- WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2021-04-22
by Alec Laws 22 Apr '21

22 Apr '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-22 MinutesRoll call Quorum was reached. Approve minutes - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> , UMA telecon 2021-04-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01> , UMA telecon 2021-04-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-08> , UMA telecon 2021-04-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-15> Eve moves to approve. Peter seconds. Motion Passes! Pension Dashboard Update RFP is released, included profile + design doc largely the same as what we've reviewed previously Still finalizing the Kantara hosted publication of the contributed profiles (outside the UMA WG). We'll update the UMA site with some explanation after it's up Kantara will look to put a press release out when the documents are posted Is there interest in implementing/trying the profiles from the WG members? Origo has an (older) POC of the AS/system. IDENTOS is interested in building a conforming 'RS Adapter'. Could we try with some open source UMA components (gluu gateway/keycloak)? Members will need access to the RFP versions of the profile + design documents Identiverse 2021 We can have a dedicated UMA presentation slot (25mins) Alec will ask about attending identiverse, volunteer to present (maybe remote). Presentation *can* be recorded or live Andi will cover the UMA EIC presentation in Sept IIW Review Eve and George presented the UMA 101 session with 15-20 attendees. Took a slightly different approach, more of a true 101 session with increasing detail as it went. Covered new profiles and the UMA<>decentralized identity relationships. Eve can upload the new slides to the wiki Some questions about user interface standards "will there be standards about UMA interfaces?" Ian notes that Pension Dashboard → Dashboard client sharing of pensions resources is possible in the profile. The person dashboard is a true interoperable uma client. After finding, Alice can access her pensions from any Dashboard client after registration. Pensions dashboard includes an idea of Alice→Alice sharing happening before any Alice→Advisor(Bob) sharing happens. Eve notes this pattern is useful in health care use-cases where the Patient ID works against some privacy goals, anyone with the ID could see/access a lot with a FHIR API The idea that UMA is a layer above any identity let's UMA apply very widely. However, specific deployments do need to specific the identity trust model (where is it integrated, who has to trust it, etc) The PDP profile is a lot of specifying the identities, which ones exist (Alice as Citizen, Bob as Advisor), where (at AS and Dashboard), whether they need to be conveyed between system (IDToken to RS for matching), how they are stored + resumed (PCT profiling). FPX also specifies identifies, no IDs at the AS, used mainly at the RS, the Wallet needs authentication and may rely on the RS for ID. Looking for production DID/VC use cases? NHS Truu id? A lot of challenges being raised about wallet interop, the growing number of did methods, technical limitation of DID-SIOP and the lack of direct interop with existing Identity/Authorization systems. A lot of people questioning the market/use-case/user drivers for SSI, there are solid example in peer dids, but not clear overarching path forward. Profiles Discussion, relationship manager draftAOBAttendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Michael 2. Eve 3. Alec 4. Domenico 5. Peter Non-voting participants: 1. Ian 2. Colin 3. Ken Regrets: <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-22> Best, - Alec

1 0

Agenda for UMA telecon 2021-04-22
by Alec Laws 21 Apr '21

21 Apr '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-22 Date and Time - *Alternate-week Thursdays 10:00am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> , UMA telecon 2021-04-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01> , UMA telecon 2021-04-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-08> , UMA telecon 2021-04-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-15> - IIW review - Profiles Discussion, relationship manager draft - AOB

