<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"><head><!--[if gte mso 9]><xml><o:OfficeDocumentSettings><o:AllowPNG/><o:PixelsPerInch>96</o:PixelsPerInch></o:OfficeDocumentSettings></xml><![endif]--></head><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1467405218321_9560"><span></span></div><div original_target="https://docs.oasis-open.org/xspa/saml-xspa/v2.0/saml-xspa-v2.0.html" id="yui_3_16_0_ym19_1_1467405218321_9561" class="qtdSeparateBR"><div id="yui_3_16_0_ym19_1_1467405218321_9651">A lot of work has been done in <br></div><div dir="ltr"><a saprocessedanchor="true" href="https://docs.oasis-open.org/xspa/saml-xspa/v2.0/saml-xspa-v2.0.html">https://docs.oasis-open.org/xspa/saml-xspa/v2.0/saml-xspa-v2.0.html</a></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467405218321_9718">and also in <br></div><div id="yui_3_16_0_ym19_1_1467405218321_9769" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467405218321_9770" dir="ltr"><a id="yui_3_16_0_ym19_1_1467405218321_9788" saprocessedanchor="true" href="http://docs.oasis-open.org/xacml/xspa/v1.0/xacml-xspa-1.0.html">http://docs.oasis-open.org/xacml/xspa/v1.0/xacml-xspa-1.0.html</a><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467405218321_9682">defining various identifiers. <br></div><div id="yui_3_16_0_ym19_1_1467405218321_10101" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467405218321_10102" dir="ltr">Some of these identifiers can be re-used/re-purposed for defining scopes around resources.</div><div id="yui_3_16_0_ym19_1_1467405218321_10140" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1467405218321_10138" dir="ltr">Cheers</div><div id="yui_3_16_0_ym19_1_1467405218321_10139" dir="ltr">Vivek Biswas, CISSP</div><div id="yui_3_16_0_ym19_1_1467405218321_10157" dir="ltr">Consulting Member@Oracle<br></div><br></div><div style="display: block;" id="yui_3_16_0_ym19_1_1467405218321_9616" class="yahoo_quoted"> <div id="yui_3_16_0_ym19_1_1467405218321_9615" style="font-family: verdana, helvetica, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_ym19_1_1467405218321_9614" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_ym19_1_1467405218321_9613" dir="ltr"> <font id="yui_3_16_0_ym19_1_1467405218321_9612" size="2" face="Arial"> <hr id="yui_3_16_0_ym19_1_1467405218321_9683" size="1"> <b><span style="font-weight:bold;">From:</span></b> Justin Richer <jricher@mit.edu><br> <b><span style="font-weight: bold;">To:</span></b> Debbie Bucci <debbucci@gmail.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "openid-specs-heart@lists.openid.net" <openid-specs-heart@lists.openid.net><br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, July 1, 2016 1:55 PM<br> <b id="yui_3_16_0_ym19_1_1467405218321_9620"><span id="yui_3_16_0_ym19_1_1467405218321_9619" style="font-weight: bold;">Subject:</span></b> Re: [Openid-specs-heart] How do you define a resource set?<br> </font> </div> <div id="yui_3_16_0_ym19_1_1467405218321_9618" class="y_msg_container"><br><div id="yiv3898840633"><div id="yui_3_16_0_ym19_1_1467405218321_9617">No, I think you’re reading it correctly. The RS defines what the resources are, and it communicates the the AS the protection mechanisms around that. So it can say “I have these resource sets”, and it can also say “this resource set has these scopes associated with it”. But it’s up to the API definition (FHIR in our case) to decide what actually goes into the sets themselves. It’s up to either the API definition or a security profile (like what we’re doing here in HEART) to define the mapping between scopes and resulting actions/data. But it’s always up to the RS to enforce these. <div class="yiv3898840633"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633">The UMA standard also has “resource set type” but those types aren’t defined or really used anywhere to my knowledge. We could, as part of our profile work, define resource set types based around FHIR resources as well as the scopes associated with them.