- WG-UMA - mailman.kantarainitiative.org

UMA/Email proof-of-concept
by Igor Zboran 23 Feb '21

23 Feb '21

Hi all, I’ve found that the topic of healthcare is quite popular among UMAnitarians. Although AEMS has been designed as a general or enterprise-oriented system, I think that it also meets the specific needs of the healthcare sector. To demonstrate the feasibility of the UMA/Email idea, I decided to build proof of concept. The full source code will be available in the public GitHub repository https://github.com/uma-email/poc. Any help welcomed. -Igor

2 6

Draft minutes of UMA telecon 2021-02-18
by Alec Laws 18 Feb '21

18 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18 Minutes Roll call Quorum was NOT reached. Approve minutes Approve minutes of UMA telecon 2021-02-04, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> Deferred LC Presentation Review Another Common Theme: interop theme, need standards based implementations of the protocol (UMA) + the ability to apply specific profiling/configuration choices example, how the RS would request a PAT (interactive/token push) custom/implementation specific interop of data formats needs for conformance of specific implementations (protocol,data) Should we rekindle the conformance suite/testing conversation? Could we start with conformance to a specific implementation profile and generalize afterwards? This reduces the scope of the testing, provides something concrete Reintroduce the relationship manager/policy manager/wallet profiles Discussed the 4 potential profiles Trusted claims is interesting in context to a public/private collaboration. Where data may need to move from public to private or vis-versa in known ways. There are challenges open public IDPS to private sector parties/use-cases. More public sector parties are creating identity/credential services. This also comes up in us health care as there is a need to exchange data between sectors, it's hard to agree on who's idp to trust. There is a lot of push back against using "social" provider (eg Google) to provide end-user (ex Patient) credentials. This is a big industry challenge. Where is the push back? The lack of identity proofing, or the security of the credential? Google spend WAYYY more to secure that credential that any single hospital/impl likely could. Seems like a partner education challenge to the benefits: user convenience, increased (delegated) security, no need to manage user passwords. As a (health acre) RP, they may end up need to support many many IDSP, this could push orgs the "other way" to centralize these features, if only for operational simplicity. Even if google is the CSP, each org that accepts it is building a new IDP and enriching the user account with local data/identifiers, useful to downstream providers. Are healthcare providers building their own Identity stacks? This should be strongly discouraged. Most health care systems seems to buy and install their own, instead of relying on external. Nancy & Alec's impl both federated authenticate and layer on identity proofing capabilities. The CSP does not have the right identifiers in every context, some proofing must be layered on. IDPS that come with proofing capabilities are beneficial, but can't meet all needs (eg to find/bind to a medical record number) There is a lot of public sector effort to define national trust framework: eg in UK https://www.gov.uk/government/publications/the-uk-digital-identity-and-attr… <https://www.gov.uk/government/publications/the-uk-digital-identity-and-attr…> The interop of IDPs is the main focus of the Kantara Identity Assurance WG <https://kantarainitiative.org/confluence/display/IAWG/WG+-+Identity+Assuran…>, which helps ensure the compatibility of different CSPs/IDPs against 800-63-3. If this topic interests, please checkout that WG! Pensions Dashboard, any updates Pensions Dashboard Program has released some documents as they build towards their procurement https://www.pensionsdashboardsprogramme.org.uk/2021/02/11/passing-pensions-… <https://www.pensionsdashboardsprogramme.org.uk/2021/02/11/passing-pensions-…> https://www.pensionsdashboardsprogramme.org.uk/2021/02/18/identity-call-for… <https://www.pensionsdashboardsprogramme.org.uk/2021/02/18/identity-call-for…> Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Sal Alec Michael Domenico Non-voting participants: Vlad Nancy Ian Scott Colin Tim George Regrets: Eve <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18>

1 0

UMA WG presentation during Leadership Council
by Alec Laws 17 Feb '21

17 Feb '21

Hi all, Please find the slides presented to all members during the Leadership Council call today attached The topic was: “New UMA profiles in progress, from industry back into the WG" Best, - Alec

1 0

Agenda for UMA telecon 2021-02-18
by Alec Laws 17 Feb '21

17 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-18> UMA telecon 2021-02-18 Date and Time Primary-week Thursdays 6:30am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04>, UMA telecon 2021-02-11 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11> Reintroduce the relationship manager/policy manager/wallet profiles Pensions Dashboard, any updates AOB - Alec

1 0

[Participate: Weds Feb 17, 12 Eastern] 30min WG/DG Update - New in 2021!
by elizabeth＠kantarainitiative.org 11 Feb '21

