<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Amazing! Thank you very much, Edmund.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Really appreciate it. Will review and respond accordingly!</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Cheers,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kristina</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Edmund Jay <ejay@mgi1.com><br>
<b>Sent:</b> Friday, December 10, 2021 9:47<br>
<b>To:</b> Kristina Yasuda <Kristina.Yasuda@microsoft.com>; openid-specs-ab@lists.openid.net <openid-specs-ab@lists.openid.net><br>
<b>Subject:</b> SIOP v2 review comments</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hi Kristina,</div>
<div><br>
</div>
<div>I've reviewed the SIOP v2 and here are some comments.</div>
<div><br>
</div>
<div>I"ve also created a pull request with some minor editorial/grammer fixes.</div>
<div><br>
</div>
<div>General comments:<br>
<br>
The html document bookmarks don’t work e.g. {#rp-metadata}, etc..<br>
<br>
<br>
2.4<br>
, and hard to be verified in a digital form.<br>
<br>
Are the digitally scanned documents hard to verify?<br>
Or the scanned documents are hard to verify electronically?<br>
<br>
<br>
3.1 <br>
Cryptographically Verifiable Identifiers - an identifier that is either based upon or can be resolved to cryptographic key material and is used by the Self-Issued OPs in the sub Claim of the ID Token to prove possession of the cryptographic key used to sign
the ID Token. Types of such identifiers are defined in this specification as Subject Syntax Types.<br>
<br>
The definition is already defined in 4, so therefore we can rewrite this part as:<br>
<br>
Subject Syntax Types - defines types of cryptographically verifiable identifiers.<br>
<br>
<br>
4.1<br>
RP and OP are defined in OIDC, so don’t need to relist them here<br>
Self-issued OP is not an abbreviation. OP is already listed in OIDC.<br>
<br>
<br>
6.<br>
Same-Device Self-Issued OP model: Self-Issued OP is on the same device on which the End-User's user interactions are occurring.
<br>
<br>
“The RP might be a Web site on a different machine and use the same-device Self-Issued OP flow for authentication.”<br>
<br>
This sentence seems to be describing the Cross device model where the RP and SIOP are on different devices.<br>
<br>
<br>
7.<br>
If the Self-Issued OP is able to perform pre-registration of the RP, client_id MUST equal to the client identifier the RP has pre-obtained using [OpenID.Registration] or out-of-band mechanisms, and registration nor registration_uri parameters MUST NOT be present
in the Self-Issued OP Request. If the Self-Issued OP Request is signed, the public key for verification MUST be obtained during the pre-registration process.<br>
<br>
I think this paragraph needs to be in 11 since it’s about the authentication request. It's also repeated 2/3 times in this document.<br>
<br>
<br>
9.2<br>
Need a short sentence to precede the metadata definitions to explain what they’re for.<br>
<br>
<br>
10.1<br>
This whole section seems to be about the authentication request and not registration.<br>
<br>
<br>
10.2<br>
Maybe add some context to say that registration parameters are sent along with the authentication request<br>
<br>
10.2.2.2<br>
To obtain the DID Document, Self-Issued OP MUST use DID Resolution defined by the DID method must be used by the RP.<br>
<br>
Too many “MUST” in that sentence.<br>
</div>
<div><br>
</div>
<div><br>
11.<br>
client_id<br>
REQUIRED. Client ID value for the Client, which in this case contains the redirect_uri value of the RP.<br>
<br>
Various places in the doc mentions client_id must also be the registered value.<br>
<br>
<br>
11.1<br>
Is response_mode=post required for all cross-device flows?<br>
If yes, the example does not have one.<br>
</div>
</div>
</div>
</body>
</html>