<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Spec Call Notes 7-May-20<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Roland Hedberg<o:p></o:p></p>
<p class="MsoNormal">Tim Cappalli<o:p></o:p></p>
<p class="MsoNormal">Bjorn Hjelm<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal">Bhupinder Singh<o:p></o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Federation Specification<o:p></o:p></p>
<p class="MsoNormal"> We released a new draft last week<o:p></o:p></p>
<p class="MsoNormal"> There was discussion on the list of using signed requests rather than private_key_jwt<o:p></o:p></p>
<p class="MsoNormal"> Roland is working on that change<o:p></o:p></p>
<p class="MsoNormal"> We'd planned an interop event at TNC in June in Bristol<o:p></o:p></p>
<p class="MsoNormal"> We're planning on doing that virtually instead<o:p></o:p></p>
<p class="MsoNormal"> Roland is deploying a federation that testers will be able to use<o:p></o:p></p>
<p class="MsoNormal"> We know of three implementations at present<o:p></o:p></p>
<p class="MsoNormal"> Roland plans to do the signed request update before the interop<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Identiverse<o:p></o:p></p>
<p class="MsoNormal"> We discussed the ways that Identiverse may be run<o:p></o:p></p>
<p class="MsoNormal"> Mike was hoping to get interactive feedback on the Federation work<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OAuth JAR<o:p></o:p></p>
<p class="MsoNormal"> Brian did a PR to address the PAR issue<o:p></o:p></p>
<p class="MsoNormal"> There's another PR by Torsten using metadata to determine algorithms<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/Nat/oauth-jwsreq/pull-requests/4/">
https://bitbucket.org/Nat/oauth-jwsreq/pull-requests/4/</a><o:p></o:p></p>
<p class="MsoNormal"> That needs to be merged<o:p></o:p></p>
<p class="MsoNormal"> Nat and John then need to publish an updated draft again<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Safari Bounce Tracking Proposal<o:p></o:p></p>
<p class="MsoNormal"> George described Apple's bounce tracking proposal<o:p></o:p></p>
<p class="MsoNormal"> See <a href="https://github.com/privacycg/proposals/issues/6">
https://github.com/privacycg/proposals/issues/6</a> and<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://github.com/privacycg/meetings/blob/master/2020/telcons/04-23-bouncetracking-minutes.md">
https://github.com/privacycg/meetings/blob/master/2020/telcons/04-23-bouncetracking-minutes.md</a><o:p></o:p></p>
<p class="MsoNormal"> This is in a Safari tech preview release<o:p></o:p></p>
<p class="MsoNormal"> Federation redirects look like this<o:p></o:p></p>
<p class="MsoNormal"> This is another possible set of browser changes that could affect identity flows<o:p></o:p></p>
<p class="MsoNormal"> Like the SameSite cookie changes<o:p></o:p></p>
<p class="MsoNormal"> This may interact with the IsLoggedIn proposal
<a href="https://github.com/WebKit/explainers/tree/master/IsLoggedIn">https://github.com/WebKit/explainers/tree/master/IsLoggedIn</a><o:p></o:p></p>
<p class="MsoNormal"> and the Google WebID proposal <a href="https://github.com/samuelgoto/WebID">
https://github.com/samuelgoto/WebID</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><o:p></o:p></p>
<p class="MsoNormal"> #1164-#1166 Federation issues now assigned to Roland<o:p></o:p></p>
<p class="MsoNormal"> Roland said that there's some other issues that he's addressed that he should close<o:p></o:p></p>
<p class="MsoNormal"> #1160 Registration 2 - Should data: URLs be allowed as valid logo_uri values?<o:p></o:p></p>
<p class="MsoNormal"> No new thoughts during the call<o:p></o:p></p>
<p class="MsoNormal"> #1161 Key rotation should require a delay between publishing a key and starting to use it?<o:p></o:p></p>
<p class="MsoNormal"> There's been more discussion on the issue, including about what the certification code is doing<o:p></o:p></p>
<p class="MsoNormal"> There's no evidence that these possible attacks have ever occurred in practice<o:p></o:p></p>
<p class="MsoNormal"> Roland said that in SAML federations, new keys are typically added days before use<o:p></o:p></p>
<p class="MsoNormal"> But in some circumstances, keys have to be changed faster than that<o:p></o:p></p>
<p class="MsoNormal"> #1086 Core 5.6.2 - chaining Distributed Claims<o:p></o:p></p>
<p class="MsoNormal"> We should investigate this<o:p></o:p></p>
<p class="MsoNormal"> The question is whether recursion is allowed<o:p></o:p></p>
<p class="MsoNormal"> There doesn't appear to be a reason why this shouldn't work<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next working group call is Monday, May 11 at 4pm Pacific Time<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>