- WG-UMA - mailman.kantarainitiative.org

Agenda for UMA telecon 2015-08-20 (those with assignments, please do them...)
by Eve Maler 19 Aug '15

19 Aug '15

See the spreadsheet for assignments and which ones I’m hoping we’ll knock down on Thursday. Thanks! http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-20 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-20> Date and Time Thu Aug 20 8:30-10am PT (we start 30 minutes earlier and meet for 90 minutes in August) Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-08-13 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-13>. Last-minute quick hits Trust elevation TC writeup reviews Legal subgroup report APAC sync report Issue resolution work (issues on GitHub <https://github.com/xmlgrrl/UMA-Specifications/issues>) (UMA V1.0.1 issue nominations spreadsheet <https://docs.google.com/spreadsheets/d/1s27E3JsHdvl_UzhGkQ8ZWP2dnyAXQAj5sxE…>) ("sprint" document <https://docs.google.com/document/d/1c50top8X6Aqw3CEVeX_SD2THqO508ihs14QwLem…>) Our timeline has us trying to knock down all of our issues by this week and next Then approving our Draft Recommendations for next-stage LC approval the following week or so AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Fwd: NCCoE Seeks Collaborators for Access Control, PIV, and Mobile Device Security Projects
by Adrian Gropper 18 Aug '15

18 Aug '15

The ABAC one-pager mentions UMA by name. https://nccoe.nist.gov/sites/default/files/ABAC.pdf We're in the big leagues! Happy weekend, Adrian ---------- Forwarded message ---------- From: *National Cybersecurity Center of Excellence* < nccoe(a)service.govdelivery.com> Date: Friday, August 14, 2015 Subject: NCCoE Seeks Collaborators for Access Control, PIV, and Mobile Device Security Projects To: info(a)healthurl.com Today's Federal Register contains notices inviting technology vendors to collaborate with the National Cybersecurity Center of Excellence on three new projects to provide mobile device security, attribute based access control, and derived personal identity verification (PIV) credentials for mobile devices. Commercially available and open source products will be the modules in end-to-end example solutions to these challenges. All collaborators will enter into a Cooperative Research and Development Agreement (CRADA; see an example <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…>) with NIST in order to participate in a consortium for each build team. The projects will result in NIST Cybersecurity Practice Guides that show organizations how they can adopt these or similar capabilities. Companies with product characteristics that meet the desired characteristics in the Federal Register notices can submit letters of interest indicating that they'd like to work on one or more of these projects. Each Federal Register notice contains instructions for how to submit a letter of interest. Project pages and Federal Register notices can be found at: - Mobile Device Security Building Block <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - https://federalregister.gov/a/2015-20040 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - Attribute Based Access Control Building Block <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - https://federalregister.gov/a/2015-20041 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - Derived Personal Identity Verification Building Block <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - https://federalregister.gov/a/2015-20039 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> To learn more, read the NIST press release <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> . SUBSCRIBER SERVICES: Manage Preferences <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> | Unsubscribe <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> | Help <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> . Technical questions? Contact inquiries(a)nist.gov <javascript:_e(%7B%7D,'cvml','inquiries(a)nist.gov');>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: Powered by GovDelivery] <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> -- Adrian Gropper MD RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

4 4

Trust Elevation Model for OASIS Trust-El TC
by Mike Schwartz 18 Aug '15

18 Aug '15

UMA WG, Here is the copy I worked up per Andrew's request on the trust-el model for UMA: https://docs.google.com/document/d/1nRrQe9U0EiQpibYnUl-uYFW92LSRcegQfsQ6kfv… Andrew only wanted 1/2 page, so I tried not to get to lost in the details (i.e. that's why I didn't mention the permission ticket...) Anyway, if its so summary as to be misleading, any suggestions are welcome! - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Reminder: APAC-friendly UMA sync 2015-08-20
by Eve Maler 18 Aug '15

18 Aug '15

Thu Aug 20 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-08-19): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UMA Legal - Release of Information (ROI) Form
by Adrian Gropper 17 Aug '15

