SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>User-Managed Access</title>

</head>

User-Managed Access

</h1>

</header>

User-Managed Access (UMA) is an <a href="OAuth#OAuth_2.0" title="OAuth">OAuth</a>-based access management protocol standard for party-to-party authorization.<a href="#cite_note-1">[1]</a> Version 1.0 of the standard was approved by the <a href="Kantara_Initiative" title="Kantara Initiative">Kantara Initiative</a> on March 23, 2015.<a href="#cite_note-2">[2]</a>

As described by the charter of the group that developed UMA,<a href="#cite_note-User_Managed_Access_Work_Group-3">[3]</a> the purpose of the protocol specifications is to “enable a resource owner to control the authorization of <a href="Data_shaping" class="mw-redirect" title="Data shaping">data sharing</a> and other protected-resource access made between online services on the owner’s behalf or with the owner’s authorization by an autonomous requesting party”. This purpose has privacy and consent implications for web applications and the <a href="Internet_of_Things" class="mw-redirect" title="Internet of Things">Internet of Things</a> (IoT), as explored by the collection of case studies contributed by participants in the standards group.<a href="#cite_note-4">[4]</a>

<div class="mw-heading mw-heading2"><h2 id="Comparison_to_OAuth_2.0">Comparison to OAuth 2.0</h2></div>

The diagram from <a href="#cite_note-5">[5]</a> (see right) highlights key additions that UMA makes to OAuth 2.0.

In a typical OAuth flow:

A resource owner (RO), a human who uses a client application, is redirected to an authorization server (AS) to log in and consent to the issuance of an access token. This access token allows the client application to gain API access to the resource server (RS) on the resource owner's behalf in the future, likely in a scoped (limited) fashion. The resource server and authorization server most likely operate within the same security domain, and communication between them is not necessarily standardized by the main OAuth specification.

User-Managed Access adds three main concepts and corresponding structures and flows:

<dl><dt>Protection API</dt>

<dd>UMA defines a standardized Protection API for the authorization servers with which resource servers communicate about data security. This API enables multiple resource servers to communicate with one authorization server and vice versa. Because the Protection API is itself secured with OAuth, it allows for formal trust establishment between each pair. This also allows an authorization server to present a centralized user interface for resource owners.</dd>

<dt>Requesting Party (RqP)</dt>

<dd>UMA defines requesting parties separately from resource owners. This enables party-to-party sharing and fine-grained delegation of access authorization. A resource owner need not consent to token issuance at runtime (i.e. each time their data is requested), but can instead define a policy at the authorization server to allow requesting parties asynchronous access to specific limited authorization scopes.</dd>

<dt>Trust Elevation</dt>

<dd>UMA enables access attempts to result in successful issuance of authorization tokens based on a process of trust elevation for requesting parties. This process may involve gathering identity claims or other claims from a requesting party, thus facilitating more robust security of resource owners' data.</dd></dl>

<div class="mw-heading mw-heading2"><h2 id="History_and_background">History and background</h2></div>

The <a href="Kantara_Initiative" title="Kantara Initiative">Kantara Initiative's</a> UMA Work Group<a href="#cite_note-User_Managed_Access_Work_Group-3">[3]</a> held its first meeting<a href="#cite_note-6">[6]</a> on August 6, 2009. UMA's design principles and technical design have been informed by previous work by Sun Microsystems employees, begun in March 2008, on a protocol called ProtectServe. In turn, ProtectServe was influenced by the goals of the <a href="Vendor_Relationship_Management" class="mw-redirect" title="Vendor Relationship Management">Vendor Relationship Management</a> movement and an offshoot effort called feeds-based VRM.

ProtectServe and UMA's earliest versions leveraged the <a href="OAuth" title="OAuth">OAuth</a> 1.0 protocol. As OAuth underwent significant change through the publication of the Web Resource Authorization Protocol (WRAP) specification and, subsequently, drafts of OAuth 2.0, the UMA specification has kept pace, and it now uses the OAuth 2.0 family of specifications for several key protocol flows.

