for additional details: https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar <https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518> Agenda - Approve minutes since UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> - Check-in, Pensions Dashboard Use-case report - How could we use funding from Kantara? - AOB

1 0

Re: [WG-UMA] Updated invitation: UMA WG @ Thu Apr 6, 2023 1pm - 2pm (EDT) (sal@idmachines.com)
by Alec Laws 06 Apr '23

06 Apr '23

Hi Adrian, that would be a great topic for an upcoming call. We've had an "UMA + GNAP" investigation on our work backlog for a while. Would you be able to facilitate a discussion? https://datatracker.ietf.org/wg/gnap/about/ (for everyone's reference) Best, - Alec On Thu, Apr 6, 2023 at 2:12 PM Adrian Gropper <agropper(a)healthurl.com> wrote: > All, > > IETF GNAP seems to be months away from Last Call. Is it worth having a > session on why the world needs both UMA and GNAP? > > - Adrian > > On Thu, Apr 6, 2023 at 1:24 PM Salvatore D'Agostino <sal(a)idmachines.com> > wrote: > >> Regrets, not going to make it to today >> >> IDmachines >> 1264 Beacon Street, #5 >> Brookline, MA 02446 >> +1 617.201.4809 >> @idmachines >> ------------------------------ >> *From:* Google Calendar <calendar-notification(a)google.com> on behalf of >> UMA WG <grt94kc567d3p039i0shdq8fcc(a)group.calendar.google.com> >> *Sent:* Thursday, April 6, 2023 1:14:47 PM >> *To:* gauravs_mailbox(a)yahoo.com <gauravs_mailbox(a)yahoo.com>; Andrew >> Hindle <andrew(a)hindleconsulting.com>; bjorn.hjelm(a)verizonwireless.com < >> bjorn.hjelm(a)verizonwireless.com>; Domenico Catalano < >> domenico.catalano(a)gmail.com>; Maciej <maciej.machulak(a)gmail.com>; Scott >> Fehrman <scott.fehrman(a)forgerock.com>; peter.davis(a)airsidemobile.com < >> peter.davis(a)airsidemobile.com>; cigdem.sengul(a)gmail.com < >> cigdem.sengul(a)gmail.com>; lalevasseur(a)ieee.org <lalevasseur(a)ieee.org>; >> adam.bradley(a)unifysolutions.net <adam.bradley(a)unifysolutions.net>; >> tsreiniger(a)gmail.com <tsreiniger(a)gmail.com>; nancy.lush(a)lgisoftware.com < >> nancy.lush(a)lgisoftware.com>; Eve Maler <eve.maler(a)forgerock.com>; >> michaelamanfi(a)hotmail.com <michaelamanfi(a)hotmail.com>; mike(a)identos.ca < >> mike(a)identos.ca>; carlos_a_garcia(a)optum.com <carlos_a_garcia(a)optum.com>; >> kay(a)kantarainitiative.org <kay(a)kantarainitiative.org>; mike(a)gluu.org < >> mike(a)gluu.org>; steve.venema(a)forgerock.com <steve.venema(a)forgerock.com>; >> Salvatore D'Agostino <sal(a)idmachines.com>; agropper(a)healthurl.com < >> agropper(a)healthurl.com>; hardjono(a)mit.edu <hardjono(a)mit.edu>; >> patrick.parker(a)empowerid.com <patrick.parker(a)empowerid.com>; >> daniela.poehn(a)unibw.de <daniela.poehn(a)unibw.de>; >> karim.boucetta(a)oxyliom-solutions.com < >> karim.boucetta(a)oxyliom-solutions.com> >> *Subject:* Updated invitation: UMA WG @ Thu Apr 6, 2023 1pm - 2pm (EDT) ( >> sal(a)idmachines.com) >> *When:* Thursday, April 6, 2023 1:00 PM-2:00 PM. >> *Where:* >> https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 >> >> UMA WG >> Dial-in and screenshare: See meeting locationThis is the WG meeting held >> every two weeks at 10am PT/noon CT/1pm ET/6pm UK/7pm CET (with suitable >> shifts for "summertime skew" twice a year, US time zone >> >> This event has been updated >> Changed: description >> >> Description >> CHANGED >> Dial-in and screenshare: See meeting location >> >> >> This is the WG meeting held every two weeks at 10am PT/noon CT/1pm ET/6pm >> UK/7pm CET (with suitable shifts for "summertime skew" twice a year, US >> time zones being dominant). >> >> Agenda and previous minutes: >> https://kantara.atlassian.net/wiki/spaces/uma/pages/4849687/Meetings+and+Mi… >> <https://www.google.com/url?q=https%3A%2F%2Fkantara.atlassian.net%2Fwiki%2Fs…> >> >> Time zone converter: www.thetimenow.com/time-zone-converter.php >> <https://www.google.com/url?q=http%3A%2F%2Fwww.thetimenow.com%2Ftime-zone-co…> >> >> UMA WG calendar: >> https://kantara.atlassian.net/wiki/spaces/uma/pages/4857518/Calendar >> <https://www.google.com/url?q=https%3A%2F%2Fkantara.atlassian.net%2Fwiki%2Fs…> >> >> To request an invitation to this meeting, or an ad hoc meeting at a time >> friendlier to your schedule, please contact the WG chair. >> >> Dial by your location >> +1 253 215 8782 US (Tacoma) >> +1 301 715 8592 US (Washington DC) >> +1 312 626 6799 US (Chicago) >> +1 346 248 7799 US (Houston) >> +1 646 558 8656 US (New York) >> +1 669 900 9128 US (San Jose) >> Find your local number: https://zoom.us/u/adwkesaBp >> <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FacJB0i8eEk&sa=D&us…> >> When Thursday Apr 6, 2023 ⋅ 1pm – 2pm (Eastern Time - Toronto) >> Location >> https://zoom.us/j/99487814311?pwd=dTAvZi9uN0ZmeXJReWRrc1Zycm5KZz09 >> View map >> <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fj%2F99487814311%3Fpwd%…> >> Guests >> gauravs_mailbox(a)yahoo.com >> Andrew Hindle <andrew(a)hindleconsulting.com> >> bjorn.hjelm(a)verizonwireless.com >> Domenico Catalano <domenico.catalano(a)gmail.com> >> Maciej <maciej.machulak(a)gmail.com> >> Scott Fehrman <scott.fehrman(a)forgerock.com> >> peter.davis(a)airsidemobile.com >> cigdem.sengul(a)gmail.com >> lalevasseur(a)ieee.org >> adam.bradley(a)unifysolutions.net >> tsreiniger(a)gmail.com >> nancy.lush(a)lgisoftware.com >> Eve Maler <eve.maler(a)forgerock.com> >> michaelamanfi(a)hotmail.com >> mike(a)identos.ca >> carlos_a_garcia(a)optum.com >> kay(a)kantarainitiative.org >> mike(a)gluu.org >> steve.venema(a)forgerock.com >> Salvatore D'Agostino <sal(a)idmachines.com> >> agropper(a)healthurl.com >> hardjono(a)mit.edu >> patrick.parker(a)empowerid.com >> daniela.poehn(a)unibw.de >> karim.boucetta(a)oxyliom-solutions.com >> View all guest info >> <https://calendar.google.com/calendar/event?action=VIEW&eid=Nmg1cDAzYWhjaDUx…> >> Reply for sal(a)idmachines.com >> Yes >> <https://calendar.google.com/calendar/event?action=RESPOND&eid=Nmg1cDAzYWhja…> >> No >> <https://calendar.google.com/calendar/event?action=RESPOND&eid=Nmg1cDAzYWhja…> >> Maybe >> <https://calendar.google.com/calendar/event?action=RESPOND&eid=Nmg1cDAzYWhja…> >> More options >> <https://calendar.google.com/calendar/event?action=VIEW&eid=Nmg1cDAzYWhjaDUx…> >> >> Invitation from Google Calendar <https://calendar.google.com/calendar/> >> >> You are receiving this email because you are an attendee on the event. To >> stop receiving future updates for this event, decline this event. >> >> Forwarding this invitation could allow any recipient to send a response >> to the organizer, be added to the guest list, invite others regardless of >> their own invitation status, or modify your RSVP. Learn more >> <https://support.google.com/calendar/answer/37135#forwarding> >> >

