UMA telecon 2022-08-11
Date and Time
- Primary-week Thursdays 06:30am PT; Secondary-week Thursdays 10:00am PT
Agenda
- Approve minutes since UMA telecon 2022-06-30
- UDAP Spec Reviews - client authZ with JWT grant
- Charter Refresh - vote if quorum
- AOB
Attendees
- NOTE: As of October 26, 2020, quorum is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve)
- Voting:
- Sal
- Alec
- Peter
- Steve
- Eve
- Domenico
- Non-voting participants:
- Regrets:
Quorum: Yes
Meeting Minutes
Approve previous meeting minutes
- Eve moves to approve, Peter seconds. Minutes Approved!
Topics
UDAP Spec Reviews - tiered oauth
https://www.udap.org/udap-client-authorization-grants.html
Why can't OAuth be profiled directly, the UDAP profiles require further profiles to get to an implementable level of specificity
Some of the examples create new risks, or could lead to new risks, eg around end-user identifiers
Few UMA members have stated interests in working with US health care and UDAP and/or UMA adoption in this space. We don't want UMA to be excluded because of perceived overlap with UDAP.
Do we need to explicitly show how UMA and UDAP can work together, eg through some report of udap profile? What do we want to produce, if/how do we engaged with the UDAP folks?
Charter Refresh
Draft Charter 2022
Eve moves to accept the 2022 charter. Sal seconds. motion passes!!
Alec will move it in place on our confluence and inform the LC
AOB
- Alec will check the calendar links
- UMA implementors page, solicit updates from members (eg Keycloak → Redhat)
- Steve will take a first pass of a list of terms for a glossary
- prior lexicon here: Lexicon
- there's some terms defined in the Julie use-case
- Steve to take a look at updating the specs page (consolidate old/new)
- Domenico will send the source files for the uma logo
Potential Future Work Items / Meeting Topics
- FAPI Review (FAPI + UMA)
- Confluence clean up, archive old items and promote the latest & greatest
- Review of the email-poc correlated authorization specification
- A financial use-case report (following the Julie healthcare template)
- either open banking or pensions dashboard
- openbanking is to FHIR(data model) as FAPI is to SMARTonFHIR(authZ protocol profile)
- mDL + UMA
- UMA + GNAP https://oauth.xyz/specs/
- would we have an UMA GNAP version (eg extension of GNAP or UMA? UMAonGNAP)
- will GNAP meet all the UMA outcomes?
- IDPro knowledge base articles
- UMA 2 playground/sandbox
- Minor profiling work,
- resource scopes → scopes
- consent as claims (needs_info)
- PAR as dynamic scopes eg fhir query params
- claims profiling (beyond IDTokens): VCs, consent, policy
Upcoming Conferences