<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>Dear all, </div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Please find below preliminary minutes of our call on Feb 22nd 2017.</div>
<div>In any case of error or misunderstanding, please let me know</div>
<div> </div>
<div><u>Participants:</u></div>
<a name="BM_BEGIN"></a>
<div><font face="Calibri" size="2"><span style="font-size:11pt;">James, john, Nicolas, Charles, Siva, Bjorn, Celestin, Keith, Axel</span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;">Agenda:</span></font></div>
<ul style="margin:0;padding-left:36pt;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Schedule for Implementers Draft</li><li style="margin-top:5pt;margin-bottom:5pt;">Updates to Account Porting spec. (draft 04).</li><li style="margin-top:5pt;margin-bottom:5pt;">AOB</li></span></font>
</ul>
<div>Discussion:</div>
<ol style="margin:0;padding-left:36pt;">
<font face="Calibri" size="4"><span style="font-size:16pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Schedule for Implementers Draft</li></span></font>
</ol>
<div><font face="Calibri" size="2"><span style="font-size:11pt;">Bjorn provides participants with the schedule for the MODRNA specifications ready for Implementer’s Draft vote:</span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<ul style="margin:0;padding-left:36pt;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li>Last call: 2017-02-22 to 2017-03-04</li><li>Implementer’s Draft Public Review: 2017-03-04 to 2017-04-18</li><li>Implementer’s Draft Voting Announcement: 2017-04-05</li><li>Implementer’s Draft Voting Period: 2017-04-12 to 2017-04-26</li></span></font>
</ul>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;">any comment or proposed changes to the schedule to feedback to Bjorn.</span></font></div>
<ol start="2" style="margin:0;padding-left:36pt;">
<font face="Calibri" size="4"><span style="font-size:16pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Updates to Account Porting spec. (draft 04).</li></span></font>
</ol>
<div>distributed Feb. 13. [James]</div>
<div>Feedback from CPAS on Account Porting presentation. [James/Siva]<font face="Calibri" size="2"><span style="font-size:11pt;">, updates proposed for next version</span></font></div>
<div>Request is done to everybody to review last specs 0.4.</div>
<div style="padding-left:18pt;"><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<ol start="3" style="margin:0;padding-left:36pt;">
<font face="Calibri" size="4"><span style="font-size:16pt;">
<li>Discussion on asynchronous /synchronous modes and user consent/authentication for token retrieval</li></span></font>
</ol>
<div> </div>
<div>Question to Siva about CPAS discussions.--> <b>Siva to send CPAS minutes</b></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">CPAS inclined to develop a formal spec and combine the different options as a single proposal and then align with MODRNA.</li><li style="margin-top:5pt;margin-bottom:5pt;">Questions on the call: more than choosing asynchronous versus synchronous modes, does the OP retrieve user consent, and authenticate the user ?</li></span></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;">Following a question of the call on the process, a remark from MODRNA chairman regarding CPAS decision: making specs in CPAS before providing them to
MODRNA seems not the good order for operations.</span></font></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Telefonica already implemented in UK.<b> Axel to get in touch with them</b>.</li><li style="margin-top:5pt;margin-bottom:5pt;"> </li><li style="margin-top:5pt;margin-bottom:5pt;">Question regarding TSP collecting consent from user. On what ID ? </li><li style="margin-top:5pt;margin-bottom:5pt;">Attention to confusion regarding different use cases: In any case, good to know who captures the consent and authenticates the user.</li></span></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;">Do we have a good understanding of “what is a trusted SP”, and what are the use cases applying in this case ? </div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;">The use of CIBA without authentication nor consent may not be relevant and a refresh_token mechanism may probably be preferable.</span></font></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">John advice is to not rewrite specs if some existing ones can do the job. In case of trusted provider, deliver a refresh token for offline access is a recommendation.</li><li style="margin-top:5pt;margin-bottom:5pt;">An additional scope offline could solve later access from RP to OP without prompting user. </li><li style="margin-top:5pt;margin-bottom:5pt;"><b>Siva suggests to take back to the CPAS the use of the refresh token</b>. In this case, User has been previously authenticated by OP.</li><li style="margin-top:5pt;margin-bottom:5pt;"> </li><li style="margin-top:5pt;margin-bottom:5pt;">Authentication by the TSP seems not a good idea, how to know it’s the right user identified by SP ?</li><li style="margin-top:5pt;margin-bottom:5pt;">Talking of UK UC. Ex: Trust Equifax to provide attributes. JWT assertion with a signature “give me attributes towards this identifier” has nothing to do with OIDC.</li><li style="margin-top:5pt;margin-bottom:5pt;">John: need for separating APIs in order for people to not confuse them. </li><li style="margin-top:5pt;margin-bottom:5pt;"> </li><li style="margin-top:5pt;margin-bottom:5pt;">Question on User Experience impact.</li><li style="margin-top:5pt;margin-bottom:5pt;">Axel: separating between design and other is bad for privacy and other concepts of OIDC. MC changing the architecture could lead to undesirable outcomes. </li></span></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;">A good approach should be to get the consent at one time, and then deliver a refresh token for the TSP to come back later to OP for getting access token
and ID token for access to user resources.</span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;"><b>We have</b><b> to post these concerns on CPAS immediately</b>.</span></font></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Bjorn: regarding the process, GSMA must provide Use cases to MODRNA for them to propose solutions. The problem seems to rely on multiple variations of use cases. Siva mentions a presentation of David Pollington,
to provide to MODRNA list. </li></span></font>
</ul>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;">Once use cases presented, MODRNA provides tech guidance. Having the same discussions in 2 different bodies is not the good approach.</span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;"><b>a common work between MODRNA and CPAs is a prerequisite</b> for headways. </span></font></div>
<ol start="4" style="margin:0;padding-left:36pt;">
<font face="Calibri" size="4"><span style="font-size:16pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">News from the may workshop </li></span></font>
</ol>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;">location: we have support from Verizon in Netherlands</span></font></div>
<div style="text-indent:-18pt;padding-left:18pt;"><font face="Calibri" size="2"><span style="font-size:11pt;">Kind regards,</span></font></div>
<div style="text-indent:-18pt;padding-left:18pt;">Philippe</div>
<div> </div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>