<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Notes from OpenID Connect Meeting 6-May-13<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Attendees:<o:p></o:p></p>
<p class="MsoNormal"> Mike Jones<o:p></o:p></p>
<p class="MsoNormal"> Amanda Anganes<o:p></o:p></p>
<p class="MsoNormal"> Don Thibeau<o:p></o:p></p>
<p class="MsoNormal"> Bryant Cutler<o:p></o:p></p>
<p class="MsoNormal"> Ian Wesley-Smith<o:p></o:p></p>
<p class="MsoNormal"> Tony Nadalin<o:p></o:p></p>
<p class="MsoNormal"> George Fletcher<o:p></o:p></p>
<p class="MsoNormal"> Axel Nennker<o:p></o:p></p>
<p class="MsoNormal"> Tom Brown<o:p></o:p></p>
<p class="MsoNormal"> John Bradley<o:p></o:p></p>
<p class="MsoNormal"> Justin P. Richer<o:p></o:p></p>
<p class="MsoNormal"> Henrik Biering<o:p></o:p></p>
<p class="MsoNormal"> Johnny Bufu<o:p></o:p></p>
<p class="MsoNormal"> Darius Dunlap<o:p></o:p></p>
<p class="MsoNormal"> Pamela Dingle<o:p></o:p></p>
<p class="MsoNormal"> Karen O'Donoghue<o:p></o:p></p>
<p class="MsoNormal"> Oliver Zhang<o:p></o:p></p>
<p class="MsoNormal"> Nov Matake<o:p></o:p></p>
<p class="MsoNormal"> Paul Lee<o:p></o:p></p>
<p class="MsoNormal"> Kevin Marks<o:p></o:p></p>
<p class="MsoNormal"> Naveen Agarwal<o:p></o:p></p>
<p class="MsoNormal"> Breno de Medeiros<o:p></o:p></p>
<p class="MsoNormal"> Marla Hay<o:p></o:p></p>
<p class="MsoNormal"> Leif Johansson<o:p></o:p></p>
<p class="MsoNormal"> Valter Nordh<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda:<o:p></o:p></p>
<p class="MsoNormal"> Implementer's Draft Status<o:p></o:p></p>
<p class="MsoNormal"> Open Issues<o:p></o:p></p>
<p class="MsoNormal"> Spec Details:<o:p></o:p></p>
<p class="MsoNormal"> Nonce Entropy Recommendations<o:p></o:p></p>
<p class="MsoNormal"> Returning ID Token from Token Endpoint when using "code id_token"<o:p></o:p></p>
<p class="MsoNormal"> Expected behavior of time fields when using Refresh Tokens<o:p></o:p></p>
<p class="MsoNormal"> Review audience/azp semantics<o:p></o:p></p>
<p class="MsoNormal"> Version String<o:p></o:p></p>
<p class="MsoNormal"> SSO claims without UserInfo claims<o:p></o:p></p>
<p class="MsoNormal"> Upcoming Interops<o:p></o:p></p>
<p class="MsoNormal"> Native Client Application Status<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Implementer's Draft Status<o:p></o:p></p>
<p class="MsoNormal"> JOSE edits resulting from last week's interim WG meeting are happening this week<o:p></o:p></p>
<p class="MsoNormal"> Edits resulting from this working group meeting will happen right after that<o:p></o:p></p>
<p class="MsoNormal"> We agreed that we'll be ready for the implementer's draft vote after that<o:p></o:p></p>
<p class="MsoNormal"> Ideally, one-two weeks out<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> We decided how to address the two new open issues<o:p></o:p></p>
<p class="MsoNormal"> Both will result in clarifications in Basic for optional fields<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nonce Entropy Recommendations<o:p></o:p></p>
<p class="MsoNormal"> We will say that sufficient entropy must be present in the nonce values used to prevent attackers from guessing values<o:p></o:p></p>
<p class="MsoNormal"> So, for instance, fixed strings and incrementing values are unacceptable<o:p></o:p></p>
<p class="MsoNormal"> We will clarify that OPs should perform no processing on nonce values, other than echoing them back in issued ID Tokens<o:p></o:p></p>
<p class="MsoNormal"> Guessing nonce values could enable attackers to silently log you into RPs without you being aware of it<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Returning ID Token from Token Endpoint when using "code id_token"<o:p></o:p></p>
<p class="MsoNormal"> This is done to enable hybrid clients where the browser uses the value returned in the front channel and the Web site uses the value returned in the back channel<o:p></o:p></p>
<p class="MsoNormal"> The validation information in both ID Tokens must be identical<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Expected behavior of time fields when using Refresh Tokens<o:p></o:p></p>
<p class="MsoNormal"> We determined that the language in Messages 2.2.3 (Access Token Response) needs a few enhancements<o:p></o:p></p>
<p class="MsoNormal"> We need to include "aud" in the list of elements that must be the same<o:p></o:p></p>
