<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Spec Call Notes 6-Jan-20<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Federation<o:p></o:p></p>
<p class="MsoNormal"> The vote for the second Implementer's Vote will pass tomorrow<o:p></o:p></p>
<p class="MsoNormal"> Roland and Mike attended Internet2/REFEDS in December<o:p></o:p></p>
<p class="MsoNormal"> There was a Federation hackathon<o:p></o:p></p>
<p class="MsoNormal"> We also received feedback on when to hold the three interop events in 2020<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">eKYC-IDA WG<o:p></o:p></p>
<p class="MsoNormal"> This is where work on OpenID Connect for Identity Assurance will continue<o:p></o:p></p>
<p class="MsoNormal"> See https://openid.net/2019/12/28/openid-connect-for-identity-assurance-now-has-a-dedicated-home/<o:p></o:p></p>
<p class="MsoNormal"> There's a call scheduled for January 8th<o:p></o:p></p>
<p class="MsoNormal"> Nat will check if the call is in the OpenID calendar<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Certification and Logout<o:p></o:p></p>
<p class="MsoNormal"> The Logout OP tests up, with instructions at https://openid.net/certification/logout-op-testing/<o:p></o:p></p>
<p class="MsoNormal"> Please test your code and the tests now!<o:p></o:p></p>
<p class="MsoNormal"> The Logout RP tests are nearly done, with instructions shortly to follow<o:p></o:p></p>
<p class="MsoNormal"> Having these tests provides important feedback needed to finish the logout specs<o:p></o:p></p>
<p class="MsoNormal"> They have already pointed out places where clarifications are needed<o:p></o:p></p>
<p class="MsoNormal"> Now is the time to run tests!<o:p></o:p></p>
<p class="MsoNormal"> Mike is using the Mercurial shutdown as a forcing function to motivate finishing these specs<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OAuth JAR Spec<o:p></o:p></p>
<p class="MsoNormal"> https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-19<o:p></o:p></p>
<p class="MsoNormal"> In AD Review status by Ben Kaduk<o:p></o:p></p>
<p class="MsoNormal"> John reported that they've been going back and forth on a possible change<o:p></o:p></p>
<p class="MsoNormal"> Some people are angry that the spec is changing the Connect request object semantics<o:p></o:p></p>
<p class="MsoNormal"> The IESG (Ben Campbell) objected to merging parameters - suggesting that all parameters must be secured<o:p></o:p></p>
<p class="MsoNormal"> Mike asked whether we could just add a note in the JAR spec on what the differences from Connect are and why they don't matter<o:p></o:p></p>
<p class="MsoNormal"> John said that some servers count on parameters like scope being outside the request object<o:p></o:p></p>
<p class="MsoNormal"> George expressed concerns about potential certification problems<o:p></o:p></p>
<p class="MsoNormal"> Mike said that he doesn't believe there are any certification tests for merging parameters<o:p></o:p></p>
<p class="MsoNormal"> We will discuss this in Tokyo<o:p></o:p></p>
<p class="MsoNormal"> Takahiko Kawasaki was one of those objecting to the change in semantics<o:p></o:p></p>
<p class="MsoNormal"> Nat suggested that we also get the opinions of Ping and ForgeRock<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> https://bitbucket.org/openid/connect/issues?status=new&status=open<o:p></o:p></p>
<p class="MsoNormal"> #1147: certification: RFC6749 MUST for error_description<o:p></o:p></p>
<p class="MsoNormal"> We can flag this as a warning since it doesn't introduce a security or interop issue<o:p></o:p></p>
<p class="MsoNormal"> #1146: certification: is returning an empty address object permitted<o:p></o:p></p>
<p class="MsoNormal"> Mike will try to get this fixed in AAD<o:p></o:p></p>
<p class="MsoNormal"> #1143: clarify text (value vs values) in 5.5.1.1<o:p></o:p></p>
<p class="MsoNormal"> We agreed that using "value" should be permitted<o:p></o:p></p>
<p class="MsoNormal"> #1141: Clarification on claims parameter in auth request validation<o:p></o:p></p>
<p class="MsoNormal"> We agreed that adding a clarification about ignoring not-understood claims would be a reasonable thing to do<o:p></o:p></p>
<p class="MsoNormal"> #1137: Is content-type application/x-www-form-urlencoded required when calling user info endpoint with empty body?<o:p></o:p></p>
<p class="MsoNormal"> Content type shouldn’t be required when there is no content.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">RSA Board Meeting<o:p></o:p></p>
<p class="MsoNormal"> Our board meeting time on Wednesday conflicts with a WebAuthn meeting<o:p></o:p></p>
<p class="MsoNormal"> We could perhaps move the board meeting to Tuesday or Thursday<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next working group call will be on Thursday, January 16th at 7:00am Pacific Time<o:p></o:p></p>
</div>
</body>
</html>