<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Spec call notes 5-Jan-17<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Phil Hunt<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda<o:p></o:p></p>
<p class="MsoNormal"> Certification Update<o:p></o:p></p>
<p class="MsoNormal"> Open Issues<o:p></o:p></p>
<p class="MsoNormal"> Odd Mobile Apps and SSO Practices<o:p></o:p></p>
<p class="MsoNormal"> Next Call<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Certification Update<o:p></o:p></p>
<p class="MsoNormal"> Roland has refactored the RP certification site to present requirements to testers more clearly<o:p></o:p></p>
<p class="MsoNormal"> It now lets you select a response_type and shows required and optional tests on that basis<o:p></o:p></p>
<p class="MsoNormal"> There are now three RP certifications<o:p></o:p></p>
<p class="MsoNormal"> Edmund Jay still has yet to submit his<o:p></o:p></p>
<p class="MsoNormal"> New OP certifications<o:p></o:p></p>
<p class="MsoNormal"> Vladimir Dzhuvinov of Connect2id<o:p></o:p></p>
<p class="MsoNormal"> Yahoo! Japan<o:p></o:p></p>
<p class="MsoNormal"> Verizon<o:p></o:p></p>
<p class="MsoNormal"> We plan to do a Certification press release in the RSA timeframe - February 13<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> #1007 Registration: Client jwks / jwks_uri must not contain private key material Core 8.1 Pairwise identifier algorithm and native apps<o:p></o:p></p>
<p class="MsoNormal"> Mike will review as part of the errata work<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Odd Mobile Apps and SSO Practices<o:p></o:p></p>
<p class="MsoNormal"> Phil ran into a case where developers are swapping ID Tokens for access tokens<o:p></o:p></p>
<p class="MsoNormal"> He thought that was odd because it means that authentication is being used for authorization<o:p></o:p></p>
<p class="MsoNormal"> The old wisdom about not using OAuth for identity is being ignored by some mobile app developers<o:p></o:p></p>
<p class="MsoNormal"> John said that Google documents a practice in which applications don't need to run their own OAuth servers<o:p></o:p></p>
<p class="MsoNormal"> https://developers.google.com/identity/sign-in/web/backend-auth<o:p></o:p></p>
<p class="MsoNormal"> It involves use of a proprietary introspection endpoint<o:p></o:p></p>
<p class="MsoNormal"> Facebook also has similar documentation<o:p></o:p></p>
<p class="MsoNormal"> George brought this old blog post that he was pointed to by some developers to our attention<o:p></o:p></p>
<p class="MsoNormal"> https://thewayofcode.wordpress.com/2013/11/25/how-to-secure-your-http-api-endpoints-using-facebook-as-oauth-provider/<o:p></o:p></p>
<p class="MsoNormal"> Phil described use cases in which stateless services are desired<o:p></o:p></p>
<p class="MsoNormal"> This is problematic when a device is lost because revocation is needed in that case<o:p></o:p></p>
<p class="MsoNormal"> William's forthcoming blog post on these topics is clearly needed<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> We are cancelling the Monday, January 9th call due to conflicts for several participants<o:p></o:p></p>
<p class="MsoNormal"> Our next call will be Thursday, January 19th at 7am Pacific Time<o:p></o:p></p>
</div>
</body>
</html>