<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:tahoma,new york,times,serif;font-size:10pt;color:#000000;"><div><p class="MsoNormal">Spec call notes 13-Oct-11</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Mike Jones</p>
<p class="MsoNormal">Edmund Jay</p>
<p class="MsoNormal">John Bradley</p>
<p class="MsoNormal">Pamela Dingle</p><p class="MsoNormal">George Fletcher</p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal">[Agenda]<br> Interop Progress<br> Spec Edits<br><br><br>[Interop]<br> Edmund, Nov, Ryo Ito has implemented Discovery and Registration specs.<br> Edmund will send a message with the endpoints to the Interop group mailing list.<br><br> Edmund raised the question of whether there should be a way in the <br> Registration spec for restricting client registrations.<br> It's decided that this should be up to the Identity providers.<br> John points to the client credentials in the request as a way to <br> restrict registrations.<br> There should be errors to indicate failed registration.<br><br><br>[Spec Edits]<br> The Token Endpoint
includes a 'secret_type' parameter to indicate the client<br> authentication type. This differs from OAuth where the client authentication<br> type is indicated at client registration time. John recommends that the specs<br> have an authentication section that explains about the client authentication so<br> that authentication does not need to be mentioned/duplicated in various places.<br> John will create issue in tracker to keep authentication similar to OAuth.<br> <br> Another issue with Token endpoint is that 'scope' is required. 'Openid' is required<br> value of 'scope' so ID Token is always returned at Token endpoint even when <br> refreshing token. John made 'scope' OPTIONAL in Refresh Token request.<br> <br> An issue is raised about what
'response_type' combinations Providers must support.<br> Current specs only mentions valid combinations but not what must be supported.<br> John will add text for which combinations ("code", and "token id_token")<br> all servers must support to facilitate inter-op.<br> <br> Topic for discussion at upcoming face 2 face meeting : How to reconcile all the <br> duplication between Messages and Standard? Decision to be decided at meeting in<br> AOL, Palo Alto.<br></p></div>
</div></body></html>