<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Spec call notes 20-Jun-11<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal">Breno de Medeiros<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The Connect specs are now checked in at <a href="http://svn.openid.net/repos/specifications/connect/1.0/">
http://svn.openid.net/repos/specifications/connect/1.0/</a> and available in HTML and TXT versions in the openid.net specs directory. See:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><a href="http://openid.net/specs/openid-connect-core-1_0.html">http://openid.net/specs/openid-connect-core-1_0.html</a><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><a href="http://openid.net/specs/openid-connect-ab-1_0.html">http://openid.net/specs/openid-connect-ab-1_0.html</a><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><a href="http://openid.net/specs/openid-connect-code-1_0.html">http://openid.net/specs/openid-connect-code-1_0.html</a><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><a href="http://openid.net/specs/openid-connect-swd-1_0.html">http://openid.net/specs/openid-connect-swd-1_0.html</a><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><a href="http://openid.net/specs/openid-connect-userinfo-1_0.html">http://openid.net/specs/openid-connect-userinfo-1_0.html</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Status check of each sub-specs:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- Core<o:p></o:p></p>
<p class="MsoNormal"> Breno to send feedback to the list, including about:<o:p></o:p></p>
<p class="MsoNormal"> Breno: Core section 4 - "Authorization type must include token"<o:p></o:p></p>
<p class="MsoNormal"> Request parameter name 4.1.1 "req" -> "request" for consistency<o:p></o:p></p>
<p class="MsoNormal"> Session audience "session_audience"<o:p></o:p></p>
<p class="MsoNormal"> 4.1.1.1 Why is "server_id" not "issuer" or "origin"?<o:p></o:p></p>
<p class="MsoNormal"> Different than other things named "*_id"<o:p></o:p></p>
<p class="MsoNormal"> Breno asked why the code binding is separate from the core?<o:p></o:p></p>
<p class="MsoNormal"> Nat responded because the core introduces the protocol elements and not just the messages<o:p></o:p></p>
<p class="MsoNormal"> Breno said that having the code define the standard bindings would eliminate a lot of duplication<o:p></o:p></p>
<p class="MsoNormal"> One possibility is to have binding subsections defining the code binding in the core spec<o:p></o:p></p>
<p class="MsoNormal"> Nat asked how this applies to the implicit flow<o:p></o:p></p>
<p class="MsoNormal"> Session management spec currently in core. Maybe make separate?<o:p></o:p></p>
<p class="MsoNormal"> Session management may not make sense outside of HTTP binding<o:p></o:p></p>
<p class="MsoNormal"> Breno doesn't want to create more documents than we have to<o:p></o:p></p>
<p class="MsoNormal"> But session management is clearly specific to the HTTP binding<o:p></o:p></p>
<p class="MsoNormal"> Nat said that since a session is an identity token, it could make sense for other bindings<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- UserInfo<o:p></o:p></p>
<p class="MsoNormal"> Mike asked whether the address claim should be a structure or a set of individual claims<o:p></o:p></p>
<p class="MsoNormal"> We decided to use a structured address claim with fields like postal_code<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- Session Management<o:p></o:p></p>
<p class="MsoNormal"> 4.1.1 Missing session parameter than can be passed in every request to indicate user<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- Dynamic Registration<o:p></o:p></p>
<p class="MsoNormal"> John sent an OpenID Connect Simple Client Registration draft for feedback<o:p></o:p></p>
<p class="MsoNormal"> John gave us background <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- JWE<o:p></o:p></p>
<p class="MsoNormal"> Mike plans to do the JWT encryption work following an OAuth bearer token update<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- OpenID 2.0 Migration<o:p></o:p></p>
<p class="MsoNormal"> Breno wants to defer working on the migration spec this until the discovery is solid<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We agreed that finishing the missing functionality is the top priority (rather than editorial restructuring)<o:p></o:p></p>
<p class="MsoNormal">Nat will send an invitation for a supplemental call in three days on Thursday Pacific / Friday Japan at the standard time<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We will begin doing version control at http://svn.openid.net/repos/specifications/connect<o:p></o:p></p>
<p class="MsoNormal">Mike will work on subversion access for the active editors using these e-mail addresses:<o:p></o:p></p>
<p class="MsoNormal"> sakimura@gmail.com<o:p></o:p></p>
<p class="MsoNormal"> ve7jtb@ve7jtb.com<o:p></o:p></p>
<p class="MsoNormal"> ejay@mgi1.com<o:p></o:p></p>
<p class="MsoNormal"> breno@google.com<o:p></o:p></p>
</div>
</body>
</html>