1 0

Draft minutes of UMA telecon 2021-04-15
by Alec Laws 15 Apr '21

15 Apr '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-15 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> , UMA telecon 2021-04-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01> , UMA telecon 2021-04-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-08> Deferred Pensions Dashboard All the agreements/etc are signed! Kantara webpage with profile going up shortly, under 'Resources'. https://www.pensionsdashboardsprogramme.org.uk/2021/04/13/digital-architect… https://www.professionalpensions.com/news/4029778/pensions-dashboard-progra… Reminder, IIW is next week (Apr 20-22) George/Eve to take up the UMA 101 presentation Identos at demo hour with the ON Health Identity use-case Identiverse June 21-23, may have a Kantara community session EIC mid-Sept, Kantara has 2.5-4 hours Profiles Discussion, relationship manager draft Last time we spoke about how the RO can get the URLs to protected resources at the RS. In the initial design of UMA this is out of scope as the RO was able to get the URL through the browser (eg to share a web hosted pdf or google doc) However some new use cases don't have this mechanism, and have to build other means for Alice (the RO) to get the resource uris to share with Bob. 1. When registering the resource, should/can the RS tell the AS this is my reference/url/identifier for that resource? 1. downside, both sides end up managing both ids 2. *make it optional on resource description, profile can choose to make it mandatory* 3. use-cases, in context of relationship manager, the RO(through the RM) is talking to the RS before resource may be registered. 4. use-cases, pension identifier, communicated directly from RS to the dashboard. 5. use-cases, AS first flows, the AS would need a way to tell the Client where the granted resource is If the uri is registered, does the AS return it to the RS on introspection? Does this relate to the resource_indicators spec? Where the client could go directly to the AS with the uri without needing to get a ticket from a failed request at the RS. George sent me to this AS to get authorization, but I need to know *where* to go access it. Today UMA works where, Alice knows the address of my Immunization record, and can share that link to Bob to access. Is Alice telling the HCP, "you can get this one piece of information", or "you can access everything that I've granted you access to". Other possible way, Alice opens her health app and the provider 'scans a qr' with the url. Trying to find ways for Alice to have to understand less about the specific resource/fine-grained authorization capabilities of UMA. There are multiple aspects to what Alice does/need to understand to participate in a wide-ecosystem. Note, the general danger of making things 'out of scope' in identity management protocols. We should likely separate the AS-first flows and discovery mechanisms. AOB Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Eve 2. Alec 3. Domenico 4. Michael 5. Sal Non-voting participants: 1. Scott 2. George 3. Tim 4. Colin

1 0

Agenda for UMA telecon 2021-04-15
by Alec Laws 14 Apr '21

14 Apr '21

https://kantarainitiative.org/confluence/display/uma/Copy+of+UMA+telecon+20… Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> , UMA telecon 2021-04-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01> , UMA telecon 2021-04-08 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-08> - Pensions Dashboard updates - Profiles Discussion, relationship manager draft - AOB

1 0

DKIM signed Delegation of Authority Email stored in a jwt/token claim
by Igor Zboran 13 Apr '21

13 Apr '21

Hi UMAnitarians, I once mistakenly thought that a decentralized system with the UMA protocol could be built in combination with the OIDC authentication system. Of course, this is not possible because the OIDC provider has to be common to both the RO and the RqP, or at least has to be federated / centralized in some way. If the RO and RqP can use mutually independent OIDC providers it will be possible to build decentralized systems such as AEMS, chat or file sharing services. So I tried to adapt the OAuth2 Authorization Code Grant for UMA Authorization Code Grant. I completely lost my thread on this point. My apologies for any inconvenience this non-umanitarian approach may have caused. After some thought and experimentation, I discarded the previous concept and replaced it with another one – this time UMA-compliant. At the core of this new idea is the use of a DKIM signed Delegation Of Authority Email stored in a jwt/token claim. I need some time to refine this idea, hope it turns out well this time. Regards -Igor