<p class="MsoNormal"> We will further clarify that "azp" must be the same<o:p></o:p></p>
<p class="MsoNormal"> We will format the requirements as a bulleted list, for better readability<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Review audience/azp semantics<o:p></o:p></p>
<p class="MsoNormal"> We will clarify that when an ID Token is used as a hint, that the party receiving the hint need not be an audience of the token<o:p></o:p></p>
<p class="MsoNormal"> Relying parties expressed a need to be able to know who the ID Token is issued to<o:p></o:p></p>
<p class="MsoNormal"> We decided that we will use the "azp" field for this<o:p></o:p></p>
<p class="MsoNormal"> "azp" will be single-valued<o:p></o:p></p>
<p class="MsoNormal"> While ideally this would be named something closer to "issued to", we will leave the name "azp" so as not to break existing deployments<o:p></o:p></p>
<p class="MsoNormal"> Breno pointed out that originally we had an issued_to field but that it was removed. This brings us full circle.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Version String<o:p></o:p></p>
<p class="MsoNormal"> We had a surprisingly long discussion of protocol versioning considerations<o:p></o:p></p>
<p class="MsoNormal"> We agreed that the "version":"3.0" value in Discovery is insufficient<o:p></o:p></p>
<p class="MsoNormal"> In particular, breaking changes would likely need a different path than /.well-known/openid-configuration<o:p></o:p></p>
<p class="MsoNormal"> Breno took the position that it was up to people extending the protocol to decide how to best extend it<o:p></o:p></p>
<p class="MsoNormal"> And that we shouldn't do a half-way job on it now<o:p></o:p></p>
<p class="MsoNormal"> Some felt that including "version":"3.0" would unnecessarily break clients if the value was changed when backwards-compatible extensions are used<o:p></o:p></p>
<p class="MsoNormal"> They advocated deleting the discovery version from the spec<o:p></o:p></p>
<p class="MsoNormal"> So as to make a decision about what to include in the forthcoming Implementer's Drafts, a vote was held on whether to keep it for now<o:p></o:p></p>
<p class="MsoNormal"> 2 voted to keep it; 5 voted to drop it; 7 voted "don't care"<o:p></o:p></p>
<p class="MsoNormal"> People are encouraged to continue discussing this on the mailing list<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">SSO claims without UserInfo claims<o:p></o:p></p>
<p class="MsoNormal"> It was observed that some OPs in closed system environments may use OpenID Connect SSO but may not implement a UserInfo endpoint<o:p></o:p></p>
<p class="MsoNormal"> We discussed whether we should allow those systems to say that they are implementing OpenID Connect or not<o:p></o:p></p>
<p class="MsoNormal"> These systems will exist whatever we decide<o:p></o:p></p>
<p class="MsoNormal"> We decided that it was better to have those systems be in the OpenID Connect tent, rather than outside of it<o:p></o:p></p>
<p class="MsoNormal"> The "userinfo_endpoint" discovery field was already only RECOMMENDED<o:p></o:p></p>
<p class="MsoNormal"> We will update the Messages Implementation Considerations to make the UserInfo endpoint optional for closed-system OPs
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Upcoming Interops<o:p></o:p></p>
<p class="MsoNormal"> Once we have Implementer's Draft specs, we will start a new round of interop testing<o:p></o:p></p>
<p class="MsoNormal"> Pam and Mike will create the OC5 interop at http://osis.idcommons.net/ next week while in Munich<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Native Client Application Status<o:p></o:p></p>
<p class="MsoNormal"> Pam did a demo of her native client iOS application<o:p></o:p></p>
<p class="MsoNormal"> She reported that way more than 80% of the work was XCode related and not OpenID Connect related<o:p></o:p></p>
<p class="MsoNormal"> She said that the OpenID Connect parts were very easy<o:p></o:p></p>
<p class="MsoNormal"> People can e-mail Pam now for a TestFlight invitation to be able to install and run the app themselves<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Photos of the four whiteboards used to record the agenda and take notes are also attached<o:p></o:p></p>
</div>
</body>
</html>