...
Agenda | Presenter | Duration | DiscussionFo |
Follow up on ID questions | 30 minutes | Vasil to develop a document that outlines the core questions/implementation concerns that you have. From there, could you work with Smita and Trev to outline the flow/process that is needed so that we can identify any gaps in the BB specs or documentation. We need to ensure that everyone is aligned on ID and Authorization - ID BB is oriented only around foundational ID, not authorization. Do we need to create a new Authorization BB that manages SSO, JWT, screen switching, etc. Manages ID and auth across multiple applications. Can the architecture team develop and manage this BB spec? Aleks: Roles and permissions need to be managed in each application. Functional Identity should be managed in one place Need functional IDs for each system, but an SSO system to link. Each application would manage functional authentication - MOSIP has a partner auth system - links to foundational ID, and there is a functional ID for each application/system. From the functional ID, generate a JWT that can be used. Write up a proposal document outlining 1 or 2 scenarios for conversation/discussion. | |
GovStack Portal Question | 20 minutes | There have been discussions that imply that GovStack implementations would have a ‘central portal’.
Explore the differences between an SSO system vs a central portal. | |
PAERA Update | 10 minutes | Update on changes to PAERA document and progress/next steps Working draft: Ready for review and comment (Sections 1-3). Steve and Wes to review. Need to decide where this lives for the upcoming release (GitBook, linked, PDF)?
| |
Prioritize future topics | 10 minutes |
| |
Future topic - Fall 2023 Manage Access Authorization to BB APIs | 30 minutes |
From Technical Committee Meeting: BBs should not own RBAC - the calling applications are responsible for it. Are we using token based authorization within the request to BB? How to get candidates bypass its own RBAC?
|
...