3 4

Draft minutes of UMA telecon 2021-04-08
by Alec Laws 08 Apr '21

08 Apr '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-08 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> , UMA telecon 2021-04-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01> Deferred Pensions Dashboard No update Events: IIW is Apr 20-22 George reminds us about the UMA 101 session. Will get in contact with the organizers to ask *EIC Sep 14-18 * hybrid event, in-person + remote. Kantara has a workshop scheduled on the first day. Looking for a 10-15min UMA update to be included. If you'd like to attend/participate feel free to reach out to Colin/Alec *ONC AGM*, the virtual booth did lead to one reach out for a qualified lead for the IAF program [image: (big grin)] AOB As a consumer, how is this wallet/consent management technology actual rendered? Currently we have many 'narrow ecosystems' around specific use-cases. Where the user ends up with a 'wallet per use-case'. There is a risk that there is re-centralization to apple/google as the only/main providers for these services. One example in travel, there are trust/verification compliance requirements set by the TSA. In US this would be some alignments/assessment against 800-63. And the use-cases within the travel vertical all have different required compliance levels (eg hotel check-in vs airline check-in). Consent is directly in control of the user, today through mobile application or direct with the airlines. Some regions have additional requirements, eg for facial recognition within the airport. Today uses can choose different assurance apps, however there is no interoperability between theses services. Even as passport does't have a digital schema defined internationally (they do have physical/nfc chip standards). ANCR is trying to make the consent receipt work across infrastructures, as one way to create interoperability. Concept of two factor consent: notice of risk & recognition of rights. Current consent management solutions do it from the RP perspective, but not the user's perspective. The standardization of data/schema is a huge issue, beyond what UMA only can solve today. ISO mDL (18015?) captures both today including some minimal disclosure + retention cases (is_age_over_NN, rp_will_retain). Creates some base interop on the core DL attributes, however states are open to add their additional parts. This works until people don't play, eg Michigan(?) who has rejected the interop all-together. When do we have a wallet that works across industry? Pointers to my identity provider and associated resource pointers (eg utility bill hosted by my hydro provider). instead of alwys needing a personal data store or copy of resources, leave them with providers that often must retain the information already. One challenge with UMA in this case it assumes the RS is always available! This is why offline use-cases are a huge industry focus, no phone home. States/Govs aren't really interested in becoming fully available services to hold/present data, issuing user held credentials avoids that IT burden as physical creds do today. There is no reason there can't be a hybid where a user has choice about pulling resources into a personal data store or leaving them at some authoritative holders. Has anyone implemented PCTs is there any requirement that it holds claims? No, the PCT is implementation defined, it can be as opaque as wanted. It's purpose is to allow the AS to recover presented claims/id about the RqP, so only the AS should need to understand its format. Are there interop requirements for the PCT? given that its issued by and consumed by the AS, there is not. Because UMA makes the RqP a first-class role, the PCT represents some RqP context/authN separate from the Client authN. One UK Open Banking has relaxed the requirement for re-authenticating every 90days. Use case is the FINTECH must authN against each bank to get Access&Refresh tokens. The re-authentication requirements led to some bad UX. How are expirations determined now? Now set by use-case between the Bank+fintech. A wallet or UMA concept helps move this problem from each use-case behind a user AS service. The RP goes back to one AS relationship across many OB API providers (Banks). This is akin to a health care provider use case, a HCP often has to use many ID systems to provide enough authority to perform some specific jobs. Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Michael 2. Alec 3. Peter 4. Sal Non-voting participants: 1. Colin 2. Ian

1 0

Agenda for UMA telecon 2021-04-08
by Alec Laws 08 Apr '21

08 Apr '21

https://kantarainitiative.org/confluence/display/uma/Copy+of+UMA+telecon+20… Date and Time - *Alternate-week Thursdays 10:00am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> , UMA telecon 2021-04-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01> - Pensions Dashboard updates - Profiles Discussion, relationship manager draft - AOB

