/
UMA telecon 2022-05-26

UMA telecon 2022-05-26

May 26, 2022

UMA telecon 2022-05-26

Date and Time

Agenda

  • Approve minutes since UMA telecon 2022-03-31

  • UMA/UDAP/etc comparison - Let's add a row for GNAP/mDL

  • Charter Refresh

  • AOB

Attendees

  • NOTE: As of October 26, 2020, quorum is 5 of 9. (Michael, Domenico, Peter, Sal, Thomas, Andi, Alec, Eve, Steve)

  • Voting:

    • Alec

  • Non-voting participants:

    • Scott

    • Nancy

  • Regrets:

Quorum: No

Meeting Minutes

Approve previous meeting minutes

  • Deferred–no quorum

Topics





UMA/UDAP/etc comparison





Julie Use-case Report - progress update on resolving feedback



Charter Refresh

Draft Charter 2022

AOB



me, delegate

?user=delegate 



Does the RqP need to know the owner? No

Does UMA support group membership policy? Yes



Alice has a resource R registered at her A, she delegates control to Bob, allowing Bob to 're-share' R with Sam. 

If Alice shares a resource R with Bob, Bob should not be able to share R with Sam



Delegation of Control (administration): Alice allows Bob to create policies over her resources (R, S, T)

Delegation of Access (sharing): Alice allows Bob to access her resources (R, S)



resource = R, scopes = (a, b, c), owner = O

Explicit Policy (opt-in): O says R can be accessed by ANYONE who provides a (name, email) ← eg to download some whitepaper

Implicit(default) Policy (opt-out): AS has a policy that all R of type can be access by ALL doctors



Implicit Policy: AS will allow any Doctor to access any resource if they assert the scope 'btg'

Implicit Policy: As will allow any RqP who is an Owner to access their own resources



Implicit policy is (today) broadly agreed to by the Owner when the agree to the ASs Terms of Service. Implicit Policy may allow an explicit opt-out by an owner. 

Explicit Opt-out: O say doctor E can't access any of her resources



National Policy > State Policy > Local Policy > (Implicit) Organizational Policy > actual policy < subject/owner/administrator Policy (Explicit)



Should we have have more impl guidance around Group Policy? It's supported in the spec, however most of our public information is Alice→Bob sharing







Potential Future Work Items / Meeting Topics

  • Confluence clean up, archive old items and promote the latest & greatest

  • Review of the email-poc correlated authorization specification

  • A financial use-case report (following the Julie healthcare template)

    • either open banking or pensions dashboard

    • openbanking is to FHIR(data model) as FAPI is to SMARTonFHIR(authZ protocol profile)

  • mDL + UMA

Upcoming Conferences