<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p> (Pretty formatted and linked version of the following meeting note is available from https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09 ) </p>
<h1 class="title"><a href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09">FAPI WG Meeting Notes (2016-08-09)</a></h1>
<p>Date & Time: 2016-08-09 23:00 UTC (16:00 PDT) - 23:59 UTC</p>
<p>Location: GoToMeeting <a class="reference external" href="https://global.gotomeeting.com/join/321819862">https://global.gotomeeting.com/join/321819862</a></p>
<p>Attendees: Nat, Anoop, (Abel Rojas as guest), Edmund, Henrik</p>
<div id="rst-header-agenda" class="contents topic">
<p class="topic-title first">Agenda</p>
<ul class="auto-toc simple">
<li><a id="rst-header-id1" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-roll-call">1. Roll Call</a></li>
<li><a id="rst-header-id2" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-adoption-of-the-agenda">2. Adoption of the Agenda</a></li>
<li><a id="rst-header-id3" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-document-restructuring">3. Document Restructuring</a></li>
<li><a id="rst-header-id4" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-external-org-relationships">4. External Org Relationships</a>
<ul class="auto-toc">
<li><a id="rst-header-id5" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-uk-open-banking-development-group">4.1. UK Open Banking Development Group</a></li>
<li><a id="rst-header-id6" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-iso-tc68">4.2. ISO TC68</a></li>
</ul>
</li>
<li><a id="rst-header-id7" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-new-open-issues">5. New & Open Issues</a></li>
<li><a id="rst-header-id8" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-aob">6. AOB</a>
<ul class="auto-toc">
<li><a id="rst-header-id9" class="reference internal" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-next-call">6.1. Next Call</a></li>
</ul>
</li>
</ul>
</div>
<div id="rst-header-roll-call" class="section">
<h2><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id1">1. Roll Call</a></h2>
<p>Each attendee introduced themselves. Abel Rojas is from Mexico City and was observing as guest. Nat explained that to be a member, one has to sign the IPR Contribution Agreement.</p>
</div>
<div id="rst-header-adoption-of-the-agenda" class="section">
<h2><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id2">2. Adoption of the Agenda</a></h2>
<p>The agenda was adopted unanimously as previously distributed.</p>
</div>
<div id="rst-header-document-restructuring" class="section">
<h2><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id3">3. Document Restructuring</a></h2>
<p>Nat introduced the document restructuring proposal. Current draft jumps all around on different topics and is hard to read. Proposed new structure is as follows, which is available on the WG Wiki(<a class="reference external" href="https://bitbucket.org/openid/fapi/wiki/Editors-Draft-00">https://bitbucket.org/openid/fapi/wiki/Editors-Draft-00</a>)</p>
<p>Financial Services – Financial API:</p>
<pre class="literal-block">1. Scope
2. Normative references
3. Terms and definitions
4. Symbols and Abbreviated terms
5. Getting Tokens
5.1. Introduction
5.2. Read Only Access
5.3. Write Access
6. Using Tokens
6.1 Introduction
6.2 Read Only Access
6.3 Write Access
7. Resource APIs
8. Security Considerations
8.1 TLS Considerations
9. Privacy Considerations
10. Acknowledgement
11. Bibliography
Annex A Financial Data API Level 1 (Normative)
</pre>
<p>Note that the section structures are according to the ISO Directive Part 2.</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">ASK: Discuss whether the proposed structure is adequate, and give mandate to editors to come up with a new WD.</blockquote>
<pre class="literal-block">The callers agreed to adopt the new structure and gave mandate to editors to act on it.