1 0

Draft minutes of UMA telecon 2021-04-01 (no joke)
by Eve Maler 01 Apr '21

01 Apr '21

Minutes Roll call Quorum was NOT reached. Approve minutes Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18>, UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> Deferred Pensions Dashboard Things are looking good for proceeding. ONC Annual Meeting Update (and other events) The ONC event took place Monday/Tuesday this week. Booth content was great, will try to republish the content on the Kantara website. Not a lot of visitors though. Will there be UMA content at Identiverse? No presentations known at this time. There will be Kantara/mDL. Eve will ping Andi and Allan to get more concrete info. IIW is later this month Apr 20-22. Registration is still open. Alec will be there and showing an IDENTOS Ontario trusted account demo. Eve is attending as well. Profiles Discussion, relationship manager draft Last week, we discussed if there's a need for Alice to be told/informed of resource locations. This wasn't identified as a need when designing UMA 2 as the URL was always "available" to Alice. Provider Directories (a directory of Health Organizations not physicians) as a current approach to this within US Health care. Ex Apple Wallet you can see the links to your health resources (at the Provider). The patient uses the Apple Wallet to login to their provider, and pull the health resources. Apple maintains a provider directory of 'approved' providers (EHRs) Apple Wallet(SMARTonFHIR client) ->EHR(OIDC/RS): login user Patient(RO) ↔EHR: authenticate EHR(RS) → Apple Wallet: URIs of Patient resources RM → RS: negotiate some access token (RAM, RMT) RM → RS: GET /my-resources (RMT) RS → RM: list of available resources RM → RS: protect resource A with AS1 If the Apple Wallet was a Relationship Manager, Alice could then direct the Provider to protect her resources at her AS, and then control sharing/delegation to the RqP outside the Provider. Does this mean that Alice's client has the resources in "machine-readable" form, which is better than just copying and pasting in some non-interoperable fashion? Nancy sees about ten different ways this is relevant, but maybe pulling the data from the endpoints is more viable with today's technology and tech appetite. The dashboard is a better idea/ideal since you get fresh data. Eve notes: The PD model creates a dashboard that faces the "RO as an UMA RqP" as its step 1. Alice "shares with herself" to do resource discovery through a pension finder service (an UMA-protected PFS). It's UMA followed by UMA, pretty sophisticated. Nancy agrees. Paper-based still seems preferable to many. Immediate high value is needed. AOB Vaccine passports are in the news. Does UMA have relevance? Nancy comments: It's a problem waiting to happen. UMA is a great solution that could be applied. HIPAA is relevant (in the US). Some organizations are restricting themselves to "get a passport to the patient on the phone". But there are so many use cases where the credential has to be shared way in advance of the person arriving. Just sharing directly without the patient being involved is the challenge. UMA is very relevant here. Nancy's folks have developed a solution here. UMA and the consent conversation: With UMA, it's a "totally computable consent". See also Kantara's stream consent receipt efforts, now with a new WG called ANCR ("advanced notice and consent receipt"). Auditability of consent, including UMA-based consent, is of high importance. How to integrate with legacy systems? It tends to be coarse-grained to meet the old systems' capabilities. E.g., consenting to treatment in a blanket fashion. Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Eve Alec Domenico Sal Non-voting participants: Scott Ian Nancy Colin Tim Eve Maler | cell and Signal +1 425.345.6756

1 0

Agenda for UMA telecon 2021-04-01
by Alec Laws 31 Mar '21

31 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-04-01 UMA telecon 2021-04-01Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> , UMA telecon 2021-03-25 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25> - Pensions Dashboard updates - Profiles Discussion, relationship manager draft - AOB

