[Openid-specs-ab] Spec Call Notes 6-Jul-20

[Mike Jones]

Spec Call Notes 6-Jul-20

Mike Jones
Nat Sakimura
Tobias Looker
Edmund Jay

External Organizations
              DIF - Distributed Identity Foundation
                           Don is working on establishing a liaison relationship
                           We don't know who our liaison officer will be yet
              IIF - Institute of International Finance
                           There will be call Thursday Japan Time including Nat and Don
                                         Topic: Establishing Digital Trust
                           Nat will be giving an overview of OpenID's relevant specs and programs
                           IIF is part of IMF
              Nat was hoping to get an SC17 MDL update
                           Tony Nadalin is working on that
                           MDL is both using the eKYC-IDA verified claims representation and has a CBOR representation

Events
              Second SIOP Virtual Meetup in a Pacific-friendly timeslot
                           We're planning for two hours starting with the OpenID Connect call timeslot
                           4pm Pacific Time, July 20 / July 21 Asia/Pacific
                           Tobias should be able to attend
                           Nat will create an Eventbrite page
                           We should try during the workshop to produce an agreed upon plan of next steps

SIOP Next Steps
              We discussed topics for the next meetup
              We need problem statements and proposals
              A decision to make is what kind(s) of new specs we want/need
                           Extension spec(s) are one possibility
                           Any breaking changes would clearly be in a new spec (if needed)
              We should probably non-normatively describe how a DID SIOP extension might work
              We should work on claims requests for distributed and aggregated claims
                           Some are also interested in having these requests work with Verifiable Credentials
              Tobias shared a SIOP Laundry List doc
                        https://hackmd.io/1RBWM2yhQDiOSAdtjEuIRw?both
                           He plans to open an issue based on his list
              Nat talked about needing a binding parameter
                           A stable subject identifier for both the claims provider and the SIOP response
                           Tobias said that this could be a JWT Thumbprint of a public key
                           Nat said that in some use cases, this subject identifier should be ephemeral

JSON Canonicalization Scheme (JCS)
              As an FYI, Anders Rundgren completed his JCS document as an informational RFC
              https://tools.ietf.org/html/rfc8785
              Mike believes there are ambiguities in the serialization, such as for 0x7F (DEL)
              Nat is concerned about multiple representations for Unicode characters

Federation Specification
              The spec has been updated to address issues found during the June 2020 Interop
                           New draft uses either signed request objects (JAR) or pushed authorization requests (PAR) for client authentication of automatic registration requests
                            https://openid.net/2020/07/01/openid-connect-federation-draft-incorporating-feedback-from-first-interop-event/
              Mike's Identiverse talk on OpenID Federation is tomorrow 7/7 at Noon Pacific Time
              https://onlinexperiences.com/Launch/Event/ShowKey=96621
              Some new Federation spec issues have also been filed

Certification
              We want people to run the old and the new test suites and get free certifications
                           This will give us actionable feedback on the new test suite
                           See https://openid.net/certification/migration/
              Nat suggested on the previous call that we send an e-mail to those who had certified in the past
                           Mike Leszcz plans to send those e-mails tomorrow

OAuth JAR
              Nat e-mailed Ben Kaduk asking for the draft to be sent back to the IESG
              Ben hasn't responded yet - Nat will ping him again

Open Issues
              https://bitbucket.org/openid/connect/issues?status=new&status=open
              #1081 - Need for a persistence user identifier - a PUID
                           Tom Jones linked this to FAPI issue #223
                           Nat said that the identifier doesn't have to be persistent - he will add a comment
                           In the case of open banking, Nat said that the identifier is ephemeral

Next Call
              The next working group call is Thursday, July 16 at 7am Pacific Time
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20200707/f7f2c2ac/attachment.html>