UMA does not use or depend on OpenID 2.0 as a means of user identification. However, it optionally uses the OAuth-based OpenID Connect protocol as a means of collecting identity claims from a requesting party in order to attempt to satisfy the authorizing user's access policy.

UMA also does not use or depend on the eXtensible Access Control Markup Language (<a href="XACML" title="XACML">XACML</a>) as a means of encoding user policy or requesting policy decisions. UMA does not dictate policy format, as policy evaluation is performed internally to the authorization server (AS) from the UMA perspective. Typically, XACML would be used to implement the policies inside the AS. Its implementation is out-of-scope of UMA. The UMA protocol flows for requesting access permission have some features in common with the XACML protocol.

<div class="mw-heading mw-heading2"><h2 id="Standardization_status">Standardization status</h2></div>

The UMA group conducts its work in the Kantara Initiative<a href="#cite_note-7">[7]</a> and has also contributed a series of Internet-Draft specifications to the <a href="Internet_Engineering_Task_Force" title="Internet Engineering Task Force">Internet Engineering Task Force</a> (IETF) as an eventual home for UMA standardization work. To this end, the WG has contributed several individual Internet-Drafts to the IETF for consideration. One of these, a specification for OAuth dynamic client registration,<a href="#cite_note-Richer-8">[8]</a> served as input for the more generalized mechanism ultimately developed for OAuth.<a href="#cite_note-Richer-8">[8]</a>

UMA was presented to the OAuth Working Group<a href="#cite_note-9">[9]</a> at the IETF 104 conference in March 2019,<a href="#cite_note-10">[10]</a> but that did not result in any UMA specifications being adopted by the IETF.

<div class="mw-heading mw-heading2"><h2 id="Implementation_and_adoption_status">Implementation and adoption status</h2></div>

The UMA core protocol has several implementations,<a href="#cite_note-11">[11]</a> including several open source implementations. Sources of active and available open-source implementations include <a href="ForgeRock" title="ForgeRock">ForgeRock</a>,<a href="#cite_note-12">[12]</a> Gluu,<a href="#cite_note-13">[13]</a> IDENTOS Inc.,<a href="#cite_note-14">[14]</a> MITREid Connect,<a href="#cite_note-15">[15]</a> Atricore, Node-UMA,<a href="#cite_note-16">[16]</a> Roland Hedberg,<a href="#cite_note-17">[17]</a> <a href="Keycloak" title="Keycloak">Keycloak</a>,<a href="#cite_note-18">[18]</a> and <a href="WSO2_Identity_Server" class="mw-redirect" title="WSO2 Identity Server">WSO2 Identity Server</a>.<a href="#cite_note-docs.wso2.com-19">[19]</a> A Kantara Initiative group is working on developing "free and open-source software (FOSS), in several popular programming languages, that empowers developers to incorporate UMA protection and authorization API enablement into applications, services, and devices".<a href="#cite_note-20">[20]</a>

UMA-enabled products are available from Gluu,<a href="#cite_note-21">[21]</a> Jericho Systems,<a href="#cite_note-22">[22]</a> ForgeRock,<a href="#cite_note-23">[23]</a> IDENTOS Inc.<a href="#cite_note-24">[24]</a> and WSO2 Identity Server <a href="#cite_note-docs.wso2.com-19">[19]</a>

<div class="mw-heading mw-heading2"><h2 id="Current_processing_and_acceptance_status">Current processing and acceptance status</h2></div>

The UMA protocol has multiple implementations. Forgerock offers a first open source implementation under OpenUMA.<a href="#cite_note-25">[25]</a> A first implementation of the authorization server is to be tested with OpenAM in the nightly build.<a href="#cite_note-forgerock-26">[26]</a>

Gluu has implemented UMA to secure and manage access to APIs.<a href="#cite_note-27">[27]</a> Cloud Identity Limited has a full UMA implementation for securing and managing access to personal information and web APIs. Several others have expressed interest in implementation and interoperability testing to the working group.

