<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:游ゴシック;
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"ＭＳ Ｐゴシック";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:"\@ＭＳ Ｐゴシック";}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
@font-face
{font-family:"\@游ゴシック";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:"Open Sans";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"ＭＳ Ｐゴシック";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0mm;
mso-margin-bottom-alt:auto;
margin-left:0mm;
font-size:12.0pt;
font-family:"ＭＳ Ｐゴシック";}
span.18
{mso-style-type:personal-reply;
font-family:游ゴシック;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:游ゴシック;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="JA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:游ゴシック">3). If there is a way to show that “policy” thing that Philip mentions, then 2).
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:游ゴシック"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net>
<b>On Behalf Of </b>Dave Tonge via Openid-specs-fapi<br>
<b>Sent:</b> Monday, July 1, 2019 3:41 PM<br>
<b>To:</b> Financial API Working Group List <openid-specs-fapi@lists.openid.net><br>
<b>Cc:</b> Dave Tonge <dave.tonge@momentumft.co.uk>; Certification <certification@oidf.org><br>
<b>Subject:</b> Re: [Openid-specs-fapi] FAPI certification testing for refresh tokens<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Trebuchet MS",sans-serif">I vote for option 3.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Fri, 28 Jun 2019 at 17:32, Joseph Heenan via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0mm 0mm 0mm 6.0pt;margin-left:4.8pt;margin-right:0mm">
<div>
<p class="MsoNormal"><span lang="EN-US">I don’t believe any UK banks support offline_access. I wonder if other ecosystems might.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">It sounds like you may be agreeing with me that either ‘3’ or ‘4’ would be acceptable options, is that fair?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Thanks<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Joseph<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-US">On 28 Jun 2019, at 16:21, Filip Skokan <<a href="mailto:panva.ip@gmail.com" target="_blank">panva.ip@gmail.com</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">If the OP has a custom policy for deciding whether to issue a refresh token you can't always mandate they issue them to the tool which may not fall under that policy. The only thing testable for conformance and interoperability's
sake would be if the server indicates offline_access scope and refresh_token grant type support, in which case you can mandate the tester whitelist this grant for the tested client and you can then test section 11 of Core.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Going beyond this would be creating a profile of your own.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><br clear="all">
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">S pozdravem,<br>
<b>Filip Skokan</b><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Fri, 28 Jun 2019 at 17:13, Joseph Heenan <<a href="mailto:joseph@authlete.com" target="_blank">joseph@authlete.com</a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0mm 0mm 0mm 6.0pt;margin-left:4.8pt;margin-right:0mm">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Filip,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Refresh tokens in general.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Specifically some/many UK banks issue them without scope=offline_access. FAPI certification also doesn’t currently require the user info endpoint is supported, though I believe core certification requires this.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">(I suspect the desire to issue refresh tokens is related to a desire to not have to support revoking access tokens - i.e. that short lived access tokens that can be refreshed mostly removes the need to ever revoke an
access token, but I could be wrong.)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Joseph<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-US">On 28 Jun 2019, at 15:41, Filip Skokan <<a href="mailto:panva.ip@gmail.com" target="_blank">panva.ip@gmail.com</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Joseph,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">can you clarify if you're talking about refresh tokens in general or the scope offline_access + prompt consent condition of OIDC?<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><br clear="all">
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">S pozdravem,<br>
<b>Filip Skokan</b><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Fri, 28 Jun 2019 at 16:29, Joseph Heenan <<a href="mailto:joseph@authlete.com" target="_blank">joseph@authlete.com</a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0mm 0mm 0mm 6.0pt;margin-left:4.8pt;margin-right:0mm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US">Hi FAPI WG,<br>
<br>
A question has arisen about exactly how refresh tokens should be tested in the FAPI-RW conformance suite (tests for this are currently being written, a suggestion Dave Tonge originally made as many banks in the UK ecosystem are able to issue refresh tokens,
and I presume in some cases not correctly...).<br>
<br>
As support of refresh tokens is entirely optional in FAPI, the question is essentially: “what should happen if the AS doesn’t issue a refresh token?”<br>
<br>
The options seem to be:<br>
<br>
1) The test is marked as passed (I’m not in favour of this option as it may well be that the tester has accidentally registered the clients without the refresh token grant)<br>
<br>
2) The test fails if the discovery document indicates the server supports refresh tokens (on the grounds that it indicates that the client has been wrongly configured and if the server supports refresh tokens they conformance suite must be able to test them
- note that discovery is also optional in FAPI-RW, though I’m questioning whether this should be the case:
<a href="https://bitbucket.org/openid/fapi/issues/239/fapi-part-2-should-mention-require" target="_blank">
https://bitbucket.org/openid/fapi/issues/239/fapi-part-2-should-mention-require</a> - the counter argument is that potentially ASs may support refresh tokens but only for non-FAPI-RW use cases)<br>
<br>
3) Same as ‘2’ but make it a warning instead of a failure (essentially suggesting that it may be okay but certificatee should be able to give a good reason why refresh tokens aren’t issued in their server when FAPI-RW is in use)<br>
<br>
4) The test is marked as “not testable” or some similar phrase, probably resulting in a similar conversation as for ‘3’.<br>
<br>
Does anyone have any thoughts please?<br>
<br>
Thanks<br>
<br>
Joseph<o:p></o:p></span></p>
</blockquote>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US">_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><br clear="all">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">-- <o:p></o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#00A4B7">Dave Tonge<o:p></o:p></span></b></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.5pt;font-family:"Open Sans",serif;color:#333333">CTO<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.5pt;font-family:"Open Sans",serif;color:#333333"><a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" target="_blank"><span style="color:#835EA5;text-decoration:none"><img border="0" width="200" height="50" style="width:2.0833in;height:.5208in" id="_x0000_i1025" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png" alt="Moneyhub Enterprise"></span></a><o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.5pt;font-family:"Open Sans",serif;color:#00A4B7">Moneyhub Financial Technology, 5th Floor, 10 Temple Back, Bristol, BS1 6FL</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#333333"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.5pt;font-family:"Open Sans",serif;color:#00A4B7">t: </span></b><span lang="EN-US" style="font-size:8.5pt;font-family:"Open Sans",serif;color:#333333">+44 (0)117 280 5120</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#333333"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#333333"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#333333">Moneyhub Enterprise is a trading style of Moneyhub Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority
("FCA"). Moneyhub Financial Technology is entered on the Financial Services Register (FRN </span><b><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#00A4B7">809360</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#333333">)
at <a href="http://fca.org.uk/register" target="_blank">fca.org.uk/register</a>. Moneyhub Financial Technology is registered in England & Wales, company registration number </span><b><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#00A4B7">06909772</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#333333"> .</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#616161"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#333333">Moneyhub Financial Technology Limited 2018 </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222">©</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#333333"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#333333"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Open Sans",serif;color:#888888">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information
in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from
this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Moneyhub Financial
Technology Limited or of any other group company.</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Open Sans",serif;color:#333333"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>