1 0

Draft minutes of UMA telecon 2021-03-25
by Alec Laws 29 Mar '21

29 Mar '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-25 MinutesRoll call Quorum was NOT reached. Approve minutes - Approve minutes of UMA telecon 2021-03-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-03-18> Deferred Pensions Dashboard All sorted, waiting for final review & confirmation of final licenses ONC Annual Meeting, Virtual Booth https://www.healthit.gov/news/events/2021-onc-annual-meeting March 29-30 Authorization Code Grant https://groups.google.com/g/kantara-initiative-uma-wg/c/OHYcZe8l8Vs Initial Thoughts/questions: - Seems strange to get emailed a callback url, would the RqP have to open that link in the same browser? - Mixing the purpose of UMA with authentication? - Where is the response to request 2? that's a 302 to the AS - Seems to have some relationship with the OAuth device code flow to perform some out-of-band authorization of a user-agent? Similar to the CIBA discussion, more in scope as CIBA was RO authn, while this is RqP authN - Does the link need to be RqP specific? No because the token request includes bob's email as a pushed claim Assume these pre-reqs: - Alice has shared a link with Bob - Alice has setup her AS to anyone who can demonstrate control of bob(a)email.com Nice feature: - The AS can authenticate the email without a direct integration to that email provider as an issuer(IDP or for claims pushing) Suggested Changes: - RqPClient does RPT less request to RS to get the ticket - Line 2 is a uma token request with a 'request_submitted' response - 3, 4, 5 should be 'out of scope' - 6 is a uma token request that 'work', returns a token Profiles Discussion, relationship manager draft ???: Can one resource be protected by two Authorization Servers? ???: Can one resource be registered multiple times as the SAME AS? Not prevented by UMA Fedz, are there any use-cases for this? Yes, nothing prevents this THere is discussion of some of these topic here: https://kantarainitiative.org/confluence/display/uma/UMA+Implementer's+Guide#UMAImplementer'sGuide-perm-request-patternsConsiderationsRegardingResourceServerPermissionRequests <https://kantarainitiative.org/confluence/display/uma/UMA+Implementer> Should we provide additional guidance on this topic? There is also no restriction for the RS to have only 1 URI for a resource. THere was some previous discussion around wild-card in resource path, other templating - How does Alice know the URL of the resource? Collapse source UMA Resource Server Management This document extends [UMA Fedz] in order to specify the interface provided by the RS to the RO for resource management. This is achieved by introducing a Resource Management API which is used by a Resource Manager Client to view available resources and direct the AS to use for protection. ** This API could also allows the RO to - view access history - set direct policy (ie Adrian clause) - establish credentials required in AS, (smarthealth.card) Reqs: - THe RO must authenticate to the RS, in order to authorize access to this API - (this capability of the RS is implied by UMA) - The RO can see a list of resources available at this RS (either protected or not) - The RO can modify the protection of resources (ie which AS to protect) - The RO can see AS's available for protection - can the RO direct the RS to get a PAT from a new AS? This is tricky depending on how PAT's are issued (ie may require end-user redirection) Possible API Names: - resource management - resource declaration - available resources - resource access management (RAM) This document introduces the following new concepts: - Resource Management API The API presented by the RS to the Resource Manager. This API is OAuth protected - Resource Management Token (RMT) (what scope should this Access Token capture?) "uma_management" ### 1.3 HTTP Usage, API Security, and Identity Context - add link between RM API and RM Token informative The use of the `uma_management` scope when requesting a RMT may indicate to the RS's authorization server that establishment of one or more PATs with an available UMA AS is 'useful' RM -> RS: /authorize?scope=uma_protection Alice <-> RS: authenticate RS -> RS: are there any PATs available PATs for Alice? RS --> Alice: 'do you want to setup an UMA AS?' Alice -> RS: yes@ uma.as.location RS --> Alice: 302 uma.as.location/authorize The `Resource Management API` allows the Resource Owner to: - View the available resources hosted at this RS, and their current protection - View the UMA Authorization Servers available to be used to protect - Manage the UMA protection of available resources Starting Conditions: - The RS hosts resources for the RO - The RS supports resource protection from an UMA AS - The RS has a UMA PAT at one or more UMA ASs (try to bring this into the profile, not as a starting condition) Step 0 The Resource