2 1

Draft minutes of UMA telecon 2023-03-16
by Alec L 16 Mar '23

16 Mar '23

https://kantara.atlassian.net/wiki/spaces/uma/pages/167018497/UMA+telecon+2… Agenda - Approve minutes since UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> - Review WG Call Times - Upcoming Conference Content (EIC & Identiverse) - IDPro knowledge base / general UMA articles - Check-in, Pensions Dashboard Use-case report - AOB Attendees - NOTE: As of Sept 15, 2022, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 4 of 6. (Peter, Sal, Alec, Eve, Steve, Sophia) - Voting: - Alec - Peter - Non-voting participants: - Hanfei - Regrets: - Steve Quorum: No Meeting Minutes Approve previous meeting minutes - Approve minutes of UMA telecon 2023-01-12 <https://kantara.atlassian.net/wiki/spaces/uma/pages/134512641> UMA telecon 2023-01-19 <https://kantara.atlassian.net/wiki/spaces/uma/pages/137462845> , UMA telecon 2023-02-02 <https://kantara.atlassian.net/wiki/spaces/uma/pages/145522689> , UMA telecon 2023-02-09 <https://kantara.atlassian.net/wiki/spaces/uma/pages/148734016> , UMA telecon 2023-02-17 <https://kantara.atlassian.net/wiki/spaces/uma/pages/152633345> , UMA telecon 2023-03-02 <https://kantara.atlassian.net/wiki/spaces/uma/pages/158400513/Copy+of+UMA+t…> , UMA telecon 2023-03-09 <https://kantara.atlassian.net/wiki/spaces/uma/pages/163872769> - Deferred - no quorum Topics Review WG Call Times Upcoming Conference Content (EIC & Identiverse) Pensions Dashboard / Open Banking Use-case report, initial discussion Draft will be worked on here: Pension Dashboard Use-Case Report <https://kantara.atlassian.net/wiki/spaces/uma/pages/135659525> We spent some time cleaning up the intro section, next steps are with Hanfei and Alec IDPro knowledge base / general UMA articles Wikipedia Article Refresh <https://kantara.atlassian.net/wiki/spaces/uma/pages/145817605> AOB - mDL and VC in UMA, current experiences and challenges - one VC challenges is the schemas that drive interop! could Kantara hold a group that curates and publishes these schemas (mdocs/vc schemas/etc) - data schema standardization is nessecary for interop! - the FI WG did some of this for SAML a “few” years ago - scope: industry agnostic data schemas, no bias to any governemnts, a unified identity schema - right to export data requires a common vocabuarly to the be useful

1 0