<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Tom,<div class=""><br class=""></div><div class="">I’m not sure I understand what ’sp’ stands for in this context?</div><div class=""><br class=""></div><div class="">I didn’t mention the UKOB spec at all, and I don’t believe it mentions anything in this area.</div><div class=""><br class=""></div><div class="">My statement was based on a native mobile app and a confidential client in the backend connecting to a FAPI part 2 authorization server. The mobile app needs a signed request object in order to present the authentication endpoint to the user; the native app can’t/mustn’t have the keys to create that request object so this can be obtained by the native app either directly from a backend API for the client, or (as Nat mentions) the browser can be sent to the confidential client which redirects to the AS.</div><div class=""><br class=""></div><div class="">I think we’re talking about having a document that describes what should be done, but not the exact details of how it is done. I don’t have a wrong feeling for whether it’s called a spec or a best practice.</div><div class=""><br class=""></div><div class="">Is the draft code of conduct document you mentioned publicly available?</div><div class=""><br class=""></div><div class="">Thanks</div><div class=""><br class=""></div><div class="">Joseph</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 22 Jul 2019, at 18:53, Tom Jones <<a href="mailto:thomasclinganjones@gmail.com" class="">thomasclinganjones@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Are you saying that the ukob spec addresses the communication between a sp and the sp software running on the users phone?<div dir="auto" class=""><br class=""></div><div dir="auto" class="">That is the topic of a code of conduct currently under development in us health care. It would be good to compare notes.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Since this is regarded as internal messaging I am not sure it is an appropriate subject for standardization. Best practice perhaps.<br class=""><br class=""><div data-smartmail="gmail_signature" dir="auto" class="">thx ..Tom (mobile)</div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jul 22, 2019, 10:33 AM Joseph Heenan via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If this were under FAPI part 2 the native app would need to obtain [at a minimum] the signed request object from the backend, and I believe PKCE then doesn’t add a huge amount (except allowing the server to perform the checks rather than relying on the client).<br class="">
<br class="">
There might be an argument that the native app should never possess the code verifier and should instead ask the backend to create a code_challenge for it? I’m not sure it makes a massive difference to the security model though.<br class="">
<br class="">
A spec seems like a good idea to me.<br class="">
<br class="">
Joseph<br class="">
<br class="">
> On 22 Jul 2019, at 17:38, Nat Sakimura via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank" rel="noreferrer" class="">openid-specs-ab@lists.openid.net</a>> wrote:<br class="">
> <br class="">
> So do you think it is a good idea to codify it in a short spec?<br class="">
> I have seen too many of bad patterns lately :-(<br class="">
> <br class="">
> On Mon, Jul 22, 2019 at 10:10 AM Torsten Lodderstedt<br class="">
> <<a href="mailto:torsten@lodderstedt.net" target="_blank" rel="noreferrer" class="">torsten@lodderstedt.net</a>> wrote:<br class="">
>> <br class="">
>> <br class="">
>> <br class="">
>>> On 20. Jul 2019, at 21:03, Nat Sakimura via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank" rel="noreferrer" class="">openid-specs-ab@lists.openid.net</a>> wrote:<br class="">
>>> <br class="">
>>> An app sending a PKCE request and getting back the code that is being sent to the server with the code verifier that are used by the server component to obtain ID Token feels a bit better.<br class="">
>> <br class="">
>> I agree.<br class="">
>> <br class="">
> <br class="">
> <br class="">
> -- <br class="">
> Nat Sakimura (=nat)<br class="">
> Chairman, OpenID Foundation<br class="">
> <a href="http://nat.sakimura.org/" rel="noreferrer noreferrer" target="_blank" class="">http://nat.sakimura.org/</a><br class="">
> @_nat_en<br class="">
> _______________________________________________<br class="">
> Openid-specs-ab mailing list<br class="">
> <a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" rel="noreferrer" class="">Openid-specs-ab@lists.openid.net</a><br class="">
> <a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
<br class="">
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" rel="noreferrer" class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</blockquote></div>
</div></blockquote></div><br class=""></div></body></html>