- WG-UMA - mailman.kantarainitiative.org

Reminder: no UMA WG call this week
by Eve Maler 24 Nov '20

24 Nov '20

This is due to the US Thanksgiving holiday on Thursday. (We’ll also have no call on December 24 or 31!) For those celebrating, hope you have a great holiday and a relaxing, healthy, and hearty long weekend. Eve Maler (sent from my iPad) | cell +1 425 345 6756

1 0

Agenda for UMA telecon 2020-11-19
by Eve Maler 18 Nov '20

18 Nov '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-11-19 Date and Time - *Alternate-week Thursdays 10am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2020-10-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-15> , 2020-10-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-22> , 2020-10-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-29> , 2020-11-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-11-05> , 2020-11-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-11-12> - Continue Policy Manager <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> / Trust Model discussion and agree on use cases - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

GAIA X
by Domenico Catalano 18 Nov '20

18 Nov '20

Europe launches GAIA X a federated Data Infrastructure for Europe a secure, federated system that meets the highest standards of digital sovereignty while promoting innovation. This project is the cradle of an open, transparent digital ecosystem, where data and services can be made available, collated and shared in an environment of trust https://www.data-infrastructure.eu/GAIAX/Navigation/EN/Home/home.html <https://www.data-infrastructure.eu/GAIAX/Navigation/EN/Home/home.html> Domenico

3 3

Agenda for UMA telecon 2020-11-12
by Alec Laws 11 Nov '20

11 Nov '20

1 0

Agenda for UMA telecon 2020-11-05
by Alec Laws 05 Nov '20

05 Nov '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-11-05 Date and Time Alternate-week Thursdays 10am PT Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> United States: +1 (224) 501-3316, Access Code: 485-071-053 See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Approve minutes of UMA telecon 2020-10-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-15>, 2020-10-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-22>, 2020-10-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-29> Policy Manager <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> draft text IIW recap AOB

1 0

Congratulations -- For Consent Receipt Supporters
by Mark Lizar 05 Nov '20

05 Nov '20

Hello All, Not sure if anyone has had a chance to review this EU Data Governance document ? (Attached) recital 25 - ” Consent Dashboards provide an aggregate view of all consent statements given digitally based on ‘consent receipts’ for managing relationships between organisations that the data subject would like to give data access too.” and 34 - to bring legal certainty to withdraw of consent”. - this has been a big part of the lobby and advocacy of work here. And it is really incredible to see it in this document. :-) Congrats Kantara and everyone who has supported the work . - Mark

2 1

Draft minutes of UMA telecon 2020-10-29
by Eve Maler 29 Oct '20

29 Oct '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-29 MinutesRoll call Quorum was not reached. Approve minutes - Approve minutes of UMA telecon 2020-10-15, <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-15> 2020-10-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-22> Deferred. Chair and legal editor positions <https://kantarainitiative.org/confluence/display/uma/Leadership+Team> up for annual term - Taking nominations Policy Manager <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> draft text Alec has worked on some user stories (attached to the minutes doc), going back to some of his original work. He has incorporated some of our "wide-ecosystem" and "client trust" thinking. What ecosystem, specifically, is wide here? Adrian's goal tends to be that the RO gets total control ("self-sovereign", not classic federation). Alec struggles with SSI in that the wallets have no certification. Could the AS help with that role? Alec suggests there are two themes: interoperability between the RS and client, and integration. Or maybe better stated, it's "data model" vs. "trust model". They get really conflated all the time. FedZ Sec 1.4 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-federated-authz-2.0…> says "The resource server defines the boundaries of resources and the scopes available to each resource, and interprets how clients' resource requests map to permission requests, by virtue of being the publisher of the API being protected and using the protection API to communicate to the authorization server." That's *data model* stuff: the RS defines its data model, and that of necessity collapses the trust model to some extent (narrows the ecosystem of potential clients somewhat) because only some clients will ever work with that data model. Standard data models such as FHIR are intended to widen ecosystems: to make it possible for more clients to work. The Resource Definitions solution was meant to try and ease the fact that the onus falls on the client to say what profile of the API it supports. There has to be some *trust model* between RS/AS/C, that is, a certifying party. The IdP in OIDC maintains its own client list. What is the case in UMA? The RO might or might not have total control of an AS they use. The AS could have a number of ways to control whether a client (vs. a RqP) is sufficiently untrustworthy that it: a) doesn't get client credentials (say, because it doesn't have a good software statement); 2) isn't allowed to continue with the token-getting protocol; or 3) doesn't get an RPT or permissions it needs for access. The RS could use the Adrian clause. But on what basis – does the RS see the client's software statement? No, not at least within an UMA context. It could detect a device footprint or similar. Let's say we're applying UMA hypothetically to the Data Transfer Project <https://datatransferproject.dev/>, which is very RS-centric, and ROs can choose their AS. It serves a population of users, which constrains clients by API type, making the ecosystem not perfectly "wide". People's relationships with RS's today include a bundled AS/IdP. UDAP is an example of an RS/AS/C certifying party. It's about the trust model, not about the data model, and it's about the trust model in an OAuth context. Some people think UDAP and UMA are stark alternatives, but this analysis helps us start to show how this doesn't seem to be true. We think we can make progress by applying the data model/trust model analysis and Alec's user stories. Nancy is connected to the new DS4P work and can keep us in the loop, along with reaching out to Alec with her thoughts on consent servers. Attendees As of October 26, 2020, quorum <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Michael, Karim, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve) 1. Michael 2. Domenico 3. Alec 4. Eve Non-voting participants: 1. Adrian 2. Nancy 3. Kate 4. Scott 5. Colin Regrets: - Andi - George *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2020-10-29
by Eve Maler 28 Oct '20

