[Openid-specs-ab] Spec Call Notes 18-Nov-24

[Michael Jones]

Spec Call Notes 18-Nov-24

George Fletcher
Nat Sakimura
Mike Jones
Brian Campbell
David Waite
Tom Jones
Aaron Parecki

Native SSO spec
                https://bitbucket.org/openid/connect/pull-requests/742
                                Mike will review and merge if it looks OK
                There are 8 open issues for Native SSO - 3 to be closed by the PR above
                Brian questioned whether we should be taking this to final or not
                                Given that it may not be the best practice for doing this
                                He said that we could make it a blog post
                George asked if there is another best practice that we should document instead
                                He observed that no one has proposed a better way
                Mike said that Okta has implemented, so we should involve them
                                Yahoo has implemented it, Vladimir has implemented it
                George said that there's value in documenting these things
                                He wanted the working group to weigh in to improve it, which they have
                Mike observed that we're also doing first-party app work in the OAuth WG
                (Aaron joined the call at this point)
                Mike asked about Okta implementing the Native SSO spec
                                George said that Okta had extended it for a cross-device case in a prototype
                                Aaron said that it's available as an API
                                  https://developer.okta.com/docs/guides/configure-native-sso/main/
                Aaron said that Google has deployed a similar thing
                                George said that he wrote this down so others could understand how to achieve what Google has
                Brian really dislikes the use of ID Tokens as hints and with different validation rules
                Brian said that that a sometimes problem with publishing specs is customers will see it and ask for it to be implemented
                                We should be cognizant of that

Mobile work
                George mused about whether we want to do any additional mobile-related work
                Mike asked what the MODRNA WG is doing now
                                People on the call didn't know

Bitbucket Issues
             https://bitbucket.org/openid/connect/issues?status=new&status=open&status=submitted&is_spam=!spam
                No new issues

Working Group GitHub Repositories
                We now have four working group GitHub repositories:
                1. https://github.com/openid/federation
                2. https://github.com/openid/federation-extended-listing
                                No issues or PRs
                                Implementations requested
                3. https://github.com/openid/federation-wallet/
                                14 open issues
                                                Many of the early ones record things that were in pre-adopted versions of the spec
                                https://github.com/openid/federation-wallet/issues/39 Authorized Credential within OpenID4VP metadata using Duckle
                                                Mike will review
                                https://github.com/openid/federation-wallet/issues/40 Trust Marks examples
                                                The examples seem reasonable
                                https://github.com/openid/federation-wallet/issues/41 Complex Trust Marks examples
                                                What's the motivation for these examples?
                                https://github.com/openid/federation-wallet/issues/42 Trust Mark with Intended Usage
                                                ditto
                4. https://github.com/openid/rp-metadata-choices
                                No issues or PRs
                                Mike knows of work to do due to the discussion on the list after the spec was contributed

                Nat pointed out that we need to update the repository page for the WG to list all the repositories
                                Mike agreed to take the action to do that

OpenID4VP
                It's currently in the 45-day foundation-wide review as a proposed Implementer's Draft
                Tom asked about user consent with credential presentation
                Mike suggested that if he has objections to the spec that he put them in issues
                                Then the objections are actionable
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20241119/3ee25547/attachment-0001.htm>