<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Spec Call Notes 30-Jul-20<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Tim Cappalli<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Bjorn Hjelm<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Tom Jones<o:p></o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Filip Skokan<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OAuth JAR<o:p></o:p></p>
<p class="MsoNormal"> Nat published -26, addressing comments by Ben Kaduk<o:p></o:p></p>
<p class="MsoNormal"> Nat will reach out to Ben after IETF finishes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Adopting RP-Initiated Logout Spec<o:p></o:p></p>
<p class="MsoNormal"> Mike called for adoption of the RP-Initiated Logout spec<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://openid.net/specs/openid-connect-rpinitiated-1_0.html">
https://openid.net/specs/openid-connect-rpinitiated-1_0.html</a><o:p></o:p></p>
<p class="MsoNormal"> It consists entirely of content extracted from the Session Management spec<o:p></o:p></p>
<p class="MsoNormal"> Those on the call were in favor of adoption<o:p></o:p></p>
<p class="MsoNormal"> Unless objections are heard within two weeks, it will be adopted<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Aggregated Claims Draft<o:p></o:p></p>
<p class="MsoNormal"> It is intended to make aggregated and distributed claims interoperable<o:p></o:p></p>
<p class="MsoNormal"> Nat mailed it to the working group<o:p></o:p></p>
<p class="MsoNormal"> <a href="http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20200720/007857.html">
http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20200720/007857.html</a><o:p></o:p></p>
<p class="MsoNormal"> It was discussed during the second SIOP meetup<o:p></o:p></p>
<p class="MsoNormal"> Nat called for it to be adopted<o:p></o:p></p>
<p class="MsoNormal"> Those on the call were in favor of adoption<o:p></o:p></p>
<p class="MsoNormal"> Unless objections are heard within two weeks, it will be adopted<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Certification<o:p></o:p></p>
<p class="MsoNormal"> Nat and Edmund have submissions ready for Basic and Implicit OP<o:p></o:p></p>
<p class="MsoNormal"> They filed <a href="https://gitlab.com/openid/conformance-suite/-/issues/792">
https://gitlab.com/openid/conformance-suite/-/issues/792</a><o:p></o:p></p>
<p class="MsoNormal"> Nat will add that the Python suite passed when nonce not returned from the authorization endpoint<o:p></o:p></p>
<p class="MsoNormal"> Related to <a href="https://bitbucket.org/openid/connect/issues/1052/make-clear-that-nonce-is-always-required">
https://bitbucket.org/openid/connect/issues/1052/make-clear-that-nonce-is-always-required</a><o:p></o:p></p>
<p class="MsoNormal"> We got a full set of OP submissions from Filip<o:p></o:p></p>
<p class="MsoNormal"> Filip discovered that the RP Config and RP Dynamic profiles aren't yet in the Java suite<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">SIOP Meeting Follow-up<o:p></o:p></p>
<p class="MsoNormal"> We agreed to follow up on the laundry list and break it into individual issues<o:p></o:p></p>
<p class="MsoNormal"> We agreed dedicate the Pacific call to mostly discuss SIOP issues<o:p></o:p></p>
<p class="MsoNormal"> We can also discuss this at times on the Atlantic call<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Logout and Session Issues<o:p></o:p></p>
<p class="MsoNormal"> At <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open&component=Logout">
https://bitbucket.org/openid/connect/issues?status=new&status=open&component=Logout</a><o:p></o:p></p>
<p class="MsoNormal"> and <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open&component=Session">
https://bitbucket.org/openid/connect/issues?status=new&status=open&component=Session</a><o:p></o:p></p>
<p class="MsoNormal"> #1003 - Document possible impacts of disabling third-party cookies on front-channel logout<o:p></o:p></p>
<p class="MsoNormal"> Mike will propose warning text in the Implementation Consideration sections<o:p></o:p></p>
<p class="MsoNormal"> #1017 - Session management: RP-init logout: Proposal for optional ui_locales parameter<o:p></o:p></p>
<p class="MsoNormal"> Mike will ask in the issue whether the OP already knows the locale info<o:p></o:p></p>
<p class="MsoNormal"> #1056 - Use of id_token in RP-Initiated Logout as the id_token_hint<o:p></o:p></p>
<p class="MsoNormal"> Should we allow POST to the logout endpoint?<o:p></o:p></p>
<p class="MsoNormal"> Filip said that Connect requires POST support to the authorization endpoint<o:p></o:p></p>
<p class="MsoNormal"> But it's a MAY in OAuth<o:p></o:p></p>
<p class="MsoNormal"> #1022 - Session Management OP Frame message origin assertion<o:p></o:p></p>
<p class="MsoNormal"> Filip to review the issue and propose specific changes<o:p></o:p></p>
<p class="MsoNormal"> #1047 - session_state - upon authentication failure?<o:p></o:p></p>
<p class="MsoNormal"> Filip to review the issue and propose specific changes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Key Recovery<o:p></o:p></p>
<p class="MsoNormal"> We discussed Tom and Tobias' key recovery proposals<o:p></o:p></p>
<p class="MsoNormal"> John described possible use of WebAuthn for this<o:p></o:p></p>
<p class="MsoNormal"> We also touched on Tom's persistent ID proposal<o:p></o:p></p>
<p class="MsoNormal"> Nat said that this is potentially related to the MODRNA Account Porting specification<o:p></o:p></p>
<p class="MsoNormal"> We will work on open tickets related to these<o:p></o:p></p>
<p class="MsoNormal"> A draft may be created and submitted to the WG<o:p></o:p></p>
<p class="MsoNormal"> John and Kim Cameron discussed encrypting bootstrap info into the DID document<o:p></o:p></p>
<p class="MsoNormal"> and then using WebAuthn to decrypt the info in a wallet after the user has authenticated via WebAuthn<o:p></o:p></p>
<p class="MsoNormal"> John: You could also include the WebAuthn credentialID in the did document as well<o:p></o:p></p>
<p class="MsoNormal"> Only the person with the authenticator would be able to decrypt the key info<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><o:p></o:p></p>
<p class="MsoNormal"> (No additional open issues were discussed)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next working group call is Monday, August 3 at 4pm Pacific Time<o:p></o:p></p>
</div>
</body>
</html>