[Openid-specs-ab] Spec Call Notes 31-Oct-22

[Mike Jones]

Spec Call Notes 31-Oct-22

Mike Jones
Karthik Sivasamy
David Waite (DW)
Naveen CM
Dima Postnikov
Aaron Parecki

JARM Approval Vote
              JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)
              Up for approval as a final spec
              Vote at https://openid.net/foundation/members/polls/286

Pull Requests
              https://bitbucket.org/openid/connect/pull-requests/
              PR #313 fix: removed duplicate word "endpoint" and changed addition to additional
                           Fixes syntax errors in Native SSO spec
                           Merged
              PR #338 [Errata] Specified the use of CORS at additional endpoints
                           Fixes #980
                           This is the last currently open errata PR
                           Merged (with discussion on the issue as recorded below)
              PR #349 feat: [Federation] RS256 not mandatory anymore
                           Closes #1681
                           Merged
              PR #346 fix: [Federation] trust mark status HTTP method
                           On the 31-Oct-22 working group call, we agreed to merge this after conflicts are resolved
              PR #320 rename to `credential_issuer` from the `issuer` in the Initiate Issuance Request
                           Ready to merge after conflicts are resolved

Issues
              https://bitbucket.org/openid/connect/issues?status=new&status=open
              #1681: [Federation] FAPI prohibits RS256
                           Fixed by PR #349
              #980: Where else do we need to specify the use of CORS support?
                           Fixed by PR #338
                           We discussed possibly prohibiting the use of CORS on the authorization endpoint in the OAuth Security BCP
                           Aaron said that he just added a statement about CORS on the token endpoint to the OAuth 2.1 spec
                           DW distinguished between API endpoints and endpoints visited by the browser
              #1700: potentially add a section that explains basics of OAuth 2.0 (perhaps an addendum).
                           Mike is mostly prone to let OAuth describe itself, but a few sentences of overview would be OK
                           Aaron Parecki noted that "Basics could grow pretty quickly"
              #1699: OIDC4VCI - error response for missing nonce
                           Mike noted that invalid_or_missing_proof doesn't seem to fit the scenario
              #1698: Scope of an Access Token in VCI
                           This probably needs discussion on a SIOP special topic call
              #1697: Server metadata needs to specify supported proof types / algorithms
                           We looked at this on the 31-Oct-22 working group call.  It would probably benefit from discussion on a SIOP special topic call.
              #1696: Is proof type flexibility needed?
                           DW said that the information that needs to be included in the proof will, in general, vary by proof type

IETF in a week in London
              Aaron and Mike plan to be there

Next Call
              The next call is on Thursday, November 3rd at 7am Pacific Time, followed by a SIOP Special Topic call the following hour
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20221101/69490bce/attachment.html>