<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Spec Call Notes 13-Aug-20<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Tim Cappalli<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Tom Jones<o:p></o:p></p>
<p class="MsoNormal">Filip Skokan<o:p></o:p></p>
<p class="MsoNormal">Joseph Heenan<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal">Bjorn Hjelm<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OAuth JAR<o:p></o:p></p>
<p class="MsoNormal"> Being discussed on the IESG Telechat right now<o:p></o:p></p>
<p class="MsoNormal"> There were no objections from the IESG - just comments<o:p></o:p></p>
<p class="MsoNormal"> (Nat and John are on the Telechat right now)<o:p></o:p></p>
<p class="MsoNormal"> They achieved approval with AD follow-up<o:p></o:p></p>
<p class="MsoNormal"> Nat needs to respond to the comments<o:p></o:p></p>
<p class="MsoNormal"> Brian wanted security considerations prohibiting use of the "sub" with a Client ID value<o:p></o:p></p>
<p class="MsoNormal"> Since that would allow repurposing the JWT for client authentication<o:p></o:p></p>
<p class="MsoNormal"> Some of the ADs asked for an explanation of why explicit typing was not included<o:p></o:p></p>
<p class="MsoNormal"> We could optionally allow explicit "typ" typing with the defined MIME type, but not require it<o:p></o:p></p>
<p class="MsoNormal"> Nat requested that people create a PR addressing the AD comments<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/Nat/oauth-jwsreq/src/master/draft-ietf-oauth-jwsreq.xml">
https://bitbucket.org/Nat/oauth-jwsreq/src/master/draft-ietf-oauth-jwsreq.xml</a><o:p></o:p></p>
<p class="MsoNormal"> Mike volunteered<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Adopting RP-Initiated Logout Spec<o:p></o:p></p>
<p class="MsoNormal"> No objections were raised, so the spec is now adopted<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Aggregated Claims Draft<o:p></o:p></p>
<p class="MsoNormal"> No objections were raised, so the spec is now adopted<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">"alg":"none" and Certification<o:p></o:p></p>
<p class="MsoNormal"> Joseph asked about the Certification suite requiring the use of alg:none in some cases<o:p></o:p></p>
<p class="MsoNormal"> Certification passes "request" values using alg:none<o:p></o:p></p>
<p class="MsoNormal"> Certification passes "request_uri" values using alg:none<o:p></o:p></p>
<p class="MsoNormal"> The certification suite doesn't ever require unsigned ID Tokens, which are allowed for response_type=code<o:p></o:p></p>
<p class="MsoNormal"> Filip suggests using whatever algorithm is available<o:p></o:p></p>
<p class="MsoNormal"> The metadata can indicate support for none or not<o:p></o:p></p>
<p class="MsoNormal"> request_object_signing_alg_values_supported<o:p></o:p></p>
<p class="MsoNormal"> The spec says "Servers SHOULD support none and RS256."<o:p></o:p></p>
<p class="MsoNormal"> Mike asserted that it's an interop issue if none is not supported<o:p></o:p></p>
<p class="MsoNormal"> George made an analogy to supporting open dynamic client registration<o:p></o:p></p>
<p class="MsoNormal"> As a security decision, AOL wouldn't want to deploy it that way, even though certification requires it<o:p></o:p></p>
<p class="MsoNormal"> Mike asserted that there's not a security issue with using unsigned Request Objects<o:p></o:p></p>
<p class="MsoNormal"> Joseph countered that the issue is having support for none in the underlying JOSE library at all<o:p></o:p></p>
<p class="MsoNormal"> Joseph asked about passing raw JSON rather than an unsigned JWT<o:p></o:p></p>
<p class="MsoNormal"> Mike said that that isn't supported by the spec<o:p></o:p></p>
<p class="MsoNormal"> Joseph asked about using PAR instead<o:p></o:p></p>
<p class="MsoNormal"> Mike said that it's not a standard yet and there's not support for it in Connect today<o:p></o:p></p>
<p class="MsoNormal"> Filip suggested making the unsigned Request Object tests optional<o:p></o:p></p>
<p class="MsoNormal"> Bjorn agreed with Filip's comments<o:p></o:p></p>
<p class="MsoNormal"> Brian said that alg:none has given JOSE an unduly bad name<o:p></o:p></p>
<p class="MsoNormal"> He thought that certifying should not require support of alg:none<o:p></o:p></p>
<p class="MsoNormal"> Nat thinks that certifying without supporting alg:none should be OK<o:p></o:p></p>
<p class="MsoNormal"> Mike suggested having two sets of Request Object tests - one for none and one for RS256<o:p></o:p></p>
<p class="MsoNormal"> Mike would still like to test none, when available<o:p></o:p></p>
<p class="MsoNormal"> Joseph said that the unsigned one can go to a skipped state if none isn't listed in the metadata<o:p></o:p></p>
<p class="MsoNormal"> We agreed to hand this off to the certification team to work out the details of the implementation change<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">logout_hint Proposal<o:p></o:p></p>
<p class="MsoNormal"> Issue #1182 - Add logout_hint parameter to RP-Initiated Logout request<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues/1182/add-logout_hint-parameter-to-rp-initiated">
https://bitbucket.org/openid/connect/issues/1182/add-logout_hint-parameter-to-rp-initiated</a><o:p></o:p></p>
<p class="MsoNormal"> George said that the login_hint should never bypass the person entering credentials<o:p></o:p></p>
<p class="MsoNormal"> He said that the ID Token is more secure<o:p></o:p></p>
<p class="MsoNormal"> Brian said that the use of the ID Token in backwards flows is problematic<o:p></o:p></p>
<p class="MsoNormal"> He said that their implementation doesn't have a place to store the ID Token<o:p></o:p></p>
<p class="MsoNormal"> Mike said that the logout_hint would only be used to select among logged-in sessions<o:p></o:p></p>
<p class="MsoNormal"> The user would still be asked whether they want to log out or not<o:p></o:p></p>
<p class="MsoNormal"> George reminded us that we have a sid parameter on Back-Channel but not Front-Channel<o:p></o:p></p>
<p class="MsoNormal"> He said that if we add parameters, we should make sure to cover all the use cases<o:p></o:p></p>
<p class="MsoNormal"> We ran out of time to finish the discussion<o:p></o:p></p>
<p class="MsoNormal"> Mike suggested that people add comments to the issue<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><o:p></o:p></p>
<p class="MsoNormal"> (We ran out of time so no additional open issues were discussed)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next working group call is Monday, August 17 at 4pm Pacific Time<o:p></o:p></p>
<p class="MsoNormal"> This is the call primarily devoted to SIOP issues<o:p></o:p></p>
</div>
</body>
</html>