</pre>
</div>
<div id="rst-header-external-org-relationships" class="section">
<h2><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id4">4. External Org Relationships</a></h2>
<div id="rst-header-uk-open-banking-development-group" class="section">
<h3><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id5">4.1. UK Open Banking Development Group</a></h3>
<p>As the follow up to UK Open Banking Worg Group (OBWG) at ODI, Open Banking Development Group (OBDG) has been announced. See ODI Announcement (<a class="reference external" href="http://theodi.org/news/announcing-the-open-banking-development-group?platform=hootsuite">http://theodi.org/news/announcing-the-open-banking-development-group?platform=hootsuite</a>).</p>
<p>Membership strucutre etc. are available at (<a class="reference external" href="https://docs.google.com/document/d/1fUx0Hbc3k2F_NF4mXD55r2E_TKVU5KY6gDM1RJ0J1ds/edit#heading=h.g10eedc4thyf">https://docs.google.com/document/d/1fUx0Hbc3k2F_NF4mXD55r2E_TKVU5KY6gDM1RJ0J1ds/edit#heading=h.g10eedc4thyf</a>).</p>
<p>Fee Structure:</p>
<pre class="literal-block">Corporate: GBP 5,000
SME: GBP 720
</pre>
<p>Should we seek to be a member (under SME) or try to establish a liaison?</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">ASK: Discuss whether we should be a member or request a liaison relationship.</blockquote>
<p>Anoop shared the information from Intuit's UK team on this. He is concerned that we will end-up with multiple standards, where some of them are local. Nat pointed out that we should at least be able to come together on the security aspect and should strive to get the unified API. Callers agreed that it would be good to try to open a liaison channel. At the same time, each member should try to get the communication going.</p>
<p>Action:</p>
<pre class="literal-block">* Nat to draft liaison request
* Anoop to follow up with Intuit UK Team
* Henrik to follow up with Danish Bank, who is a member of OBDG
</pre>
</div>
<div id="rst-header-iso-tc68" class="section">
<h3><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id6">4.2. ISO TC68</a></h3>
<p>ISO TC68 will have a meeting this November. We probably should send a liaison request.</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">ASK: To Mandate Nat to develop a liaison request.</blockquote>
<p>Nat explained what is ISO TC68 and why it is valuable to submit the finished specs to ISO in relationship with WTO TBT treaty. While OpenID Process is WTO TBT treaty compliant and should count as an international standard, in many countries, they are not aware of OIDF standard and getting it published as ISO standard with ISO number is valuable in these cases.</p>
<p>Action:</p>
<pre class="literal-block">Nat to draft liaison request
</pre>
<p>Nat further explained the liaison process, that it has to go through the liaison committee which is composed of Board EC and WG Chairs so that it can be sent as OIDF and not as a WG.</p>
</div>
</div>
<div id="rst-header-new-open-issues" class="section">
<h2><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id7">5. New & Open Issues</a></h2>
<p>In the call, participants discussed the following issues listed in the [issue tracker](<a class="reference external" href="https://bitbucket.org/openid/fapi/issues">https://bitbucket.org/openid/fapi/issues</a>)</p>
<p>Since we were short of time, we have gone through only the following issues:</p>
<ul>
<li>
<p class="first">issue <a title="Accounts: Total Pages and Page does not make sense" href="https://bitbucket.org/openid/fapi/issues/2/accounts-total-pages-and-page-does-not" rel="nofollow">#2</a>: Accounts: Total Pages and Page does not make sense</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<p>It is not meant to be physical page but "memory page". Some companies have hundreds of accounts and need "pagination". Assigned to Anoop. Anoop is going to send the example so that we can make a better "description"</p>
</blockquote>
</li>
<li>
<p class="first">issue <a title="Add "Open Data" data set" href="https://bitbucket.org/openid/fapi/issues/7/add-open-data-data-set" rel="nofollow">#7</a>: Add "Open Data" data set</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<p>There is no such thing in DDA. We need to create our own. David Tonge's group in UK is creating this. We need to get more info on it. At the same time, we should gather more data on each countries so that we can come up with a sensible one. Assigned to Anoop.</p>
</blockquote>
</li>
<li>
<p class="first">issue <a title="Should hard coded paths be avoided" href="https://bitbucket.org/openid/fapi/issues/8/should-hard-coded-paths-be-avoided" rel="nofollow">#8</a>: Should hard coded paths be avoided</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<p>It is desirable not to constrain the path. DDA's path is just an example and implementations are free to create their own path as long as they adhere to the functional requirements. We will write in the main text that the paths in Annex A are only examples. Assigned to Nat.</p>
</blockquote>
</li>
</ul>
<p>Working Group members are asked to go through the rest of issues and put comments in the tracker / discuss on the email list.</p>
<ul class="simple">
<li>issue <a title="Remove MessageFormat and references to it" href="https://bitbucket.org/openid/fapi/issues/4/remove-messageformat-and-references-to-it" rel="nofollow"><s>#4</s></a>: Remove MessageFormat and references to it</li>
<li>issue <a title="Internationalization of strings" href="https://bitbucket.org/openid/fapi/issues/10/internationalization-of-strings" rel="nofollow">#10</a>: Internationalization of strings</li>
