<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#002060">Breno, two questions came up on the call that we need you to provide your input on.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">1. Having a requested audience parameter seems like a security flaw, as you could request a token scoped to someone else. Shouldn’t we just have the audience be the return_to URL or something derived from it?
We plan to delete this parameter unless we hear back from you with a good reason why it must be kept and why it can be secure.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">2. Why do we need a nonce parameter when we already have the OAuth state parameter to serve this purpose? Or is it just to be able to provide the additional semantics that the value is returned in the id_token?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>Mike Jones<br>
<b>Sent:</b> Thursday, July 28, 2011 3:53 PM<br>
<b>To:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> [Openid-specs-ab] Spec call notes 28-Jul-11<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Spec call notes 28-Jul-11<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Johnny Bufu<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda:<o:p></o:p></p>
<p class="MsoNormal"> Specific questions about spec features<o:p></o:p></p>
<p class="MsoNormal"> audience parameter in request<o:p></o:p></p>
<p class="MsoNormal"> nonce parameter in request<o:p></o:p></p>
<p class="MsoNormal"> req -> request in OAuth request<o:p></o:p></p>
<p class="MsoNormal"> Can a redirect_url be a redirect URI?<o:p></o:p></p>
<p class="MsoNormal"> Editing updates<o:p></o:p></p>
<p class="MsoNormal"> IPR Contribution Agreements<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">audience parameter in request<o:p></o:p></p>
<p class="MsoNormal"> A bad RP could put in someone else's audience<o:p></o:p></p>
<p class="MsoNormal"> Do we not pass it and have audience constructed out of return_to?<o:p></o:p></p>
<p class="MsoNormal"> Edmund thought this had to do with input from Breno about native clients<o:p></o:p></p>
<p class="MsoNormal"> We don't have enough information to use it properly - will remove unless clarified<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">nonce parameter in request<o:p></o:p></p>
<p class="MsoNormal"> Should RP supply a nonce or just request that a nonce be used?<o:p></o:p></p>
<p class="MsoNormal"> John asked what the difference between nonce and state is<o:p></o:p></p>
<p class="MsoNormal"> Edmund thought that this was something specific to Facebook<o:p></o:p></p>
<p class="MsoNormal"> Nat pointed out that we haven't said anything about processing rules for the nonce<o:p></o:p></p>
<p class="MsoNormal"> Other than that the value is returned in id_token<o:p></o:p></p>
<p class="MsoNormal"> No rule about verifying nonce, at present<o:p></o:p></p>
<p class="MsoNormal"> John will look at the Facebook documentation and investigate their usage<o:p></o:p></p>
<p class="MsoNormal"> If not required for the Lite spec, it should probably be removed there<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">req -> request in OAuth HTTP request<o:p></o:p></p>
<p class="MsoNormal"> We agreed to make this change<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Can a redirect_url be a redirect URI?<o:p></o:p></p>
<p class="MsoNormal"> We think no<o:p></o:p></p>
<p class="MsoNormal"> This is separate from the js_origin_url<o:p></o:p></p>
<p class="MsoNormal"> (The js_origin_url may not use an http scheme, but is still a redirect target)<o:p></o:p></p>
<p class="MsoNormal"> Nat wondered whether he wanted to change the name just to be closer to OAuth<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Editing updates<o:p></o:p></p>
<p class="MsoNormal"> Mike has reviewed Casper's edits and is ready to check them in, modulo the discussions above<o:p></o:p></p>
<p class="MsoNormal"> John has the Lite spec down to about 15 pages including Security Considerations<o:p></o:p></p>
<p class="MsoNormal"> This includes id_token<o:p></o:p></p>
<p class="MsoNormal"> Without security considerations and references is 10 pages, including 1.5 pages of index<o:p></o:p></p>
<p class="MsoNormal"> Or roughly 8 pages of spec material<o:p></o:p></p>
<p class="MsoNormal"> John reverted the text to use the name "Introspection Endpoint"<o:p></o:p></p>
<p class="MsoNormal"> John asked whether we should copy the relevant portions of the Discovery spec into Lite<o:p></o:p></p>
<p class="MsoNormal"> We agreed no, saying that Discovery is optional and could be replaced by manual configuration<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Besides producing Lite, we also need to produce:<o:p></o:p></p>
<p class="MsoNormal"> Standard <o:p></o:p></p>
<p class="MsoNormal"> Messages (Core and Framework)<o:p></o:p></p>
<p class="MsoNormal"> Already have:<o:p></o:p></p>
<p class="MsoNormal"> Discovery<o:p></o:p></p>
<p class="MsoNormal"> Registration<o:p></o:p></p>
<p class="MsoNormal"> Session Management<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Lite is pared down to the world view of an RP<o:p></o:p></p>
<p class="MsoNormal"> Compliance for IdPs may be different for IdPs than for RPs<o:p></o:p></p>
<p class="MsoNormal"> IdPs should support code and token flows but RPs can just support token<o:p></o:p></p>
<p class="MsoNormal"> Say this in a conformance section in Standard<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">IPR Contribution Agreements<o:p></o:p></p>
<p class="MsoNormal"> Nat will review the list archives and produce a list of people we need IPR agreements from<o:p></o:p></p>
<p class="MsoNormal"> We should not go to an implementer's draft until we have the appropriate agreements in place<o:p></o:p></p>
</div>
</body>
</html>