28 Oct '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-29 Date and Time - *Primary-week Thursdays 6:30am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2020-10-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-15> , 2020-10-22 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-22> - Chair and legal editor positions <https://kantarainitiative.org/confluence/display/uma/Leadership+Team> up for annual term - Policy Manager <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> draft text - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2020-10-22
by Eve Maler 26 Oct '20

26 Oct '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-22 MinutesRoll call Quorum was not reached. Approve minutes - Approve minutes of UMA telecon 2020-10-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-15> Deferred. Policy Manager <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> draft - review text - Policy data model email <https://groups.google.com/g/kantara-initiative-uma-wg/c/k9LlfGGzLY0> sent by Alec The one needed field is to specify the required values in order to achieve interoperability. Alec's first attempt at an example is for something like a Google Doc Share button for Comment access. The second example starts to get hairy. In specifying required claims, how long can we avoid starting to define a "minimum viable required claims language" for ROs to use that "doesn't need to look like a policy language"? In the solutions with which Identos has deployment experience, how much flexibility does the RO really need? Not much, because the community AS sort of manages to limit the options in a reasonable manner given the actual community. The APIs and scopes are fixed, the packages of client requests are fixed, and so what the clients can get access to is fixed, and in their specific case, the RqP == the RO. For dynamic APIs that rely on an ID token for invocation context, like FHIR with patient ID, UMA becomes less friendly. Even dictating "required claims", we're sort of getting into the policy game a little bit. It seems like a slippery slope. And yet we don't think the RO really cares about the choice of language. An architecture where the AS would be a client of policy information points (PIPs) that could all speak the same policy language by agreement, even if the RO joined each pair together through OAuth in "protection API" fashion, would still be "paternalistic" rather than "self-sovereign" in outlook, though. Our approach is intended to empower the RO more than that (and thus focuses on a client application the RO is able to choose). We need to get clearer on our use cases/user stories. Our sample UX illustrated by Domenico doesn't (yet?) illustrate what happens if the client app interacts with multiple AS's. Can we construct user stories about what the RO wants to have happen when they have multiple AS's? multiple RS's (with resources that could be shared (and thus policy))? multiple RqP's necessitating sharing (and thus policy)? The answers to all this will dictate just what we need to solve in terms of policy and "required claims" interoperability. Alec is going to try to construct some. Attendees As of October 22, 2020 (pre-meeting), quorum is 6 of 11. (Michael, Karim, Domenico, Mike, Peter, Sal, Gaurav, Thomas, Andi, Maciej, Eve) 1. Michael 2. Peter 3. Eve Non-voting participants: 1. Alec 2. Scott 3. Kate 4. Anik Regrets: - Andi *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2020-10-22
by Eve Maler 22 Oct '20

22 Oct '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-22 Date and Time - *Alternate-week Thursdays 10am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/485071053 <https://www.google.com/url?q=https://global.gotomeeting.com/join/485071053&…> - United States: +1 (224) 501-3316, Access Code: 485-071-053 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Approve minutes of UMA telecon 2020-10-15 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-10-15> - Policy Manager <https://github.com/KantaraInitiative/wg-uma/blob/master/uma_policy_manager.…> draft - review text - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1