<li>issue <a title="OAuth Profile should mandate RFC7636 (PKCE) for code flow" href="https://bitbucket.org/openid/fapi/issues/11/oauth-profile-should-mandate-rfc7636-pkce" rel="nofollow">#11</a>: OAuth Profile should mandate RFC7636 (PKCE) for code flow</li>
<li>issue <a title="OAuth Profile should mandate per AS redirect URI for Clients with session comparison" href="https://bitbucket.org/openid/fapi/issues/12/oauth-profile-should-mandate-per-as" rel="nofollow">#12</a>: OAuth Profile should mandate per AS redirect URI for Clients with session comparison</li>
<li>issue <a title="TLS 1.0 should be banned" href="https://bitbucket.org/openid/fapi/issues/13/tls-10-should-be-banned" rel="nofollow">#13</a>: TLS 1.0 should be banned</li>
<li>issue <a title="Allowed Redirection Client URI is not a defined term" href="https://bitbucket.org/openid/fapi/issues/14/allowed-redirection-client-uri-is-not-a" rel="nofollow">#14</a>: Allowed Redirection Client URI is not a defined term</li>
<li>issue <a title="Client Authentication, not Client Authorization" href="https://bitbucket.org/openid/fapi/issues/15/client-authentication-not-client" rel="nofollow">#15</a>: Client Authentication, not Client Authorization</li>
<li>issue <a title="Client Authentication -- Do we need TLS mutual authentication?" href="https://bitbucket.org/openid/fapi/issues/16/client-authentication-do-we-need-tls" rel="nofollow">#16</a>: Client Authentication -- Do we need TLS mutual authentication?</li>
<li>issue <a title="Incomplete sentence "In line with FFIEC (Federal Financial Institutions Examination Council) guidance on Authentication to mitigate security risks."" href="https://bitbucket.org/openid/fapi/issues/17/incomplete-sentence-in-line-with-ffiec" rel="nofollow">#17</a>: Incomplete sentence "In line with FFIEC (Federal Financial Institutions Examination Council) guidance on Authentication to mitigate security risks."</li>
<li>issue <a title=""Authorization token" is not a defined term in RFC6749" href="https://bitbucket.org/openid/fapi/issues/18/authorization-token-is-not-a-defined-term" rel="nofollow">#18</a>: "Authorization token" is not a defined term in RFC6749</li>
<li>issue <a title="Remove or Improve OAuth Interactions Diagram" href="https://bitbucket.org/openid/fapi/issues/19/remove-or-improve-oauth-interactions" rel="nofollow">#19</a>: Remove or Improve OAuth Interactions Diagram</li>
<li>issue <a title="Meaning of the Surrogate Identifier Clause not clear" href="https://bitbucket.org/openid/fapi/issues/20/meaning-of-the-surrogate-identifier-clause" rel="nofollow">#20</a>: Meaning of the Surrogate Identifier Clause not clear</li>
<li>issue <a title="Residual Data clause should be generalized and moved to privacy considerations" href="https://bitbucket.org/openid/fapi/issues/21/residual-data-clause-should-be-generalized" rel="nofollow">#21</a>: Residual Data clause should be generalized and moved to privacy considerations</li>
<li>issue <a title="Undefined OAuth response parameter "user_id" appears in the text" href="https://bitbucket.org/openid/fapi/issues/22/undefined-oauth-response-parameter-user_id" rel="nofollow">#22</a>: Undefined OAuth response parameter <cite>user_id</cite> appears in the text</li>
<li>issue <a title="How do I find AccountID to use in transfer?" href="https://bitbucket.org/openid/fapi/issues/23/how-do-i-find-accountid-to-use-in-transfer" rel="nofollow">#23</a>: How do I find AccountID to use in transfer?</li>
</ul>
<p>The previous discussion results are recorded in each issue tickets.</p>
<p>Some of the issue was related to the ambiguity etc. of the DDA spec that we are basing on. These (<a title="Incomplete sentence "In line with FFIEC (Federal Financial Institutions Examination Council) guidance on Authentication to mitigate security risks."" href="https://bitbucket.org/openid/fapi/issues/17/incomplete-sentence-in-line-with-ffiec" rel="nofollow">#17</a>, <a title="Meaning of the Surrogate Identifier Clause not clear" href="https://bitbucket.org/openid/fapi/issues/20/meaning-of-the-surrogate-identifier-clause" rel="nofollow">#20</a>, <a title="Undefined OAuth response parameter "user_id" appears in the text" href="https://bitbucket.org/openid/fapi/issues/22/undefined-oauth-response-parameter-user_id" rel="nofollow">#22</a>) was assigned to Anoop, and Anoop will follow up.</p>
<p>Action:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">WG members to follow up with the issues. Anoop to send notes especially on (<a title="Incomplete sentence "In line with FFIEC (Federal Financial Institutions Examination Council) guidance on Authentication to mitigate security risks."" href="https://bitbucket.org/openid/fapi/issues/17/incomplete-sentence-in-line-with-ffiec" rel="nofollow">#17</a>, <a title="Meaning of the Surrogate Identifier Clause not clear" href="https://bitbucket.org/openid/fapi/issues/20/meaning-of-the-surrogate-identifier-clause" rel="nofollow">#20</a>, <a title="Undefined OAuth response parameter "user_id" appears in the text" href="https://bitbucket.org/openid/fapi/issues/22/undefined-oauth-response-parameter-user_id" rel="nofollow">#22</a>).</blockquote>
</div>
<div id="rst-header-aob" class="section">
<h2><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id8">6. AOB</a></h2>
<div id="rst-header-next-call" class="section">
<h3><a class="toc-backref" href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2016-08-09#rst-header-id9">6.1. Next Call</a></h3>
<ul>
<li>
<p class="first">Wed Aug 17, 2pm UTC (4pm Denmark, 7am PDT, 11pm JST)</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<p>Anoop will not be able to join this call, but he will send notes before it so that the group can discuss it.</p>
</blockquote>
</li>
</ul>
<p>Meeting was adjourned at 23:59 UTC.</p>
</div>
</div>
<p> </p>
<div> </div>
</body></html>