Thanks to Adrian for the feedback. Good point about the continuation of the hearings; I believe Justin also will be doing those. If it seems we can't get a solid enough consensus on priorities today, maybe we can partially continue that conversation next week while also diving into some sufficiently top-priority topics. (And thanks for the kind words. Knock 'em dead today!) Everyone also please note: Josh, with the help of Justin and Sarah, has just reported new issue #239 https://github.com/KantaraInitiative/wg-uma/issues/239, a vulnerability to a session fixation attack in the claims-gathering flow, along with potential mitigations. Thanks, folks! I have added this to the matrix. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Wed, Jan 27, 2016 at 12:21 PM, Adrian Gropper wrote:

Regrets that I will not be on the call tomorrow as I'm testifying in the same .gov API task Force that Eve did yesterday. (Eve did a Faboulous job!)

I would add an X to the intersection of 95 (multiple AS) and #trust. I'm particularly thinking of what happens when the same API (e.g.: FHIR in healthcare) is used for a resource that might be accessed under both RO and institutional controls. Again, in healthcare, access to a patient-level FHIR resource could be under HIPAA TPO (no patient consent required, when the Client has certain attributes) or under HIPAA patient right of access (no trust is required as long as the RO specifies the Client.) In this example, the same resource could have two different ASs or the resource would be duplicated in order to work with a single AS UMA.

I believe this issue is not just for healthcare. For example, in IoT, a shared door lock resource might be controlled by the ASs of multiple tenants. When a RqP shows up at the door, they need to be matched with the AS of the tenant they claim invited them.

Adrian

On Wed, Jan 27, 2016 at 3:00 PM, Eve Maler wrote:

...

Please take a look at the linked new roadmap page. I've done an initial job of looking at existing issues in GitHub, seeing which ones had a fair number of comments and/or a fair amount of "passion", and correlating them with use cases we've discussed. But this may not be at all complete.

If you can't come to tomorrow's meeting to discuss priorities, then as a second-best, please try to weigh in on the list. It's ideal to discuss use cases first, but I recognize that some issues don't and won't have use cases attached. Also, I suspect that we'll need to go through all the issues at the end of this process, much as we did last time, to make sure we didn't miss anything.

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

On Wed, Jan 27, 2016 at 11:17 AM, Eve Maler wrote:

...

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-01-28 Date and Time

- *Thu Jan 28,* 9-10am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines https://www.turbobridge.com/join.html), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:* *IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar

Agenda

- Roll call - Approve minutes of UMA telecon 2016-01-07 http://internetidentityworkshop.com/ - V1.0.1 specs are out: Recommendations and I-Ds (see home page) - Thanks, Maciej/Thomas/Oliver! - Other pages are generally updated too - Review the new UMA Roadmap for 2016 http://kantarainitiative.org/confluence/display/uma/UMA+Roadmap+for+2016 page and *prioritize our work* - Good F2F http://kantarainitiative.org/confluence/display/uma/Meetings+and+Minutes opportunities for working sessions - Good liaison opportunities - How does it make sense to revise our charter http://kantarainitiative.org/confluence/display/uma/Charter? - AOB

*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma

--

Adrian Gropper MD

PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/