<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:tahoma,new york,times,serif;font-size:10pt;color:#000000;"><div><span class="cgSelectable" style="cursor:pointer;" title="View all emails with this subject">Spec call notes 06-Feb-12<br><br><br>Nat Sakimura<br>John Bradley<br>Edmund Jay<br>George Fletcher<br>Sal D'Agnostino<br><br><br>Agenda :<br> - Interop<br> - Issues<br><br><br>Interop :<br> Mike Jones has sent an updated interop test list to the mailing list and will update the Interop Wiki soon.<br> The following test case have been requested to be added to the Interop features list:<br> 1) Test for Bad ID Token Signature at the RP<br><br> It was decided that encryption related features will not be tested pending outcome of the Jose specs.<br>
<br><br>Issues :<br> #530 Add Authentication Context Class to Registration<br> This adds a default context to the authorization request.<br> #531: add default_max_age to Registration<br> This adds a default max_age to the authorization request.<br> #532: Add require_auth_time to registration.<br> This option returns an auth_time parameter in the ID Token.<br> The above 3 issues are used for setting default request options without requiring the client to send a signed<br> request object in each request. These options are relatively static per client so they have been accepted<br> and John will make necessary modifications.<br><br> On a side note, it was discussed that maybe we should change the Registration spec to use
JSON format<br> similar to the OpenID Request Object. John will create a new issue for future consideration.<br><br> #533 Basic 2.3.2 Example has wrong aud<br> Wrong aud value in the spec. Edmund will fix.<br><br> #534 Messages add iat to id_token<br> It is considered good security practice to include the iat value in the ID Token, but Messages haven't been updated<br> to include the value in the ID Token.<br> Assigned to John.<br><br> #535 Messages add id_token to Authorization Request<br> This parameter is used to identify a particular session via the ID Token in the authorization request. It differs from the<br> user_id in the id_token object of the OpenID
Request Object in that the latter identifies only the particular user.<br> The issue has been modified to make the parameter optional instead of optional.<br> Issue is assigned to John.<br><br><br><br></span></div>
</div></body></html>