</div><div class="yiv3898840633"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633"> — Justin</div><div class="yiv3898840633yqt6413728323" id="yiv3898840633yqt95390"><div class="yiv3898840633"><br class="yiv3898840633" clear="none"><div><blockquote class="yiv3898840633" type="cite"><div class="yiv3898840633">On Jul 1, 2016, at 4:17 PM, Debbie Bucci <<a original_target="mailto:debbucci@gmail.com" saprocessedanchor="true" rel="nofollow" shape="rect" class="yiv3898840633" ymailto="mailto:debbucci@gmail.com" target="_blank" href="mailto:debbucci@gmail.com">debbucci@gmail.com</a>> wrote:</div><br class="yiv3898840633Apple-interchange-newline" clear="none"><div class="yiv3898840633"></div></blockquote></div></div></div></div><div class="yiv3898840633yqt6413728323" id="yiv3898840633yqt77878"><div><div original_target="mailto:openid-specs-heart@lists.openid.net" class="yiv3898840633" dir="ltr"><div class="yiv3898840633"><div class="yiv3898840633">In an effort to move things along, I was going to attempt to define a resource set or two. Is <a original_target="https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html" saprocessedanchor="true" rel="nofollow" shape="rect" class="yiv3898840633" target="_blank" href="https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html">https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html</a> the right documents to reference ? Boy did i have things backasswords!<br class="yiv3898840633" clear="none"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633"><br class="yiv3898840633" clear="none"></div>This document describes how to post/get/update/delete the overall resource set name, but I am having a bit of difficulty understanding what resources are actually in that set. Given that is defined on the RS - perhaps the AS would never know nor could it make fine grained decisions on an element within the set. Instead the AS could consent or deny to share based on AIDs or Mental diagnosis but it would be up to the RS to understand how to translate how those decisions are made.<br class="yiv3898840633" clear="none"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633">This helps better explain to me how the AS could configure/register/interact with a different RS *on the fly*. So, based on skimming the reference, our profile will suggest resource set names for subsets of data that we believe a consumer would want to authorize and potentially additional scopes not included as part of the FHIR/OAUTH Profile. Even those would be dependent on what the RS is willing or could technically support.<br class="yiv3898840633" clear="none"></div><div class="yiv3898840633"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633">I'm missing something ... right?<br class="yiv3898840633" clear="none"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633">Deb<br class="yiv3898840633" clear="none"></div><div class="yiv3898840633"><br class="yiv3898840633" clear="none"></div><div class="yiv3898840633"><br class="yiv3898840633" clear="none"></div></div>
_______________________________________________<br class="yiv3898840633" clear="none">Openid-specs-heart mailing list<br class="yiv3898840633" clear="none"><a saprocessedanchor="true" rel="nofollow" shape="rect" class="yiv3898840633" ymailto="mailto:Openid-specs-heart@lists.openid.net" target="_blank" href="mailto:Openid-specs-heart@lists.openid.net">Openid-specs-heart@lists.openid.net</a><br class="yiv3898840633" clear="none">http://lists.openid.net/mailman/listinfo/openid-specs-heart<br class="yiv3898840633" clear="none"><br class="yiv3898840633" clear="none"></div></div></div><br><div class="yqt6413728323" id="yqt07130">_______________________________________________<br clear="none">Openid-specs-heart mailing list<br clear="none"><a original_target="mailto:openid-specs-heart@lists.openid.net" saprocessedanchor="true" shape="rect" ymailto="mailto:Openid-specs-heart@lists.openid.net" href="mailto:Openid-specs-heart@lists.openid.net">Openid-specs-heart@lists.openid.net</a><br clear="none"><a original_target="http://lists.openid.net/mailman/listinfo/openid-specs-heart" saprocessedanchor="true" shape="rect" href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>