Oh, OK. That was just redirect_uri. Maybe it's better to state that directly than to state 'end points '. <br><div class="gmail_quote">On 2015年2月11日(水) at 11:51 Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Nat, I agree that those tests should be made optional for Basic. The signature tests are still required for Implicit and Hybrid.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">As for mandating TLS, we’re mandating that the OP endpoints always use TLS. However for the code flow, the RP endpoint is allowed to not use TLS (provided
the OP allows this, which it isn’t required to do).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Roland – I synced your RPtest spreadsheet with the RP tab in the Conformance Tests spreadsheet a while back.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Openid-specs-ab [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Nat Sakimura<br>
<b>Sent:</b> Monday, February 09, 2015 7:09 PM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] RP Test<u></u><u></u></span></p></div></div><div lang="EN-US" link="blue" vlink="purple"><div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi. <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I suppose we should either drop or relax the following. They are not required in Basic. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">rp-idt-kid-absent<br>
rp-idt-kid<u></u><u></u></p>
</div>
<p class="MsoNormal">rp-alg-rs256<br>
rp-alg-none<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Also, I am wondering if the following is accurately reflecting the standard. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">"Uses https for all endpoints unless only using code flow" </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">(It has no identifier assigned to it.)</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">Section 3.1.2 states: </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Communication with the Authorization Endpoint MUST utilize TLS. See </span><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://openid.net/specs/openid-connect-core-1_0.html#TLSRequirements" target="_blank"><b><span style="font-size:12.0pt;font-family:"Verdana","sans-serif";color:#663333;text-decoration:none">Section 16.17</span></b></a></span><span style="font-family:"Verdana","sans-serif";color:black"> for
more information on using TLS.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">Section 3.1.3 states: </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Communication with the Token Endpoint MUST utilize TLS. See </span><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://openid.net/specs/openid-connect-core-1_0.html#TLSRequirements" target="_blank"><b><span style="font-size:12.0pt;font-family:"Verdana","sans-serif";color:#663333;text-decoration:none">Section 16.17</span></b></a></span><span style="font-family:"Verdana","sans-serif";color:black"> for
more information on using TLS.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">Section 5.3 states: </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Communication with the UserInfo Endpoint MUST utilize TLS. See </span><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://openid.net/specs/openid-connect-core-1_0.html#TLSRequirements" target="_blank"><b><span style="font-size:12.0pt;font-family:"Verdana","sans-serif";color:#663333;text-decoration:none">Section 16.17</span></b></a></span><span style="font-family:"Verdana","sans-serif";color:black"> for
more information on using TLS.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Looks like we are mandating to use TLS regardless of the flow. </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<p class="MsoNormal">Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div></div></blockquote></div>