<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hi Edmund,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I created a PR addressing the comments you have sent below to the ML. Please review and approve.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<a href="https://bitbucket.org/openid/connect/pull-requests/91/addressing-edmunds-siop-v2-comments-sent">openid / connect / Pull Request #91: addressing Edmund's siop-v2 comments sent to the ML — Bitbucket</a><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
A lot of good catches. Thank you very much!</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Kristina</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Edmund Jay <ejay@mgi1.com><br>
<b>Sent:</b> Friday, December 10, 2021 9:47<br>
<b>To:</b> Kristina Yasuda <Kristina.Yasuda@microsoft.com>; openid-specs-ab@lists.openid.net <openid-specs-ab@lists.openid.net><br>
<b>Subject:</b> SIOP v2 review comments</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hi Kristina,</div>
<div><br>
</div>
<div>I've reviewed the SIOP v2 and here are some comments.</div>
<div><br>
</div>
<div>I"ve also created a pull request with some minor editorial/grammer fixes.</div>
<div><br>
</div>
<div>General comments:<br>
<br>
</div>
<div>The html document bookmarks don’t work e.g. {#rp-metadata}, etc..<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(12, 100, 192);">-> addressed</span></div>
<div><br>
<br>
2.4<br>
, and hard to be verified in a digital form.<br>
<br>
Are the digitally scanned documents hard to verify?<br>
Or the scanned documents are hard to verify electronically?<br>
<span style="color:rgb(12, 100, 192);font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">-> Clarified. scanned docs are hard to be verified digitally</span><br>
<br>
3.1 <br>
Cryptographically Verifiable Identifiers - an identifier that is either based upon or can be resolved to cryptographic key material and is used by the Self-Issued OPs in the sub Claim of the ID Token to prove possession of the cryptographic key used to sign
the ID Token. Types of such identifiers are defined in this specification as Subject Syntax Types.<br>
<br>
The definition is already defined in 4, so therefore we can rewrite this part as:<br>
<br>
Subject Syntax Types - defines types of cryptographically verifiable identifiers.<br>
<span style="color: rgb(12, 100, 192);">-> I like it! thank you for the suggestion!</span><br>
<br>
4.1<br>
RP and OP are defined in OIDC, so don’t need to relist them here<br>
Self-issued OP is not an abbreviation. OP is already listed in OIDC.<br>
<span style="color: rgb(12, 100, 192);">-> l agree, I took out Self-Issued OP, but kept OP/RP, keeping in mind that some of the readers of this specification are not familiar with OIDC.Core. Can take out if there are strong counter-opinions.</span><br>
<br>
6.<br>
Same-Device Self-Issued OP model: Self-Issued OP is on the same device on which the End-User's user interactions are occurring.
<br>
<br>
“The RP might be a Web site on a different machine and use the same-device Self-Issued OP flow for authentication.”<br>
<br>
This sentence seems to be describing the Cross device model where the RP and SIOP are on different devices.<br>
<span style="color: rgb(12, 100, 192); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">-> Absolutely. Thank you for catching it.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>7.<br>
If the Self-Issued OP is able to perform pre-registration of the RP, client_id MUST equal to the client identifier the RP has pre-obtained using [OpenID.Registration] or out-of-band mechanisms, and registration nor registration_uri parameters MUST NOT be present
in the Self-Issued OP Request. If the Self-Issued OP Request is signed, the public key for verification MUST be obtained during the pre-registration process.<br>
<br>
I think this paragraph needs to be in 11 since it’s about the authentication request. It's also repeated 2/3 times in this document.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(12, 100, 192);">-> I deleted the part about client_id since it is about the authn per your comments. the part is repeated twice - in the overview and in the description of the pre-registration part. the overview was added upon the request
to give more clarify. I think mentioning this twice reads ok..?</span></div>
<div><br>
9.2<br>
Need a short sentence to precede the metadata definitions to explain what they’re for.<br>
<span style="color:rgb(12, 100, 192);font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255);display:inline !important">-> Added.</span><br>
<br>
10.1<br>
This whole section seems to be about the authentication request and not registration.<br>
<span style="color: rgb(12, 100, 192);">-> Good point. moved relevant parts to the request section.</span><br>
<br>
10.2<br>
Maybe add some context to say that registration parameters are sent along with the authentication request<br>
</div>
<div><span style="color:rgb(12, 100, 192);font-family:Calibri, Arial, Helvetica, sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important">-> Added.</span><br>
</div>
<div><span style="color:rgb(12, 100, 192);font-family:Calibri, Arial, Helvetica, sans-serif;font-size:14px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div>10.2.2.2<br>
To obtain the DID Document, Self-Issued OP MUST use DID Resolution defined by the DID method must be used by the RP.<br>
<br>
Too many “MUST” in that sentence.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(12, 100, 192);">-> fixed</span></div>
<div><br>
11.<br>
client_id<br>
REQUIRED. Client ID value for the Client, which in this case contains the redirect_uri value of the RP.<br>
<br>
Various places in the doc mentions client_id must also be the registered value.<br>
<span style="color: rgb(12, 100, 192);">-> fixed. very good catch, thank you!</span><br>
</div>
<div><span style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255)"><span style="margin:0px;color:rgb(12, 100, 192)"><br>
</span></span></div>
<div>11.1<br>
Is response_mode=post required for all cross-device flows?<br>
</div>
<div>If yes, the example does not have one.<br>
</div>
<div><span style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif;background-color:rgb(255, 255, 255)"><span style="margin:0px;color:rgb(12, 100, 192)">-> Already fixed in a previous PR. When we introduce PARM, not all cross-device
flows will have response_mode=post, but for now they do)</span></span><br>
</div>
</div>
</div>
</body>
</html>