<div class="mw-heading mw-heading2"><h2 id="Applicable_use_cases">Applicable use cases</h2></div>

UMA's architecture can serve a variety of consumer-facing and enterprise-facing use cases. The UMA group collects case studies on its wiki.<a href="#cite_note-ki_case-28">[28]</a>

One example set of use cases is in healthcare IT and consumer health. In the OpenID Foundation organization, a working group called Health Relationship Trust (HEART)<a href="#cite_note-29">[29]</a> is working to "harmonize and develop a set of privacy and security specifications that enable an individual to control the authorization of access to RESTful health-related data sharing APIs", building upon, among other standards, UMA.

Another example set of use cases, which originally influenced UMA's development, is in the area of "personal data stores" in the fashion of <a href="Vendor_relationship_management" title="Vendor relationship management">vendor relationship management</a>. In this conception, an individual can choose an operator of an authorization service that accepts connections from a variety of consumer-facing digital resource hosts in order to offer a dashboard with resource sharing management capabilities.

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFMalerMachulakRicher2018" class="citation web cs1">Maler, E.; Machulak, M.; Richer, J. (2018-01-07). <a rel="nofollow" class="external text" href="https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html#introduction">"User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization"</a>. docs.kantarainitiative.org. Retrieved 2024-01-11.</cite>

</li>

<li id="cite_note-2"><a href="#cite_ref-2">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://kantara.atlassian.net/wiki/spaces/uma/pages/4857568/UMA+telecon+2015-02-23">"UMA telecon 2015-02-23 - WG - User Managed Access - Kantara Initiative"</a>. kantara.atlassian.net. Retrieved 2024-01-11.</cite>

</li>

<li id="cite_note-User_Managed_Access_Work_Group-3">^ <a href="#cite_ref-User_Managed_Access_Work_Group_3-0">a</a> <a href="#cite_ref-User_Managed_Access_Work_Group_3-1">b</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://kantarainitiative.org/workgroups/user-managed-access-work-group/">"User Managed Access Work Group"</a>. Kantara Initiative: Trust through ID Assurance. Retrieved 2024-01-11.</cite>

</li>

<li id="cite_note-4"><a href="#cite_ref-4">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://kantara.atlassian.net/wiki/spaces/uma/pages/4850549/Case+Studies">"Case Studies - WG - User Managed Access - Kantara Initiative"</a>. kantara.atlassian.net. Retrieved 2024-01-11.</cite>

</li>

<li id="cite_note-5"><a href="#cite_ref-5">^</a> <cite class="citation cs2"><a rel="nofollow" class="external text" href="https://www.youtube.com/watch?v=WL0YNr4FEi4">CIS 2015 Tuesday, June 9 - George Fletcher, AOL</a>, July 2015, retrieved 2024-01-11</cite>

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://kantara.atlassian.net/wiki/spaces/uma/pages/4857529/UMA+telecon+2009-08-06">"UMA telecon 2009-08-06 - WG - User Managed Access - Kantara Initiative"</a>. kantara.atlassian.net. Retrieved 2024-01-11.</cite>

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://kantara.atlassian.net/wiki/spaces/uma/overview?homepageId=4849674">"WG - User Managed Access - Kantara Initiative"</a>. kantara.atlassian.net.</cite>

</li>

<li id="cite_note-Richer-8">^ <a href="#cite_ref-Richer_8-0">a</a> <a href="#cite_ref-Richer_8-1">b</a> <cite id="CITEREFRicherJonesBradleyMachulak2015" class="citation report cs1">Richer, Justin; Jones, Michael B.; Bradley, John; Machulak, Maciej; Hunt, Phil (July 2015). <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/rfc7591/">OAuth 2.0 Dynamic Client Registration Protocol</a> (Report). Internet Engineering Task Force.</cite>

