<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0"></p>
<div></div>
<p></p>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
===================================================</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
OpenID AB/Connect WG Call Note (2018-08-30)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
===================================================</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Date: 2018-08-30 14:00 UTC</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Location: GoToMeeting https://global.gotomeeting.com/join/181372694</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Agenda</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
-----------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
1. Roll Call</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
2. Commonalities and Differences Report on Fed Specs (Andreas/Roland)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3. Issues</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3.1. #1046 - Core 3.1.2.1. - id_token_hint (Torsten)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3.2. #1047 - session_state - upon authentication failure? (Filip)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3.3. #1048 - Correct way to return errors (fragment vs query) in hybrid flow is unclear (Joseph)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3.4. #1033 - RP-initiated logout: require valid id_token_hint to take action on post_logout_redirect_uri (Filip)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
4. AOB</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
4.1. Topics for the next call</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
4.2. OIX Meeting on 10 and 11</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
The meeting was called to order at 14:05 UTC. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
1. Roll Call</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
=============</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Present: Nat, Andreas, Brian, Chris Phillips, Filip, George, Henrik, Roland, Sarah, Torsten, Bjorn, Brian, Rich, Joseph</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
2. Commonalities and Differences Report on Fed Specs (Andreas/Roland)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
=====================================================================</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Commonalities</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
1. Both are based on a trust chain. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Roland: Nested objects. Allows by value. --> can switch to list. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Andreas: List. Only by references. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
2. Both use Flattening. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3. Differences</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Roland: 3.1 OIDC standard dynamic registration</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Andreas: 3.2 No registration: Implicit use of asymmetric key/webfinger</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
RP just sends authorization req. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Client_id = url so OP can use webfinger. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Registration is to a common trust root. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
It seems to be able to come up with a draft that has a common approach on 1, 2 and options to choose either 3.1 or 3.2. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Chris also pointed out that Multi-lateral trust needs to be addressed explicitly. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Everybody agreed that current "implicit" assumption on it should be made explicit. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Nat asked if there is a way to have two federations interoperate at a later day if they have chosen 3.1 and 3.2 respectively. This is a valid use-case and needs more consideration. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
There are F2F opportunity at</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* TecEx: https://meetings.internet2.edu/2018-technology-exchange/</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* IIW</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">Roland, Andreas and Chris are going to have more conversations and</span>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
should be able to come up with a report in a few weeks. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3. Issues</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
============</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
#1046 - Core 3.1.2.1. - id_token_hint (Torsten)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
-------------------------------------------------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* #1046: https://bitbucket.org/openid/connect/issues/1046/core-3121-id_token_hint</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">Add non-normative text to say that login_hint is any string that</span>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
helps RP to identify who the user is. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Norway, login_hint is used to signal the issuer. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
George will come up with a proposed. text. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
#1047 - session_state - upon authentication failure? (Filip)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
-------------------------------------------------------------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* #1047 - https://bitbucket.org/openid/connect/issues/1047/</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Text scattered all over so should be collected at one place. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Filip will produce a suggested text. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
#1048 - Correct way to return errors (fragment vs query) in hybrid flow is unclear (Joseph)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
--------------------------------------------------------------------------------------------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* #1048 - https://bitbucket.org/openid/connect/issues/1048/</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
It should be returned in the fragment as the certification suite at the end of last year was OK with returning it in the query string. This behaviour is now fixed and the error should be returned in the fragment. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
People agreed that the current text is not clear while our intention is clear. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Text should be clarified. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Assign it to Mike. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
#1033 - RP-initiated logout: require valid id_token_hint to take action on post_logout_redirect_uri (Filip)</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
-------------------------------------------------------------------------------------------------------------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* #1048 - https://bitbucket.org/openid/connect/issues/1033/</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
This ticket is related to #1032. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
It is clear that there needs to be a mechanism to validate that it is safe to do a redirect. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Are there other mechanisms that do not require login_hint? </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Session ID OR </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* Session ID + Client ID. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
* #1032 Post logout URI + Client ID. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
DOS attack possibilities etc. need to be considered as well. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Time has run out while we were discussing this issue. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
It needs to be continued on the ticket. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
4. AOB</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
==============</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
4.1 Topics for the next call </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
-----------------------------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
1. Safari IPT2 and implicit flow</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
2. Native SSO spec. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
3. Issue #1029</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
4.2 OIX Meeting on 10 and 11</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
----------------------------</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Please post more info if you have. </div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
The call closed at 15:02 UTC</div>
<div style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<br>
</div>
<span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">-- </span><br style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
<div dir="ltr" class="gmail_signature" style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: small;">
Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank" style="color: rgb(17, 85, 204);" id="LPlnk839803" class="OWAAutoLink" previewremoved="true">http://nat.sakimura.org/</a><br>
<br>
@_nat_en</div>
</div>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, Helvetica, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<p class="MsoNormal" align="left"><span style="font-size:11.0pt; font-family:"Noto Sans CJK JP Medium",sans-serif"><span lang="EN-US" style="font-family:Calibri,Helvetica,sans-serif"></span></span></p>
<p class="MsoNormal" align="left"><span lang="EN-US" style="font-size:11.0pt; font-family:"Noto Sans CJK JP Medium",sans-serif">--</span></p>
<p class="MsoNormal" align="left"><span lang="EN-US" style="font-size:11.0pt; font-family:"Noto Sans CJK JP Medium",sans-serif"></span></p>
<p class="MsoNormal" align="left"><span lang="EN-US" style="font-size:8pt; font-family:Calibri,Helvetica,sans-serif">PLEASE READ: This e-mail is confidential and intended for the named recipient only. If you are not an intended recipient, please notify the
sender and delete this e-mail.</span></p>
<span style="font-family:Calibri,Helvetica,sans-serif; font-size:8pt"></span>
<p class="MsoNormal" align="left"><br>
<span style="font-family:Calibri,Helvetica,sans-serif; font-size:8pt"></span></p>
<span style="font-family:Calibri,Helvetica,sans-serif; font-size:8pt"></span>
<p class="MsoNormal" align="left"><span style="font-family:"Noto Sans CJK JP Medium",sans-serif; font-size:11pt"><br>
</span></p>
<p class="MsoNormal" align="left"><span style="font-family:"Noto Sans CJK JP Medium",sans-serif; font-size:11pt"><br>
</span></p>
<br>
<p></p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
</div>
</div>
</div>
</body>
</html>