<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">SIOP Special Topic Call Notes 7-Jul-22<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kristina Yasuda<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">David Chadwick<o:p></o:p></p>
<p class="MsoNormal">Joseph Heenan<o:p></o:p></p>
<p class="MsoNormal">Dmitri Zagidulin<o:p></o:p></p>
<p class="MsoNormal">Andrew Hughes<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal">Bjorn Hjelm<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">IETF 114 is soon<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Pull Requests<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/pull-requests/">
https://bitbucket.org/openid/connect/pull-requests/</a><o:p></o:p></p>
<p class="MsoNormal"> PR #228: Restructuring OpenID4VCI spec to improve readability prior to the Implementer's Draft call<o:p></o:p></p>
<p class="MsoNormal"> We agreed to merge this after Torsten or Tobias approve<o:p></o:p></p>
<p class="MsoNormal"> PR #225: adding format identifiers for 23220-4<o:p></o:p></p>
<p class="MsoNormal"> This will be merged after confirming that it matches the ISO spec<o:p></o:p></p>
<p class="MsoNormal"> PR #229: corrected the OP Metadata JSON<o:p></o:p></p>
<p class="MsoNormal"> David talked about the difference between types and schemas<o:p></o:p></p>
<p class="MsoNormal"> He said that you can't assume what the schema is from the type<o:p></o:p></p>
<p class="MsoNormal"> David suggested working through an example with multiple types of credentials<o:p></o:p></p>
<p class="MsoNormal"> PR #227: changed parameter name from registration to client metadata<o:p></o:p></p>
<p class="MsoNormal"> Kristina discussed semantics for ephemeral clients<o:p></o:p></p>
<p class="MsoNormal"> We discussed how to handle new metadata for a client that is already registered<o:p></o:p></p>
<p class="MsoNormal"> We think that an error should be thrown in this case, since it's an attack vector<o:p></o:p></p>
<p class="MsoNormal"> This would be the case if both a client_id and client_metadata parameters are present<o:p></o:p></p>
<p class="MsoNormal"> Kristina said that the client_id parameter would be meaningless for ephemeral client<o:p></o:p></p>
<p class="MsoNormal"> This is signalled by having client_id=redirect_uri<o:p></o:p></p>
<p class="MsoNormal"> Brian wondered if the lack of a client_id would indicate this<o:p></o:p></p>
<p class="MsoNormal"> Kristina said that client_id is a mandatory parameter<o:p></o:p></p>
<p class="MsoNormal"> Kristina said that in SIOPv2, you can use dynamic client registration or out-of-band registration<o:p></o:p></p>
<p class="MsoNormal"> George said that if a client_id already exists, it's an error to attempt to provide new registration information<o:p></o:p></p>
<p class="MsoNormal"> Mike also agreed that this should be an error<o:p></o:p></p>
<p class="MsoNormal"> George said that throwing an error is testable<o:p></o:p></p>
<p class="MsoNormal"> Mike suggested that we merge this, continuing to throw an error when the extra client_metadata parameter is present<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Issues<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><o:p></o:p></p>
<p class="MsoNormal"> #1538: Clarify valid response_type values<o:p></o:p></p>
<p class="MsoNormal"> Travis Spencer asked whether we want to define and allow composite response types including vp_token<o:p></o:p></p>
<p class="MsoNormal"> Mike said that we don't want to enable a combinatorial explosion of new response_type values<o:p></o:p></p>
<p class="MsoNormal"> #1544: Requesting multiple credentials<o:p></o:p></p>
<p class="MsoNormal"> David asked whether one can receive multiple credentials in a single credential request<o:p></o:p></p>
<p class="MsoNormal"> Kristina said that the intent is to receive a single credential per request<o:p></o:p></p>
<p class="MsoNormal"> There is a single proof<o:p></o:p></p>
<p class="MsoNormal"> David said that sometimes the text seems to imply that multiple credentials can be returned<o:p></o:p></p>
<p class="MsoNormal"> Mike made an analogy to OAuth - where we've consistently refused requests to be able to return multiple access tokens with different scopes<o:p></o:p></p>
<p class="MsoNormal"> George agreed with that analogy<o:p></o:p></p>
<p class="MsoNormal"> Joseph said that handling error cases would certainly be more complicated if multiple credentials are possible<o:p></o:p></p>
<p class="MsoNormal"> Mike asked David to create a PR rooting out cases where there seems to be ambiguity<o:p></o:p></p>
<p class="MsoNormal"> George suggested that we deploy the simple case and then determine whether deployments are asking for the more complicated case<o:p></o:p></p>
<p class="MsoNormal"> David said that they have implemented multiple returns and partial returns<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next call will be on Monday, July 11, 2022 at 4pm Pacific Time<o:p></o:p></p>
</div>
</body>
</html>