17 Aug '15

The ROI form is one of the three common legal documents in healthcare. (The other two are the Notice of Privacy Practices that's a meaningless and often unsigned notification about HIPAA and informed consent notices for specific procedures. ) The ROI form (attached) is quite typical and demonstrates all of the common elements. I've annotated it with the UMA terms. Jim Hazard and I have some experience translating the ROI form into the Common Accord format. I see the ROI form as the institutional complement to the 4 use-cases I shared last week. The use-cases were presented entirely from Alice's perspective. The ROI form is presented entirely from the service provider perspective. There is, of course, a third dimension: the third parties and intermediaries in the real world that have contractual relationships with Alice and her service provider. These are sometimes called Business Associates in healthcare and sometimes overlap with federations. Alice's third parties often look like software clients and apps. Adrian -- Adrian Gropper MD RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 2

Notes from UMA legal subgroup telecon 2015-08-14
by Eve Maler 14 Aug '15

14 Aug '15

Attending: Eve, Jon, Dazza, Mark, Tom, Adrian, Jeff S The wg-uma GitHub area has a wiki <https://github.com/KantaraInitiative/wg-uma/wiki> that Dazza has been populating. Work through Adrian email thread to discuss UMA flow and use cases Walk through an UMA demonstration? (Eve) Discuss consent receipts and logging — how do they map to use cases? See consent receipt generator demo? (Mark) How many more use cases do we really need? a lot? a few? none? Discuss licensure vs. contract (if time?) We walked through the UMA FAQ descriptions of the UMA flow. An autonomous web service client can often be in a data broker role: an institution where the RO doesn’t have a login. What about where “data rights ownership” resides in multiple parties? UMA the technology settled on a simplification where only a single entity (meaning a hunk of software or operator of same) can be an RO. But in reality, multiple parties (meaning persons or non-person entities that can do things like sign contracts) could have rights. Adrian says “There’s only one Alice”. Are we focusing exclusively, or primarily, on “Alice” use cases? UMA was originally intended to focus first and foremost on the individual as an RO, which is why our BO spec <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> points to NSTIC (while slightly debugging its definition of Individual). Action item/issue: We should circle back around to revising the definitions of party/entity/role etc. Look at the BO spec <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> for background. The notion of data sharing with third parties is not very well covered in law, so UMA is significant in this area. The proposed EU Data Protection Law revisions do seem to have some relevance here, though. And this is where Consent Receipts are also relevant. Dazza suggests that the ISO 29100 statutory privacy roles <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Use-Cases,-Role…> have relevance here, but Adrian isn’t so sure. Analysis of Alice-to-Alice N use case: The OAuth model is “pairwise” between each service and client app. UMA, by contrast, allows Alice to aggregate the records of all of her consents (and ultimately receipts of her consents). “Accounting for Disclosures” (A4D) is a HIPAA term of art; think of this just as a record of the consents, not as the “CDC" point. Ultimately, the use cases can blend; each is just meant to highlight a few aspects of desired features but they’re not mutually exclusive. How would we map the people and organizations named to roles? Would one of the EHRs be something like a Microsoft HealthVault? Where would a physician come into play? Adrian has kept PCPs and personal health records (PHRs) out of this use case for simplicity. Adrian’s “Release of Information” (ROI) form goes into detail about the “who to sue” question. In the US, frequently a PCP has a hospital affiliation, and the hospital uses a SaaS product run by an EHR vendor like Cerner. Eve has a login to evergreenhealth.cerner.com <http://evergreenhealth.cerner.com/>. She can use the (proprietary but UMA-like) portal to share the allergy portion of her health record with her husband. In this case, Cerner is a “Business Associate” of the institution. What Eve calls “figuring out who to sue” is what the pros would call “structuring the transaction”. When using a standard that allows multiple parties to hook up and use others for authorization, this is the goal. Next time: Accelerating on the use cases, and mapping to consent receipts, given our deeper understanding. Today counts as excellent progress — thanks, all! Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 1

