[Openid-specs-ab] Spec Call Notes 14-Feb-19

[Mike Jones]

Bjorn Hjelm was also in attendance.

From: Mike Jones
Sent: Thursday, February 14, 2019 8:31 AM
To: openid-specs-ab at lists.openid.net
Subject: Spec Call Notes 14-Feb-19

Spec Call Notes 14-Feb-19

Brian Campbell
George Fletcher
Jeff Lombardo
Rich Levinson
Roland Hedberg
Torsten Lodderstedt
Mike Jones
Nat Sakimura
George Fletcher
Tom Jones

OpenID Connect for Identity Proofing
              Torsten submitted a draft this week
                           [Openid-specs-ab] OpenID Connect for Identity Proofing (Proposal)
              The extension can convey user data and assurance, methods, processes, and evidence
              There is need for this kind of strong identity proofing
              There is a need to specify which claims are verified
                           And to convey both verified and non-verified claims
              Torsten is using this for anti money laundering, for instance
              The requirements are written down in the introduction
              The extension has two parts
                           Definition of additional claims
                                         Such as place of birth
                           Syntax and semantics for requesting and providing verified claims
              People are requested to review the doc by the Feb 28 call in two weeks
                           We will adopt it then unless objections are voiced
              Nat: Minimum viable Electronic Know Your Customer (EKYC) work is being done in the EU
                           We should align with that work
                           The chair Stephane G Mouy is willing to work with us
                           Presentations:
                                         https://www.dropbox.com/s/ls28l1ps53u2u2b/3.%20%20PriGroup%202%20Minimum%20Viable%20eKYC%20Framework%20Presentation%20-%20Final2%20%28002%29.pdf.pdf?dl=0
                                     https://www.dropbox.com/s/b4egx1gxma8xh9x/LoA-rated%20Attribute%20Framework%20Proposal%20-%2020181017.pdf?dl=0
                           The EKYC effort will report by the end of June to the EIDAS group in the EU
              Torsten agrees that we should work with people from multiple jurisdictions
              Nat: The EU plan is to have the claims provider be separate from the IdP
                           Torsten is using this in practice
                           The RP requests only the claims that it needs - in accordance with GDPR
              A multi-faceted discussion of legal and regulatory requirements occurred
                           EU law requires that the recipient acquire specific claims about the verification
                           The US AAMVA, however, requires that proofing be verified but the proofing data need not be acquired
                           Different jurisdictions will use different procedures and legal frameworks
                           George: What we're largely discussing is differences in business requirements
                           Mike: It's up to implementers and deployers to comply with local legal and business requirements
                                         We as spec writers should supply tools helping them do that
                           Nat: What we write needs to be globally relevant
                           Torsten: We need to collect use cases from different jurisdictions
                           Nat: In Japan, OIDF-J is doing EKYC work
              Nat asked whether this should be in the Connect WG or another one
                           Mike said that the claims request and response syntax is an extension to Connect, so belongs here
                           We should seek broad legal and policy review as we're doing the work
              Tom asked us to consider use cases in which additional information is requested outside the Connect authentication flow
                           Torsten: Distributed claims can be used for this
              George: An attribute provider endpoint is different from the UserInfo Endpoint
                           Nat: We should define a mechanism for onboarding claims providers to OPs
                           Torsten: EIDAS imposes very specific legal requirements about verification processes and participants
              Torsten particularly asks everyone to review the requirements in the introduction
                           We're tackling a multi-dimensional problem
                           Nat: This tackles one of the largest cost factors for financial institutions
                           Torsten: This is true of anyone going digital, such as utilities, etc.
              Torsten asked if SecureKey can inform the working group of what the approach they're taking with IBM is
                           Jeff agreed to look into this

Federation Draft
              Roland told us that in the new federation draft, Federation Operators and other participants can enforce policy
                           For instance, only using EC crypto rather than RSA crypto
                           A new policy language has been incorporated that's informed by requirements from specific use cases
              Mike plans to publish the editor's draft to openid.net/specs/ draft 07 today

Open Issues
              https://bitbucket.org/openid/connect/issues?status=new&status=open

              #1029 - authentication_failed error response
                           Torsten wrote a proposed draft doing this
                           Nat requested that Torsten send an HTML attachment of the draft
                           We can then make an adoption decision on the call in two weeks
              #1046 - Core 3.1.2.1. - id_token_hint
                           Torsten asks us to sanction passing an ID Token as a login_hint value
                           We will discuss this more on the next call

Next Call
              3pm Pacific Time on Monday, February 18th
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20190215/d1b9d823/attachment.html>