<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Spec call notes 10-Feb-14<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda:<o:p></o:p></p>
<p class="MsoNormal"> Connect Voting<o:p></o:p></p>
<p class="MsoNormal"> Open Issues<o:p></o:p></p>
<p class="MsoNormal"> Future Meetings<o:p></o:p></p>
<p class="MsoNormal"> Session Management<o:p></o:p></p>
<p class="MsoNormal"> Interactive Client Registration<o:p></o:p></p>
<p class="MsoNormal"> Call Schedule<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Connect Voting:<o:p></o:p></p>
<p class="MsoNormal"> The voting tool will start the voting tomorrow<o:p></o:p></p>
<p class="MsoNormal"> It will close two weeks from then<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues:<o:p></o:p></p>
<p class="MsoNormal"> #917 - space is deliminator while also a legal character in client_id and session state<o:p></o:p></p>
<p class="MsoNormal"> This seems like a problem we'll need to address<o:p></o:p></p>
<p class="MsoNormal"> Mike asked whether the postMessage character set is ASCII or Unicode<o:p></o:p></p>
<p class="MsoNormal"> If Unicode, we could use a non-ASCII separator<o:p></o:p></p>
<p class="MsoNormal"> Or we could use a different ASCII character, such as Delete (0x7f)<o:p></o:p></p>
<p class="MsoNormal"> More investigation seems like it's needed<o:p></o:p></p>
<p class="MsoNormal"> #915 - Computation of OP session_state in the IdP requires origin URI<o:p></o:p></p>
<p class="MsoNormal"> Todd Lainhart is to propose specific text<o:p></o:p></p>
<p class="MsoNormal"> #914 - Session 5 - Missing client_id parameter<o:p></o:p></p>
<p class="MsoNormal"> This seems to need more discussion<o:p></o:p></p>
<p class="MsoNormal"> #880 - Host the endpoint https://self-issued.me/registration/1.0/<o:p></o:p></p>
<p class="MsoNormal"> This is still on John's to-do list<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Future Meetings:<o:p></o:p></p>
<p class="MsoNormal"> Before IETF 89 in London<o:p></o:p></p>
<p class="MsoNormal"> We have requested a room from noon-5<o:p></o:p></p>
<p class="MsoNormal"> OpenID would take the first half, OAuth the second<o:p></o:p></p>
<p class="MsoNormal"> John will set up Eventbrite registration for this<o:p></o:p></p>
<p class="MsoNormal"> During RSA in San Francisco<o:p></o:p></p>
<p class="MsoNormal"> Mike still needs to investigate this possibility - probably after Friday's IETF submission deadline<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Session Management:<o:p></o:p></p>
<p class="MsoNormal"> Breno and Naveen had a conversation with John and Nat about session management<o:p></o:p></p>
<p class="MsoNormal"> They're concerned about RPs generating a lot of traffic at IdPs<o:p></o:p></p>
<p class="MsoNormal"> They believe that token caching is needed<o:p></o:p></p>
<p class="MsoNormal"> Mike questioned what level of the specs this should happen at, and what we need to do<o:p></o:p></p>
<p class="MsoNormal"> Breno asked whether having RPs have logout notification endpoints wouldn't work better in some cases<o:p></o:p></p>
<p class="MsoNormal"> John brought up that some RPs might not want to have JavaScript<o:p></o:p></p>
<p class="MsoNormal"> Devices like Layer7 intermediary devices and other may have problems injecting JavaScript into the HTML<o:p></o:p></p>
<p class="MsoNormal"> Breno was also worried postMessage security vulnerabilities<o:p></o:p></p>
<p class="MsoNormal"> This may mostly have to do with using postMessage for authentication<o:p></o:p></p>
<p class="MsoNormal"> All JavaScript widgets share the same postMessage channel<o:p></o:p></p>
<p class="MsoNormal"> For session management, we're only sending "yes" or "no" so we're not leaking much information<o:p></o:p></p>
<p class="MsoNormal"> Versus sending the ID Token via postMessage, which would be a concern<o:p></o:p></p>
<p class="MsoNormal"> Mike plans to try to talk with Breno and Naveen in person this week about next steps<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Interactive Client Registration<o:p></o:p></p>
<p class="MsoNormal"> Google also discussed wanting to do dynamic client registration for IMAP clients<o:p></o:p></p>
<p class="MsoNormal"> This requires user interaction, which dynamic registration doesn't currently support<o:p></o:p></p>
<p class="MsoNormal"> As a side effect, they would like to also issue tokens<o:p></o:p></p>
<p class="MsoNormal"> They liked the software statement idea<o:p></o:p></p>
<p class="MsoNormal"> They only want to issue Client IDs to be created for authenticated users<o:p></o:p></p>
<p class="MsoNormal"> John will think about whether and how they can accomplish this with our existing protocol flows<o:p></o:p></p>
<p class="MsoNormal"> We think that this is possible<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Call Schedule:<o:p></o:p></p>
<p class="MsoNormal"> There's been no discussion about call times on the list so far<o:p></o:p></p>
<p class="MsoNormal"> We will continue with the weekly Thursday calls for now<o:p></o:p></p>
<p class="MsoNormal"> People are encouraged to discuss what the right schedule is on the list<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>