11 Feb '21

Greetings, First, apologies in advance for cross posting. If you are participating in more than one Group, you will receive this more than once! You are invited to join the first 30minutes of the monthly Leadership Council call (typically the 3rd Wednesday for the month) to hear from WG/DG representatives on the current status of their work. We greatly look forward to your attendance, questions and comments. The meeting link is here: <https://www.google.com/url?q=https://global.gotomeeting.com/join/112012805& sa=D&source=calendar&ust=1613499348900000&usg=AOvVaw2GmED_8avxmfdX7QvULQ9B> https://global.gotomeeting.com/join/112012805 Full call-in details are shown at the end of this email. We are trying something new in conjunction with the Leadership Council calls. The first 30 minutes are open to all - we'll have a discussion leader inform us about an interesting topic relevant to your contributions at Kantara. This initiative is in response to your feedback last year asking for greater cross-working group sharing, for greater co-ordination and synergy. You are more than welcome to stay on to observe the proceedings of the LC call that follows straight after if you wish. We start this new initiative with the User Managed Access (UMA) WG Topic: New UMA profiles in progress, from industry back into the WG Speaker: Alec Laws, UMA WG Vice Chair, from IDENTOS Alec has been a software developer and solution architect his entire career. He's recently been interested in the many ways that technology can be used to solve real-world identity and privacy challenges. IDENTOS' products have embraced User Managed Access with a focus on allowing people to have greater control of their identity and health care data. The LC Agenda is below: . Roll Call . IPR announcement . Agenda Approval . Minutes Approval . Executive Director Update . Work/Discussion Group Updates . Work Group Administration: Federation Interoperability, FIRE + HIAWG . Identifier Registry Presentation - Tom Jones https://trustregistry.org/ . Discussion on Kantara's current IPR options and copyright notices. . Board of Directors Liaisons Update: Andrew Hughes, Ken Dagg . Upcoming Conferences: Identiverse, EIC 2021, Identity Week series, Connect:ID, Identity North Series, others . AOB .............................. Full call-in details: <https://www.google.com/url?q=https://global.gotomeeting.com/join/112012805& sa=D&source=calendar&ust=1613499348900000&usg=AOvVaw2GmED_8avxmfdX7QvULQ9B> https://global.gotomeeting.com/join/112012805You can also dial in using your phone. United States: +1 (646) 749-3129 Access Code: 112-012-805 More phone numbers Australia: +61 2 9087 3604 Austria: +43 7 2081 5427 Belgium: +32 28 93 7018 Canada: +1 (647) 497-9350 Denmark: +45 32 72 03 82 Finland: +358 923 17 0568 France: +33 170 950 594 Germany: +49 692 5736 7317 Ireland: +353 15 360 728 Italy: +39 0 247 92 13 01 Netherlands: +31 207 941 377 New Zealand: +64 9 280 6302 Norway: +47 21 93 37 51 Spain: +34 932 75 2004 Sweden: +46 853 527 827 Switzerland: +41 225 4599 78 United Kingdom: +44 20 3713 5028 Kind regards, The Kantara Staff Team <https://kantarainitiative.org/> <https://signup.e2ma.net/signup/1889513/1769625/> Receive Kantara News & Updates <https://kantarainitiative.org/about/10th-anniversary/> Kantara Initiative, <https://edufoundation.kantarainitiative.org/> Kantara Educational Foundation & <https://kantarainitiative.eu/> Kantara Europe

1 0

Draft Minutes of UMA telecon 2021-02-11
by Alec Laws 11 Feb '21

11 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11 Minutes Roll call Quorum was NOT reached. Approve minutes Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04> Connect.ID 2021 Call for Speakers (Oct 5-6) https://www.terrapinn.com/exhibition/connect-id <https://www.terrapinn.com/exhibition/connect-id/?utm_source=pardot&utm_medi…> Please make sure to submit your application before 26th February: https://www.terrapinn.com/exhibition/connect-id/apply-to-speak.stm <https://www.terrapinn.com/exhibition/connect-id/apply-to-speak.stm> Other upcoming identity/security conference (checkout https://kantarainitiative.org/events/ <https://kantarainitiative.org/events/>): Identity Week Asia Identity Week UK PDP Update PD Program has sent across some proposed license changes. Currently in-review by Kantara AEMS Update There has been some work towards an POC here: https://github.com/uma-email/poc <https://github.com/uma-email/poc> Check it out and get involved! UMA WG Presentation to All-Members 1200-1230 EST Next Wednesday Feb Topic: Industry UMA profiles bring new work to our group Alec will share the slides with the list ahead of this session sat/sun/monday UMA and FAPI discussion con't There has been some reach out to FAPI around our interest in exploring this in the WG. If anyone is interested in leading this item please reach out to Alec or the mailing list. Other profiles next steps What's inside the Wallet? Wallet as an RS? AS? With information (identity + other credentials) stored at the Wallet, does it become an RS for me? With the Wallet, the 'subject' is in the data-flow, more OIDC like. An RS supports more 'delegation' or other requesting parties. Wallet may 'push' to endpoint more than allowing a RP to 'pull' data, specifically a mobile device is hard to be setup as an 'endpoint'. How would push work? RP needs new information, calls an authorization endpoint. The AS routes to the smartphone (how? must be through some web service). The wallet receives a token to hit the RP API with the requested information. One angle is that if the Wallet is an RS, to a client there is no difference. The RP receives a token and can redeem it for the requested information. In the PD profile the dashboard is a normal UMA client. Maybe the 'Wallet' profile can be positioned similarly, where the API being requested is the 'policy api' hosted by the AS. The policy api would expose the registered resources and the associated policies. In the current profile, the RO would need to return to the AS to modify policy (eg invite a new advisor), or see pending requests to their pensions from an advisor. Another interesting overlap between the wallet profile + PD profile is the need to discover RS's that may not have UX or a user credential. Topic for next week, re-introduce wallet/resource manager profiles with the additional pensions dashboard use-case as context. Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Peter Alec Michael Non-voting participants: Ian Colin Regrets: Sal Andi Eve

