[Openid-specs-ab] A/B Connect Atlantic Call Notes 12/12/2024

[Michael Fraser]

A/B Connect Atlantic Call Meeting Notes
12 December 2024

Attendance:
- Mike Jones
- Brian Campbell
- Bjorn Hjelm
- Victor Lu
- Michael Fraser

House Keeping
- Discussed the imminent change to the wg call cadence
                - Atlantic call Thursday weekly (7am US Pacific Time)
                - Pacific call Tuesday every other week (8am Japan Time)

- Federation Extended Listing spec
                - https://github.com/openid/federation-extended-listing/pull/7
                                - Has 2 approvals
                                - Will merge when a week old since raise if no further issues raised

- Federation Core
                - Continuing to receive feedback after Security Review
                - https://github.com/openid/federation/pull/163
                                - aligning terminology when referring to trust_mark identifiers
                - https://github.com/openid/federation/pull/164
                                - prohibiting loops in trust chains
                                - 3 approvals - will merge when a week old
                - https://github.com/openid/federation/pull/155
                                - enables multiple trust anchor identifiers in resolve requests
                                - Michael Fraser to review after call
                - https://github.com/openid/federation/pull/153
                                - corresponds to issue 127 (https://github.com/openid/federation/issues/127)
                                - expands explanation on trust mark issuer validation
                                - PR includes TBDs
                                                - feedback sought on this
                                - example of issuance delegation:
                                                - in the US the department of motor vehicle (DMV) mandates inspections but delegates such inspections to vendors
                                                - DMV authorises issuance but vendor autoshop performs actual issuance
                - conversation ongoing with OIDF certification team
                                - initial set of tests completed
                                - Mike Jones to write expanded set of goals
                                - current tests validate entity data structures - expanded tests would cover protocol testing - specifically automatic registration
                - https://github.com/openid/federation/issues/165
                                - queries a scenario where multiple trust marks can have the same ID
                                - needs further input
                - https://github.com/openid/federation/issues/166
                                - query over trust marks without `exp` claim and their interaction with the status endpoint
                - https://github.com/openid/federation/issues/167
                                - requesting a privacy consideration section in the specification
                                - Mike Jones looking for wider input from working group on issue
                - https://github.com/openid/federation/issues/147
                                - discussion on issues around client metadata having multiple values for client authentication in their entity statement leads to ambiguous client registrations
                                - the suggestion to use PAR isn't a silver bullet here
                                - Mike Jones and Michael Fraser committed to adding thoughts on the issue
                - https://bitbucket.org/openid/connect/issues?status=new&status=open&status=submitted&is_spam=!spam
                                - nothing new since August in bitbucket
                                - some pending work on separate Native App SSO specification

- Federation Wallet
                - no pull requests
                - https://github.com/openid/federation-wallet/issues/44
                                - asks how a wallet discovers if a OID4VCI issuer uses OIDF Federation
                                - suggested a consumer could attempt to call the well-known
                                - Looking for further thoughts on issue
                - https://github.com/openid/federation-wallet/issues/43
                                - proposes a mechanism to alias an entity identifier
                                - questions raised over integrity verification
                                - Further comments from the working group requested
                - https://github.com/openid/federation-wallet/issues/29
                                - looking for further input from working group
                - https://github.com/openid/federation-wallet/issues/19
                                - looking for further input from working group

- OAuth Security Workshop
                - https://oauth.secworkshop.events/osw2025
                - https://www.harpa.is/en/oauth-security-workshop-2025
                - registration is now open

- IETF 122 (Bangkok) Registration is open


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20241212/d90ea9d1/attachment-0001.htm>