Re: [WG-UMA] [E] Draft minutes of UMA telecon 2020-08-27

Hi Bjorn, potentially yes, because in the general UMA (asynchronous) case, Alice may not be around when Bob seeks access. Here are some previous notes of our discussions on this (where we were calling this both "CIBA-ish" and "high assurance of the RO to the RqP"): - 2018-12-20 <http://High assurance of the RO to the RqP> (including links to several previous discussions) - 2019-01-10 https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-01-10 (where we discussed a potential channel for conveying the assurance) - 2019-08-01 https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-08-01 (in passing) *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Thu, Aug 27, 2020 at 4:40 PM Hjelm, Bjorn < bjorn.hjelm@verizonwireless.com> wrote:

Eve, Regarding the last point, what would be the motivation for developing a "prove to Bob that Alice is who she says she is" profile?

Is there something missing in OpenID Connect and/or CIBA that is prompting this?

BR, Bjorn

On Thu, Aug 27, 2020 at 11:02 AM Eve Maler wrote:

...

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-08-27 https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D08-2D27&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=FZ6XHLcTmzHBOKiKJgCwLb8cvp1OBOmMDdQRwBkhGMs&e= MinutesRoll call

Quorum was reached. Approve minutes

- Approve minutes of UMA telecon 2020-07-09 https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D07-2D09&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=c-dh3tc_3D0hNIA6-E85oP3mHIbfGbUn3A3YrbseHeU&e= , 2020-07-16 https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D07-2D16&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=upZ2T4f6UYf3a5nGfpjpvyHGsieFTqERgpql8IfvUow&e= , 2020-07-23, https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D07-2D23&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=lNMqyqKDV9JaLcN8X_ZtspykLsvoCJ-24EkJ4Hp_JDk&e= 2020-07-30, https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D07-2D30&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=oR6mTGfUhNI0dKzSzkEd0wTQQfN3m6Q0ibwDVTAGbiE&e= 2020-08-06, https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D08-2D06&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=JfngTS23gA8qg12cJ4KbgT1oHVCKirwH1IacEc5gh2U&e= 2020-08-13, https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D08-2D13&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=ddCOvz9vfrU9CdbumvdH4SwczcKALWEL7Hv3TX4RJEU&e= 2020-08-20 https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_confluence_display_uma_UMA-2Btelecon-2B2020-2D08-2D20&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=N5HTNcXURgie5wVIC1STzXnFy6IJy9rn6GJxjZmzmgo&e=

Deferred. Sustainable Self-Sovereign Agents (S3A)

There was a meeting held earlier today – notes and a recording here https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1kZ7-5FSkcn4zb3zOfEu7XZDrYAmLR1T-5FpbBoSk8AEfrSg_edit&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=fuyIawup9oYPmMGfTgmSfacxzFSB_ooyhYgNaKQu-hk&e=. For more info or to get involved, contact Adrian. UMA is being put in play. PKCE and UMA wrapup

Any final *quick* comment on this? Alec has suggested some updates to his latest wording in this email thread https://urldefense.proofpoint.com/v2/url?u=https-3A__groups.google.com_g_kantara-2Dinitiative-2Duma-2Dwg_c_t72iQgd2qEU&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=CtFHEg9jWA3b4DqiMrdcHe-n0nGNv7iNRBKchxtUwXk&e=, though he's not perfectly happy with it. Eve suggests putting it in the UIG anyway, and drawing people's attention to the (non-normative) wording for use and comment.

Adrian notes that a UserInfo endpoint, interacted with in a fashion that is sort of variable in the SSI context (e.g. the first contact could be a QR code), could be an interactive claims gathering endpoint. We have also in the past discussed how we need notification functionality, which requires out-of-band endpoints. Relationship Manager profile

Alec sent thoughts on the policy manager API in this email thread https://urldefense.proofpoint.com/v2/url?u=https-3A__groups.google.com_g_kantara-2Dinitiative-2Duma-2Dwg_c_1BcBSR-5FFnJA&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=Bup95VCgFLU64TDD_-wXk_bR6bwo5aLZQb5yxrgJJAM&e= .

Let's see if we can capture a deeper "why"/comparison statement that could go into the profile. (See the openings of the UMA2 specs for an example.) Alec's new wording does contain this sort of why/comparison/motivation. In other words, in the case where the AS is a "multi-user" AS and Alice (the RO) has no choice about which one it is that she has to use, we want to make sure to preserve as much of Alice's agency (control) in the situation as possible. So pushing policy management out of the AS and into a client app gives Alice this point of control. She wants some freedom to independently verify who is providing advice about what policies to choose. We have, in the past, discussed AI engines that implement things like relationship-based policy. This client could provide such functionality.

The token that protects this policy management interface is different from the PAT but is similar to it. Let's call it a "PMT" right now, for argument's sake.

The FPX work that is being dropped here is the policy manager's interaction with the RS. The previous discussions we were having about "cascading" AS's had to do with the situation when the server-side (multi-user) AS might hold some policy and the client-side (Alice-specific) relationship manager/policy manager might hold some policy too, and then you have to figure out policy ordering. But Alec has left that out for the sake of simplicity.

Adrian objects to working on this profile because it optimizes for a situation where the server-side AS isn't Alice's fiduciary. Alec believes there is nothing in the profile that precludes the RS from presenting 10 AS's and letting the RO choose. Eve believes that Tim has previously concluded that any server-side AS that serves multiple users would have a hard time being anything more than a limited fiduciary (but we have to check). As well, a key requirement expressed by a number of healthcare players has been to "federate" policy management across multiple servers, so this seems to be consistent in a certain sense. Her past discussions with Nancy revolved around "consent management servers" (CMS's) and she brainstormed a "consent access token" (CAT?) to protect a "consent API".

Domenico notes that PSD2 has the concept of a collector – an aggregator of data from multiple bank institutions. This is what this "RO client" (can we call it that? Thomas suggests it) enables the RO to do with policies, across any number of AS's, whether the RO chose them or not.

Scott has been context-switching every time he hears "client", thinking it means our classic "UMA client" that the RqP uses, so we should also qualify "client" when we mean the one that the RO uses.

Should we go back to the RO-client interfacing with both AS's and RS's? Let's think about that.

Adrian loves the notion that the market wants some kind of policy management wallet or agent. [image: (smile)] Is this bidirectional? Is it a read/write API? He suggests extending the "Adrian clause" to the AS as well the RS. Let us ponder that.

Eve adds on top: We may want to think about another modular profile that we should consider drafting, a "prove to Bob that Alice is who she says she is" profile, now that we'll have an RO-client that incidentally allows for Alice-authentication. This would help us solve for CIBA-like use cases (which we've discussed ad nauseam before).

*Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org

https://urldefense.proofpoint.com/v2/url?u=https-3A__kantarainitiative.org_mailman_listinfo_wg-2Duma&d=DwICAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=8ZJPVymFJMqNKGpLw7ucdXDGT09zAscuJdnsZs4jGEQ&s=n3dfATXwpkyXESPfU2RCsEyHfw6EvG0EqPhamSuPUbQ&e=