<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Helvetica, Arial, sans-serif">+1 Thanks for writing this
up Torsten!</font><br>
<br>
<div class="moz-cite-prefix">On 8/24/18 8:45 AM, Torsten Lodderstedt
via Openid-specs-ab wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4C6CB536-A414-49BE-A869-DFBAD1AE598D@lodderstedt.net">
<pre wrap="">Hi Mike,
I created the new draft and sent you a pull request (<a class="moz-txt-link-freetext" href="https://bitbucket.org/openid/connect/pull-requests/3/1029-authentication-failed-error-response/diff">https://bitbucket.org/openid/connect/pull-requests/3/1029-authentication-failed-error-response/diff</a>).
I also attached the HTML.
@all: Please review and give feedback.
Thanks in advance,
Torsten.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Am 28.07.2018 um 21:52 schrieb Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>:
It would be listed in the set of Connect specifications at <a class="moz-txt-link-freetext" href="http://openid.net/connect/">http://openid.net/connect/</a>.
-- Mike
-----Original Message-----
From: Torsten Lodderstedt <a class="moz-txt-link-rfc2396E" href="mailto:torsten@lodderstedt.net"><torsten@lodderstedt.net></a>
Sent: Saturday, July 28, 2018 5:32 AM
To: Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>
Cc: Vladimir Dzhuvinov <a class="moz-txt-link-rfc2396E" href="mailto:vladimir@connect2id.com"><vladimir@connect2id.com></a>; <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Spec Call Notes 21-Jun-18
Hi Mike,
I potentially could do such a spec quickly. But how do you envision a developer to find out there is a complementary spec enhancing OpenID Connect Core? Developers will (at most) consult the OpenID Connect spec because that�s what they are looking for.
kind regards,
Torsten.
</pre>
<blockquote type="cite">
<pre wrap="">Am 30.06.2018 um 14:57 schrieb Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>:
I was envisioning a spec that simply defines a new error code and registers it in the OAuth Extensions Error Registry. Its normative contents would be something like this:
OAuth �error� Value:
unable_to_meet_authentication_requirements
The authentication performed did not meet the requirements of the requester.
In the non-normative parts of the spec, you could say that one place this new error code could be used was if an OpenID Connect �acr� is requested as an essential claim and its criteria could not be met.
This doesn�t rise to the level of incrementing the Connect version number or updating the entire spec. In my view, that would send the wrong message to the marketplace.
You could do this simple spec pretty quickly.
-- Mike
From: Torsten Lodderstedt <a class="moz-txt-link-rfc2396E" href="mailto:torsten@lodderstedt.net"><torsten@lodderstedt.net></a>
Sent: Friday, June 29, 2018 10:44 PM
To: Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>
Cc: Vladimir Dzhuvinov <a class="moz-txt-link-rfc2396E" href="mailto:vladimir@connect2id.com"><vladimir@connect2id.com></a>; <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Spec Call Notes 21-Jun-18
What kind of new spec do you have in mind to add the error code, which is required to properly handle an error situation described in OpenId Connect Core? I would assume OpenID Connect 1.x?
Am 28.06.2018 um 12:28 schrieb Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>:
Can you change a published RFC? No.
Part of the OIDF maintaining its reputation as a professional standards body is to likewise safeguard the integrity of our final specifications.
I realize that writing a new specification to introduce new functionality may seem inconvenient but it�s ultimately the right thing to do.
-- Mike
From: Torsten Lodderstedt <a class="moz-txt-link-rfc2396E" href="mailto:torsten@lodderstedt.net"><torsten@lodderstedt.net></a>
Sent: Wednesday, June 27, 2018 8:14 PM
To: Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>
Cc: Vladimir Dzhuvinov <a class="moz-txt-link-rfc2396E" href="mailto:vladimir@connect2id.com"><vladimir@connect2id.com></a>; <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Spec Call Notes 21-Jun-18
Even if the error code is obviously missing in the original spec?
Am 27.06.2018 um 07:31 schrieb Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>:
Correct. Just like the IETF, we don�t make normative changes to Final specifications.
The way to introduce a new error code is to write a new specification that does so.