1 0

Agenda for UMA telecon 2021-02-11
by Alec Laws 10 Feb '21

10 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-11 Date and Time Alternate-week Thursdays 6:30am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-02-04 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04> Connect.ID 2021 Call for Speakers UMA and FAPI discussion AOB Best, - Alec

1 0

Re: [WG-UMA] UMA/Email proof-of-concept
by Eve Maler 08 Feb '21

08 Feb '21

Fascinating that there’s a whole list of issues. More on this subject: It looks like AI and a wallet-like client-side approach are being put into play, potentially fixing some of Hey’s downsides, with a forthcoming solution called Big Mail: https://getbigmail.com/ https://9to5mac.com/2021/01/22/big-mail-email-radical-new-ui/ Eve Maler (sent from my iPad) | cell +1 425 345 6756 > On Sep 29, 2020, at 10:31 AM, Igor Zboran <izboran(a)gmail.com> wrote: > > > Hi all, > > I’ve found that the topic of healthcare is quite popular among UMAnitarians. Although AEMS has been designed as a general or enterprise-oriented system, I think that it also meets the specific needs of the healthcare sector. To demonstrate the feasibility of the UMA/Email idea, I decided to build proof of concept. The full source code will be available in the public GitHub repository https://github.com/uma-email/poc. Any help welcomed. > > -Igor > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma

2 1

Draft minutes of UMA telecon 2021-02-04
by Alec Laws 04 Feb '21

04 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04 Minutes Roll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2021-01-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-01-21>, UMA telecon 2021-01-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-01-28> Andi Moves to Approve, APPROVED Announcing, ANCR WG As shared on the UMA mailing list, a new WG has recently started: Advanced Notice & Consent Receipt - ANCR-WG <https://kantarainitiative.org/confluence/pages/viewpage.action?pageId=14080…> Goal, update consent receipt 1.1, update the fields captured around a specific consent receipt "the anchor receipt" Meets Wednesday 1030ET UMA and FAPI discussion con't FAPI as a profile can notionally be supported by an UMA AS. How can we demonstrate that UMA/FAPI work nicely together? WIth a goal of getting some mutual recognition from FAPI(?) In UK there is a push for strong consent+authorization+privacy, can UMA fill that need left by base security profiles? The federation and delegation cases seem to be realized as an afterthought in these solutions. HEART started profiling UMA for the Healthcare use case, maybe this is a starting point for a UMA/FAPI security profile. Another angle is that FAPI is a security profile for open banking use-case. Can UMA show it's value better in the use-case vs simply accepting security profiles. OpenBanking is defining the "implementation profile"/ wider ecosystem roles and interactions (eg specific client types like payment initiation service providers(sp?)) How can we take this further to include the Consent Receipt? The consent receipt today was designed to be the minimal international information needed for a real meaningful consent. Can a consent receipt be a 'grant'? Person gives their 'grant'(s) at the AS, captured as a consent receipt, before the AS issues the technical grant(uma ticket) to a client. Tickets and token could refer to the specific receipt (ie as a uri). Human gives consent grant, which through law corresponds to outcomes/preferences as interpreted by an AS. https://kantarainitiative.org/confluence/download/attachments/129565039/pri… <https://kantarainitiative.org/confluence/download/attachments/129565039/pri…> Pensions Dashboard update (if needed) No major update. Let's setup a topic around the group IPR separate from the Pensions Dashboard topic Other profiles next steps Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) Voting: Michael Andi Domenico Alec Sal Non-voting participants: Ian George Mark Colin Nancy

1 0

Agenda for UMA telecon 2021-02-04
by Alec Laws 03 Feb '21

03 Feb '21

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-02-04 Date and Time Primary-week Thursdays 6:30am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2021-01-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-01-21>, UMA telecon 2021-01-28 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2021-01-28> Announcing, ANCR WG UMA and FAPI discussion Pensions Dashboard update Other profiles next steps AOB Cheers, - Alec

1 0