Manager obtains an OAuth Access Token valid for use at the Resource API. The Access Token must allow the RS to determine the RO's resources. - is there a purpose for NOT the RO to use this interface? Is this 'delegation' too early in Step 1 (Get Info) The RM obtains a list of UMA AS's available for resource protection, and a list of available resources Step 2 (Update Protection) The RM directs the RS to modify the resource protection either - putting an unprotected resource under protection at a specific AS, possibly only registering specific scopes - removing the protection of a resource at an AS. The RS will no longer honor RPTs for this resource from that AS - modify the protection of a resource, such as to add or remove scopes ## Available Resources Endpoint The API available at the available resources endpoint enables the resource manager to have knowledge of the resources hosted by the resource server for the resource owner. \_rs_id is a resource server defined identifier for a resource. Before a resource is registered at an AS, there is no handle/reference available (unless the RS provides one) GET /my-resources/ ``` [ { "_resource_id" "ABC", "resource_scopes":[ "view", "http://photoz.example.com/dev/scopes/print" ], "description":"Collection of digital photographs", "icon_uri":"http://www.example.com/icons/flower.png", "name":"Photo Album", "type":"http://www.example.com/rsrcs/photoalbum", // uri/location of the resource? protected_at: (optional) [ { // (_id in UMA Fedz) // does the RMT need to know this value? yes since this resource can be registered multiple times at an AS "authorization_sever_resource_registration_id" : "_as_issued_id_for_resource_ABC" "authorization_server" : "as_identifier", "registered_scopes" : [ "view" ], "user_access_policy_uri" : url (optional) } ] }, ] ``` Protected Resources ``` [ { "_resource_id" "ABC", "authorization_sever_resource_id" : "_as_id" "authorization_server" : "as_identifier", "registered_scopes" : [ "view" ] }, { "_resource_id" "ABC", "authorization_sever_resource_id" : "_as_id_2" "authorization_server" : "as_identifier_2", "registered_scopes" : [ "view", " http://photoz.example.com/dev/scopes/print" ] } ] ``` /authorization-servers/:id/resources ``` [ { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id" "registered_scopes" : [ "view" ] }, { "_rs_id" "ABC", "authorization_sever_resource_id" : "_as_id_2" "registered_scopes" : [ "view", " http://photoz.example.com/dev/scopes/print" ] } ] ``` In dashboard world, rs_id = PeI (pension identifier) - to confirm, is the PeI the same as the as_id? ie is it created by the RS or the AS RS_1 holds pension A with identifier a RS_1 registers pension A single person, single resource, single rs: can have multiple resource registration, eg with different scopes Resource = Patient Registered Resource 1: Just the Patient Object Registered Resource 2: The Patient + Sub Objects ### Available Resource Description A registered resource is a JSON document that extends the resource description from [UMA Fedz 3.1 Resource Description](1) with the following parameters: authorization_server OPTIONAL A string identifying the authorization server that protects this resource ** could also be the AS policy uri from resource registration? (1 https:// docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0.html#re… ) #### List Available Resource Descriptions #### Update Available Resources Description ## Authorization Server Endpoint The API available at the authorization server endpoint enables the resource manager to view and manage the authorization servers available for resource protection. The resource owner may allow resource protection only through the set of available authorization servers. ***note***: a challenge here is that it's quite difficult for this interface to create a relationship between an AS/RS because how the PAT is issued (ie could be interactive) Currently this is a 'dynamic' API since it conveys information to Alice about whether a specific AS is available for use in other protection APIs (ie is there an active/historical PAT for this AS). If this is static, Alice won't know if she can use that AS for protection THe list of AS's may also be specific to the RO. Bob may have registered AS1, while Alice uses AS2 ### Authorization Server Description #### List Authorization Server Description GET /my-authorization-servers/ ``` [ { as_url: "http://authserver_id.ca" has_as_pat: true }, { as_url: "http://authserver_id2.com" has_as_pat: false } ] ``` POST /my-as/:one/resource ``` { _rs_resource_id: scopes: [] } ``` vs POST /my-resource/:abc/authorization-server ``` { _as_id: scopes: [] } ``` AOBAttendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 8. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: 1. Eve 2. Peter 3. Michael 4. Alec Non-voting participants: 1. Nancy 2. Colin 3. Scott 4. Ian 5. Tim Regrets:

2 1