-- Mike
From: Openid-specs-ab <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab-bounces@lists.openid.net"><openid-specs-ab-bounces@lists.openid.net></a> On Behalf Of Vladimir Dzhuvinov via Openid-specs-ab
Sent: Wednesday, June 27, 2018 8:26 AM
To: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Spec Call Notes 21-Jun-18
My observation is that errata don't introduce new parameters, but are rather used to fix typos and clarify things.
Depending on how the errata get published - as part of the original spec or as separate doc - developers often fail to notice them :)
Vladimir
On 25/06/18 18:34, Torsten Lodderstedt via Openid-specs-ab wrote:
What about an errata?
Am 25.06.2018 um 16:31 schrieb Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>:
A new specification needs to be written. We can't add new functionality to final specifications.
-----Original Message-----
From: Torsten Lodderstedt <a class="moz-txt-link-rfc2396E" href="mailto:torsten@lodderstedt.net"><torsten@lodderstedt.net></a>
Sent: Monday, June 25, 2018 10:30 AM
To: Mike Jones <a class="moz-txt-link-rfc2396E" href="mailto:Michael.Jones@microsoft.com"><Michael.Jones@microsoft.com></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Spec Call Notes 21-Jun-18
Hi Mike,
what needs to be done in order to bring Issue #1029 forward?
kind regards,
Torsten.
Am 21.06.2018 um 16:48 schrieb Mike Jones via Openid-specs-ab <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab@lists.openid.net"><openid-specs-ab@lists.openid.net></a>:
Spec Call Notes 21-Jun-18
Mike Jones
Brian Campbell
George Fletcher
Bjorn Hjelm
John Bradley
George Fletcher's Native SSO Proposal
George plans to produce an xml2rfc version of his Native SSO draft by the end of the week
Potential iOS Changes
Vittorio Bertocci plans to have a meeting at Identiverse to discuss SSO and Apple's "Intelligent Track Protection" initiative
Federation Specification Review
This review is under way
<a class="moz-txt-link-freetext" href="http://openid.net/2018/06/08/public-review-period-for-openid-connect-federation-specification-started/">http://openid.net/2018/06/08/public-review-period-for-openid-connect-federation-specification-started/</a>
People are encouraged to review the draft
RISC Approval Vote
The vote is open through June 29th
Please participate at <a class="moz-txt-link-freetext" href="https://openid.net/foundation/members/polls/141">https://openid.net/foundation/members/polls/141</a>
Certification
We are launching the Form Post Response Mode certification profiles at Identiverse
We will have people test the tests at Identiverse
New RP Libraries
We've created a jwtconnect.io site as a documentation home for the JWTConnect libraries
Roland plans to create the Python github projects at <a class="moz-txt-link-freetext" href="https://github.com/openid">https://github.com/openid</a> before Identiverse
Open Issues
See <a class="moz-txt-link-freetext" href="https://bitbucket.org/openid/connect/issues">https://bitbucket.org/openid/connect/issues</a>
#1029: authentication_failed error response
No activity since last call
#1030: Front & back-channel logout: require HTTPS URIs?
Vladimir is right. Mike will make the change to require https URIs.
Unauthenticated Logout Requests
George will file an issue proposing Security Considerations language about denial of service attacks using front-channel logout
Spec Progress
We plan to take the three logout specs to final status soon
Please review them now
The OAuth AS Metadata spec is in Auth48 so will probably finish this week
This will unblock the errata progress
The Security Event Token (SET) spec is with the RFC editor and so should also finish soon
We want this to finish before making back-channel logout final
Next Calls
We are cancelling the Monday, June 25th call because it is during Identiverse
The next call is Thursday, July 5th at 7am Pacific Time
_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Distinguished Engineer
Identity Services Engineering Work: <a class="moz-txt-link-abbreviated" href="mailto:george.fletcher@teamaol.com">george.fletcher@teamaol.com</a>
AOL Inc. AIM: gffletch
Mobile: +1-703-462-3494 Twitter: <a class="moz-txt-link-freetext" href="http://twitter.com/gffletch">http://twitter.com/gffletch</a>
Office: +1-703-265-2544 Photos: <a class="moz-txt-link-freetext" href="http://georgefletcher.photography">http://georgefletcher.photography</a>
</pre>
</body>
</html>