</li>

<li id="cite_note-9"><a href="#cite_ref-9">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://datatracker.ietf.org/wg/oauth/about/">"Web Authorization Protocol (oauth)"</a>. datatracker.ietf.org. Retrieved 2024-01-11.</cite>

</li>

<li id="cite_note-10"><a href="#cite_ref-10">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://datatracker.ietf.org/meeting/104/materials/minutes-104-oauth-00">"IETF104 - oauth WG - meeting minutes"</a>.</cite>

</li>

<li id="cite_note-11"><a href="#cite_ref-11">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://kantarainitiative.org/confluence/display/uma/UMA+Implementations">"UMA Implementations - WG - User Managed Access - Kantara Initiative"</a>.</cite>

</li>

<li id="cite_note-12"><a href="#cite_ref-12">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://forgerock.org/openuma/">"Digital Identity for Consumers and Workforce | ForgeRock"</a>.</cite>

</li>

<li id="cite_note-13"><a href="#cite_ref-13">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20140209133913/http://www.gluu.org/open-source/open-source-vs-on-demand/">"Mission Critical Authentication and Authorization - Open Source vs On Demand"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.gluu.org/open-source/open-source-vs-on-demand/">the original</a> on 2014-02-09. Retrieved 2024-01-19.</cite> Gluu OSS implementation of UMA

</li>

<li id="cite_note-14"><a href="#cite_ref-14">^</a> <a rel="nofollow" class="external text" href="https://identos.com/">IDENTOS Inc. Federated Privacy Exchange (FPX)</a>

</li>

<li id="cite_note-15"><a href="#cite_ref-15">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server">"An OpenID Connect reference implementation in Java on the Spring platform"</a>. github.com. Retrieved 2024-01-19.</cite>

</li>

<li id="cite_note-16"><a href="#cite_ref-16">^</a> <a rel="nofollow" class="external text" href="https://github.com/atricore/node-uma/">Atricore OSS implementation of UMA for Node.js</a>

</li>

<li id="cite_note-17"><a href="#cite_ref-17">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/rohe/pyuma">"Rohe/Pyuma"</a>. <a href="GitHub" title="GitHub">GitHub</a>. 22 January 2018.</cite>

</li>

<li id="cite_note-18"><a href="#cite_ref-18">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20190306234830/https://www.keycloak.org/docs/4.0/release_notes/index.html">"Keycloak 4.0.0.Final"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.keycloak.org/docs/4.0/release_notes/index.html">the original</a> on 2019-03-06. Retrieved 2019-03-05.</cite>

</li>

<li id="cite_note-docs.wso2.com-19">^ <a href="#cite_ref-docs.wso2.com_19-0">a</a> <a href="#cite_ref-docs.wso2.com_19-1">b</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://docs.wso2.com/display/IS580/User+Managed+Access">"User Managed Access - Identity Server 5.8.0 latest - WSO2 Documentation"</a>.</cite>

</li>

<li id="cite_note-20"><a href="#cite_ref-20">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20160216134803/http://kantarainitiative.org/confluence/display/umadev/Home">"Home - WG - User-Managed Access Developer Resources - Kantara Initiative"</a>. Archived from <a rel="nofollow" class="external text" href="http://kantarainitiative.org/confluence/display/umadev/Home">the original</a> on 2016-02-16. Retrieved 2015-08-13.</cite>

</li>

<li id="cite_note-21"><a href="#cite_ref-21">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20150805132945/http://www.gluu.org/gluu-server/access-management/">"Web Access Management | the Gluu Server for SSO, WAM, & 2FA | Gluu"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.gluu.org/gluu-server/access-management/">the original</a> on 2015-08-05. Retrieved 2015-08-13.</cite>

