<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>Thanks to feedback from the list, here is an updated (in red) version of meeting notes :</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<a name="BM_BEGIN"></a>
<div><u>Participants :</u></div>
<div>Bjorn, Axel, Philippe, Charles, Gonzalo</div>
<div> </div>
<div><u>Agenda :</u></div>
<ol style="margin:0;padding-left:36pt;">
<li>CPAS feedback post-Workshop meeting [Siva]</li><li>Issue Tracker [All] #52 to #56</li></ol>
<ol start="3" style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li> </li></span></font>
</ol>
<div><u>Discussion:</u></div>
<ol style="margin:0;padding-left:35.7pt;">
<li>CPAS feedback post-Workshop meeting [Siva]</li></ol>
<div>Not addressed</div>
<div> </div>
<ol start="2" style="margin:0;padding-left:35.7pt;">
<li>Issue Tracker [All]</li></ol>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li><a href="https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text"><font face="Arial" size="2" color="blue"><span style="font-size:10pt;"><u>#52</u></span></font></a></li></span></font>
</ul>
<div>signed request object: it seems to not be enough, keep 52 open until John comment.</div>
<ul style="margin:0;">
<li>John to comment</li></ul>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li><a href="https://bitbucket.org/openid/mobile/issues/53/ciba-terminology-consumption-device"><font face="Arial" size="2" color="blue"><span style="font-size:10pt;"><u>#53</u></span></font></a></li><li><font face="Arial" size="2"><span style="font-size:10pt;">CIBA terminology of consumption device on front channel</span></font><font face="Arial" size="2"><span style="font-size:10pt;">. </span></font><font face="Arial" size="2"><span style="font-size:10pt;">Axel
changed</span></font><font face="Arial" size="2"><span style="font-size:10pt;"> it</span></font><font face="Arial" size="2"><span style="font-size:10pt;">. Nobody disagrees</span></font><font face="Arial" size="2"><span style="font-size:10pt;">,</span></font><font face="Arial" size="2"><span style="font-size:10pt;">
</span></font><font face="Arial" size="2"><span style="font-size:10pt;">change a</span></font><font face="Arial" size="2"><span style="font-size:10pt;">pproved</span></font><font face="Arial" size="2"><span style="font-size:10pt;">.</span></font></li></span></font>
</ul>
<div><font color="red">Issue closed</font></div>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li><a href="https://bitbucket.org/openid/mobile/issues/54/ciba-client-notification-endpoint"><font face="Arial" size="2" color="blue"><span style="font-size:10pt;"><u>#54</u></span></font></a></li></span></font>
</ul>
<div>CIBA BackChannel endpoint authentication.</div>
<div>The client sending an auth request with a bearer token, used to authenticate the ID Provider. Client endpoint must be able to authenticate the OP. This feature is in CIBA from the beginning. John mentioned that banks wouldn’t use bearer tokens. </div>
<div>Could be interesting to allow other kinds of mechanism to authenticate the OP. One possibility is a bearer token, but other means could work too. </div>
<ul style="margin:0;">
<li>Axel to ask to FAPI team what they think</li></ul>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li><a href="https://bitbucket.org/openid/mobile/issues/55/ciba-signed-result-objects"><font face="Arial" size="2" color="blue"><span style="font-size:10pt;"><u>#55</u></span></font></a></li></span></font>
</ul>
<ul style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;">CIBA sends the result object, in S2S communication. FAPI team wants non repudiation. Id Token must be signed, is it enough ? do we need and is there a way to sign the whole response ?</li></ul>
<ul style="margin:0;">
<li>Axel to ask to FAPI team what they think</li></ul>
<ul style="margin:0;">
<font face="Calibri" size="2"><span style="font-size:11pt;">
<li><a href="https://bitbucket.org/openid/mobile/issues/56/signed-request-object-authentication"><font face="Arial" size="2" color="blue"><span style="font-size:10pt;"><u>#56</u></span></font></a></li></span></font>
</ul>
<ul style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;">How to choose between OIDC spec or the JWT spec, as they seem to not be totally consistent ?</li><li style="margin-top:5pt;margin-bottom:5pt;">Email occurred on the list.</li><li style="margin-top:5pt;margin-bottom:5pt;">The signed request object should be OK, because we are in S2S exchanges. in the JWT, only the expiration param is mandatory.</li><li style="margin-top:5pt;margin-bottom:5pt;"><font face="Wingdings">à</font> Question for <b>John</b>.</li></ul>
<ol start="3" style="margin:0;padding-left:36pt;">
<li style="margin-top:5pt;margin-bottom:5pt;">Closing old issues in Issue Tracker [Axel]</li></ol>
<ol start="4" style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;">Go through the old issues on the next call.</li></ol>
<ol start="4" style="margin:0;padding-left:36pt;">
<li>AOB</li></ol>
<div style="text-indent:-18pt;padding-left:18pt;">Axel: how to make categories on Bitbucket.</div>
<div><font color="red">Bjorn <font face="Calibri" size="2"><span style="font-size:11pt;">took an action to reach out to John and Mike (Jones) again to get this resolved</span></font><font face="Calibri" size="2"><span style="font-size:11pt;">.</span></font></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Best regards,</div>
<div>Philippe</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>