UMA Legal - Mapping Roles
by Mark Lizar 14 Aug '15

14 Aug '15

Dazza and I were chatting about how roles might map between UMA and the MVCR, (which references roles from ISO 29100). We thought this might be useful in providing a place to start. - Mark Extracted from Binding Obligations Requesting Party Resource Server Operator Authorization Server Operator Authorizing Party Statutory Privacy Roles Extracted from ISO 29100 2.11 PII controller entity (or entities) that determines the purposes and means for processing PII other than individual persons who use data for personal purposes NOTE A PII controller sometimes instructs others (e.g., PII processors) to process PII on its behalf while the responsibility for the processing remains with the PII controller. 2.12 PII principal natural person to whom the PII relates NOTE Depending on the jurisdiction and the particular data protection and privacy legislation, the concept of a “PII principal” may also be defined as a “data subject”. 2.13 PII processor entity that processes PII on behalf of and in accordance with the instructions of a PII controller 2.26 third party an entity other than the PII principal, the PII controller and the PII processor, and the persons who are authorized to process the data under the direct authority of the PII controller or the PII processor UMA Healthcare Use Case Roles Extracted from Adrian's use cases Alice Bob EHR-1 Operator EHR-2 Operator PCP (Primary Care Provider) Custodian 3.1.1 Extrapolating from Existing Legal Scenarios"

1 0

UMA Specifications @ GitHub
by Maciej Machulak 14 Aug '15

14 Aug '15

Hi, The specs now have a new home - please updated your bookmarks :-) https://github.com/KantaraInitiative/wg-uma Cheers, Maciej -- Maciej Machulak email: maciej.machulak(a)gmail.com mobile: +44 7999 606 767 (UK) mobile: +48 602 45 31 66 (PL)

2 1

OASIS Trust-El TC UMA description
by Mike Schwartz 13 Aug '15

13 Aug '15

Andrew, Per the WG minutes, I'd be happy to write up a description of the trust elevation features of UMA. - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Draft minutes of UMA telecon 2015-08-13
by Eve Maler 13 Aug '15

13 Aug '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-13 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-13> Minutes Roll call Quorum was reached. Minutes approval MOTION: Approve the minutes of UMA telecon 2015-08-06 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-06>. APPROVED. Trust Elevation TC request Mike will follow up on Andrew H's request to write something up on UMA for the TC document. He's already on that TC. GitHub repo status Eve's xmlgrrl repo for UMA-Specifications is now moved over to the KI side <https://github.com/KantaraInitiative>. Issue resolution work We agree that a patch release is still the right thing to do. We assigned milestones afresh to all of the current issues. Eve will duplicate issues where they ultimately apply to subsequent releases. Issue 161/162 discussion: The constraint is that the RS must be able, based on the C's access attempt with no token and no other context, to distinguish the AS and RO that match the protected resource set. In practice, this likely means that the URI needs to be unique per resource set. Let's mention this constraint in a few places. E.g., in Core Sec 1.3.1 and Core Sec 2. And we also have to put it into RSR Sec 2 and Sec 2.2. Issue 163 discussion: 200 with a special header has been discussed. Let's align the header with the future! What do we think the V1.1/V2.0 header would be for the ticket, the RO-specific information the client would need, etc.? WWW-Authenticate: UMA parameters. So the name of this parameter would be what? We want to convey that we're not giving an error code, but we're starting a process that requires some additional action if they want to get the protected representation (ish) of the resource. We already have as_uri=as_uri and Justin would suggest that we have ticket=ticket in future. The sheer presence of the UMA header is all that is required – nothing else. Issue 172 discussion: The feedback from the implementation process is that what's in the spec is not enough. The OAuth spec has more guidance on this type of thing. Can we be more specific without saying exactly what the lifecycle is? Can it be forever or not, e.g.? The spreadsheet <https://docs.google.com/spreadsheets/d/1s27E3JsHdvl_UzhGkQ8ZWP2dnyAXQAj5sxE…> has a few more notes and champion assignments. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 30 Jul 2015 (pre-meeting), quorum is 7 of 12. (François, Domenico, Sal, Thomas, Andi, Phani, Robert, Maciej, Eve, Arlene, Irwin, Mike) Eve Irwin (regrets for next three telecons) Arlene Thomas Mike Maciej Domenico Sal Non-voting participants: Adrian Justin Sarah Nat Mark Jin Scott Regrets: Andi Robert François Ishan James Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0