</li>

<li id="cite_note-22"><a href="#cite_ref-22">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20190615020113/https://www.jerichosystems.com/company/pr04082015.html">"Jericho Systems Corporation Announces the Release of Consentral™ on FHIR for the Control of Sensitive Health Information"</a>. Archived from <a rel="nofollow" class="external text" href="https://www.jerichosystems.com/company/pr04082015.html">the original</a> on 2019-06-15.</cite>

</li>

<li id="cite_note-23"><a href="#cite_ref-23">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.forgerock.com/platform/user-managed-access/">"User-Managed Access (UMA) - ForgeRock"</a>.</cite>

</li>

<li id="cite_note-24"><a href="#cite_ref-24">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://identos.com/products-federated-privacy-exchange-fpe/">"Federated Privacy Exchange - by IDENTOS"</a>.</cite>

</li>

<li id="cite_note-25"><a href="#cite_ref-25">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.forgerock.com/blog/tag/openuma">"All Posts about OpenUMA"</a>. Retrieved 2024-01-19.</cite>

</li>

<li id="cite_note-forgerock-26"><a href="#cite_ref-forgerock_26-0">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.forgerock.com/platform/access-management">"ForgeRock Access Management"</a>. Retrieved 2024-01-19.</cite>

</li>

<li id="cite_note-27"><a href="#cite_ref-27">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20150924022613/http://www.gluu.org/open-source/open-source-vs-on-demand/">"Gluu - Open Source"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.gluu.org/open-source/open-source-vs-on-demand/">the original</a> on 2015-09-24.</cite> Gluu OSS implementation of UMA

</li>

<li id="cite_note-ki_case-28"><a href="#cite_ref-ki_case_28-0">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://kantarainitiative.org/confluence/display/uma/Case+Studies">"Case Studies - WG - User Managed Access - Kantara Initiative"</a>.</cite>

</li>

<li id="cite_note-29"><a href="#cite_ref-29">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://openid.net/wg/heart/">"HEART WG | OpenID"</a>. 27 October 2014.</cite>

</li>

</ol></div>

<div class="mw-heading mw-heading2"><h2 id="Further_reading">Further reading</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .refbegin{margin-bottom:0.5em}.mw-parser-output .refbegin-hanging-indents>ul{margin-left:0}.mw-parser-output .refbegin-hanging-indents>ul>li{margin-left:0;padding-left:3.2em;text-indent:-3.2em}.mw-parser-output .refbegin-hanging-indents ul,.mw-parser-output .refbegin-hanging-indents ul li{list-style:none}@media(max-width:720px){.mw-parser-output .refbegin-hanging-indents>ul>li{padding-left:1.6em;text-indent:-1.6em}}.mw-parser-output .refbegin-columns{margin-top:0.3em}.mw-parser-output .refbegin-columns ul{margin-top:0}.mw-parser-output .refbegin-columns li{page-break-inside:avoid;break-inside:avoid-column}@media screen{.mw-parser-output .refbegin{font-size:90%}}

/* end https://en.wikipedia.org/ */

</style><div class="refbegin" style="">

<ul><li><cite id="CITEREFSchwartzMachulak2018" class="citation book cs1">Schwartz, Michael; Machulak, Maciej (2018). "User-Managed Access". Securing the Perimiter: Deploying Identity and Access Management with Free Open Source Software. Apress. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9781484226018</bdi>.</cite></li></ul>

</div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<li><a rel="nofollow" class="external text" href="https://docs.kantarainitiative.org/uma/rec-uma-core.html">User-Managed Access (UMA) Profile of OAuth 2.0 Recommendation</a></li>

<li><a rel="nofollow" class="external text" href="https://docs.kantarainitiative.org/uma/rec-oauth-resource-reg.html">OAuth 2.0 Resource Set Registration Recommendation</a></li>

<li><a rel="nofollow" class="external text" href="https://kantara.atlassian.net/wiki/spaces/uma/pages/4849710/UMA+Implementations">UMA Implementations</a></li></ul></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2024-12-22" href="https://en.wikipedia.org/wiki/?title=User-Managed_Access&oldid=1264501120">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>