<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Special OpenID Connect call for Certification lockdown decision 23-Mar-15<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Justin Richer<o:p></o:p></p>
<p class="MsoNormal">Garyl Erickson<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Ian Glazer<o:p></o:p></p>
<p class="MsoNormal">Robert Wegmann<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal">Roshni Chandrashekhar<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda<o:p></o:p></p>
<p class="MsoNormal"> Open Issues<o:p></o:p></p>
<p class="MsoNormal"> Misc<o:p></o:p></p>
<p class="MsoNormal"> What's left to do?<o:p></o:p></p>
<p class="MsoNormal"> What does lockdown mean?<o:p></o:p></p>
<p class="MsoNormal"> Next Steps<o:p></o:p></p>
<p class="MsoNormal"> Past the first certification round<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> #82: Configuration does not get modified when changing from dynamic to static discovery<o:p></o:p></p>
<p class="MsoNormal"> Not critical to certification<o:p></o:p></p>
<p class="MsoNormal"> #33: Giving a login hint (OP-H-03) Test falls into indeterminate state with error on our side<o:p></o:p></p>
<p class="MsoNormal"> Resolved<o:p></o:p></p>
<p class="MsoNormal"> #84: Test Traces ONLY refer to last test run<o:p></o:p></p>
<p class="MsoNormal"> Resolved<o:p></o:p></p>
<p class="MsoNormal"> #101: no idea what happened but something went wrong with a new instance created at OpenID Certification OP Test Tool Configuration<o:p></o:p></p>
<p class="MsoNormal"> Roland said that the database of implementers was getting corrupted<o:p></o:p></p>
<p class="MsoNormal"> Roland thinks that he knows what the cause was<o:p></o:p></p>
<p class="MsoNormal"> There are usability problems reaching the initial test page<o:p></o:p></p>
<p class="MsoNormal"> This is not necessarily critical to the lockdown since people have working (sometimes manually edited) configurations<o:p></o:p></p>
<p class="MsoNormal"> #100: OP test server not including intermediate certificate.<o:p></o:p></p>
<p class="MsoNormal"> This working now, even though it's returning the root cert<o:p></o:p></p>
<p class="MsoNormal"> We'll leave this alone<o:p></o:p></p>
<p class="MsoNormal"> (This still needs to happen for the RP test server)<o:p></o:p></p>
<p class="MsoNormal"> #123: redirect_URI tests still reporting wrong results.<o:p></o:p></p>
<p class="MsoNormal"> For OP-redirect_uri-Missing, John's test is returning 400 as it should to a page shown<o:p></o:p></p>
<p class="MsoNormal"> but the page is showing a red circle after hitting back<o:p></o:p></p>
<p class="MsoNormal"> The log says partial result but the page shows a red circle for John and a question mark for Brian<o:p></o:p></p>
<p class="MsoNormal"> Mike will add instructions about ignoring the result to testers<o:p></o:p></p>
<p class="MsoNormal"> Roland will hard-code the partial result for a specific set of tests<o:p></o:p></p>
<p class="MsoNormal"> He will send the list out for review before doing the hard-coding<o:p></o:p></p>
<p class="MsoNormal"> #127: [OP-redirect_uri-RegFrag] - Server returns error, test doesn't recognize it<o:p></o:p></p>
<p class="MsoNormal"> Roland will fix this one<o:p></o:p></p>
<p class="MsoNormal"> #111: OP-IDToken-SigEnc (Signed and encrypted ID Token) Test is unable to decrypt ID Token for certain response_type requests<o:p></o:p></p>
<p class="MsoNormal"> "kid": null appears to be an error in Edmund's code<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Misc<o:p></o:p></p>
<p class="MsoNormal"> Robert has been testing Basic with alg:none and is happy with the result<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What's left to do?<o:p></o:p></p>
<p class="MsoNormal"> Rollover -> Rotation (to match the spec)<o:p></o:p></p>
<p class="MsoNormal"> Rollover should not be listed as [Config]<o:p></o:p></p>
<p class="MsoNormal"> Everything appears to be captured in the tracker, other than what's in the notes<o:p></o:p></p>
<p class="MsoNormal"> Short form instructions need to be written<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What does lockdown mean?<o:p></o:p></p>
<p class="MsoNormal"> None of the code paths for any certification profile get touched without a working group decision to do so<o:p></o:p></p>
<p class="MsoNormal"> Stuff that's independent, such as encryption tests, can continue to be developed<o:p></o:p></p>
<p class="MsoNormal"> Anything risky should happen in a branch<o:p></o:p></p>
<p class="MsoNormal"> Once we announce that we are accepting results, we will accept them even if the tests are incomplete/wrong at the time of testing<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Steps<o:p></o:p></p>
<p class="MsoNormal"> Roland fixes the few bugs discussed today<o:p></o:p></p>
<p class="MsoNormal"> Mike edits the English strings a little more<o:p></o:p></p>
<p class="MsoNormal"> Have Don send the timeline mail to the working group<o:p></o:p></p>
<p class="MsoNormal"> Submissions are due on the Monday the 13th - a week before RSA<o:p></o:p></p>
<p class="MsoNormal"> We send a message WG and testers saying we will now accept results<o:p></o:p></p>
<p class="MsoNormal"> Mike creates the closed-form instructions<o:p></o:p></p>
<p class="MsoNormal"> Filenames for each profile of log files and image captures<o:p></o:p></p>
<p class="MsoNormal"> List of things that are self-asserted<o:p></o:p></p>
<p class="MsoNormal"> The working group reviews them<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Past the first certification round<o:p></o:p></p>
<p class="MsoNormal"> RP testing is more difficult than OP testing<o:p></o:p></p>
<p class="MsoNormal"> The test tool can't see what the RP does as a result of the responses<o:p></o:p></p>
<p class="MsoNormal"> There will be a lot more screen shots in this case<o:p></o:p></p>
<p class="MsoNormal"> Roland and team has constructed an OP that will behave differently based on the components of the path<o:p></o:p></p>
<p class="MsoNormal"> Logically these are all different OPs that the RP uses<o:p></o:p></p>
<p class="MsoNormal"> Edmund had suggested just putting the test ID in the paths<o:p></o:p></p>
<p class="MsoNormal"> Roland will write up possibilities to the list for us to review<o:p></o:p></p>
<p class="MsoNormal"> For RP testing, the min-bar requires understanding .well-known/openid-configuration files<o:p></o:p></p>
</div>
</body>
</html>