<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Spec call notes 9-Feb-15<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda<o:p></o:p></p>
<p class="MsoNormal"> Certification<o:p></o:p></p>
<p class="MsoNormal"> OpenID Workshop on April 6<o:p></o:p></p>
<p class="MsoNormal"> OpenID 2.0 Migration<o:p></o:p></p>
<p class="MsoNormal"> Session Management<o:p></o:p></p>
<p class="MsoNormal"> Form Post Response Mode Binding<o:p></o:p></p>
<p class="MsoNormal"> Next Calls<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Certification<o:p></o:p></p>
<p class="MsoNormal"> It's on Mike's list to create initial certification web pages for review<o:p></o:p></p>
<p class="MsoNormal"> Profile definitions and instructions<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Mike asked whether we want test names to be OP-Letter-Number or to be more semantically meaningful names<o:p></o:p></p>
<p class="MsoNormal"> Mike will work with Roland to create and convert over to these<o:p></o:p></p>
<p class="MsoNormal"> That will let us have stable names that don't get renumbered, etc.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Roland continues having problems getting the Symantec hosts to work for our use cases<o:p></o:p></p>
<p class="MsoNormal"> He can't even do HTTP GETs to port 80 for his source repository<o:p></o:p></p>
<p class="MsoNormal"> Mike will see if progress can be made on that this week<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Open Certification Issues at https://bitbucket.org/openid/certification/issues<o:p></o:p></p>
<p class="MsoNormal"> Brian asked about the status of tests about revoking access tokens on auth code reuse<o:p></o:p></p>
<p class="MsoNormal"> We agreed two weeks ago to make that a warning<o:p></o:p></p>
<p class="MsoNormal"> People are encouraged to verify fixes after Roland marks them fixed and then close the bugs<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> The RP tests seem to be about a constant week from being live<o:p></o:p></p>
<p class="MsoNormal"> The current holdup is good UI code in front of them saying how to use them<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Apparently Hans Zandbelt talked to Roland about RP testing but it seemed to him that it was going to be complicated<o:p></o:p></p>
<p class="MsoNormal"> Mike will try to look into why that was<o:p></o:p></p>
<p class="MsoNormal"> Mike encouraged people to look at the RP tab of the conformance profile definitions spreadsheet<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OpenID 2.0 Migration<o:p></o:p></p>
<p class="MsoNormal"> The 60 day review period is under way<o:p></o:p></p>
<p class="MsoNormal"> See http://openid.net/2015/02/01/review-of-proposed-final-openid-2-0-to-openid-connect-migration-specification/<o:p></o:p></p>
<p class="MsoNormal"> The next step is posting about the voting<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OpenID Workshop on April 6<o:p></o:p></p>
<p class="MsoNormal"> https://openid-mar-2015.eventbrite.com<o:p></o:p></p>
<p class="MsoNormal"> The page is not currently showing who is registered<o:p></o:p></p>
<p class="MsoNormal"> Times still need to be added to the agenda<o:p></o:p></p>
<p class="MsoNormal"> The marketing committee is thinking of starting the event earlier (before 11:00) because of all of the working groups<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Form Post Response Mode Binding<o:p></o:p></p>
<p class="MsoNormal"> Ping and Microsoft have successfully interoperated on the form post response mode<o:p></o:p></p>
<p class="MsoNormal"> Mike asked whether or not we need to add additional security considerations<o:p></o:p></p>
<p class="MsoNormal"> Brian pointed out that the bad combinations are of things like query in the wrong places and not with the form post response mode<o:p></o:p></p>
<p class="MsoNormal"> Mike believes we should take it final. Brian agrees.<o:p></o:p></p>
<p class="MsoNormal"> Mike will ask if there any objections to taking it forward<o:p></o:p></p>
<p class="MsoNormal"> If no objections are heard, we will start the 60 day review period next Monday<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Session Management<o:p></o:p></p>
<p class="MsoNormal"> Mike plans to write a one-pager on image get based logout<o:p></o:p></p>
<p class="MsoNormal"> This is aligned with what Ping and probably Deutsche Telekom have done<o:p></o:p></p>
<p class="MsoNormal"> This has the advantage of being parallelizable<o:p></o:p></p>
<p class="MsoNormal"> And it's kind of the lowest common denominator logout mechanism<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Calls<o:p></o:p></p>
<p class="MsoNormal"> We decided to go back to two calls a week between now and the certification launch<o:p></o:p></p>
<p class="MsoNormal"> The Thursday call is at <a href="https://www3.gotomeeting.com/join/181372694">
https://www3.gotomeeting.com/join/181372694</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>