<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Spec Call Notes 25-Aug-22<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">David Chadwick<o:p></o:p></p>
<p class="MsoNormal">Brian Campbell<o:p></o:p></p>
<p class="MsoNormal">Rifaat Shekh-Yusef<o:p></o:p></p>
<p class="MsoNormal">George Fletcher<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">WGLC for Unmet Authentication Requirements specification<o:p></o:p></p>
<p class="MsoNormal"> Completed today<o:p></o:p></p>
<p class="MsoNormal"> No comments received<o:p></o:p></p>
<p class="MsoNormal"> Mike will start the review for Final status<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Vote for Proposed Final OpenID Connect Logout Specifications is underway<o:p></o:p></p>
<p class="MsoNormal"> Please participate at <a href="https://openid.net/foundation/members/polls/276">
https://openid.net/foundation/members/polls/276</a><o:p></o:p></p>
<p class="MsoNormal"> The vote closes on Monday<o:p></o:p></p>
<p class="MsoNormal"> You can join at <a href="https://openid.net/foundation/members/registration">
https://openid.net/foundation/members/registration</a> if you're not already a member<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Pull Requests<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/pull-requests/">
https://bitbucket.org/openid/connect/pull-requests/</a><o:p></o:p></p>
<p class="MsoNormal"> PR #301: Described when signed request requirement could be relaxed<o:p></o:p></p>
<p class="MsoNormal"> Related to <a href="https://bitbucket.org/openid/connect/issues/1606/relax-behaviour-around-automatic-client">
https://bitbucket.org/openid/connect/issues/1606/relax-behaviour-around-automatic-client</a><o:p></o:p></p>
<p class="MsoNormal"> Please review<o:p></o:p></p>
<p class="MsoNormal"> PR #255: Determining if one party may be able to trust a second party.<o:p></o:p></p>
<p class="MsoNormal"> Related to <a href="https://bitbucket.org/openid/connect/issues/1551/">
https://bitbucket.org/openid/connect/issues/1551/</a><o:p></o:p></p>
<p class="MsoNormal"> David Chadwick said that this PR also generalizes functionality, like the previous one<o:p></o:p></p>
<p class="MsoNormal"> David has made some clarifications in the PR<o:p></o:p></p>
<p class="MsoNormal"> He's waiting for terminology feedback from those requesting it<o:p></o:p></p>
<p class="MsoNormal"> PR #243: Ordering claims in OP Metadata (Issue #1593)<o:p></o:p></p>
<p class="MsoNormal"> Kristina requested changes<o:p></o:p></p>
<p class="MsoNormal"> David asked whether the ordering is related to the format or the display<o:p></o:p></p>
<p class="MsoNormal"> George asked why ordering matters in the protocol<o:p></o:p></p>
<p class="MsoNormal"> David said that some customers have asked for ordering<o:p></o:p></p>
<p class="MsoNormal"> He said that there's a requirement from the issuer to display them in the same order as shown in the paper document<o:p></o:p></p>
<p class="MsoNormal"> George said that he's still struggling with that<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">prompt=create Specification<o:p></o:p></p>
<p class="MsoNormal"> George updated us on the status<o:p></o:p></p>
<p class="MsoNormal"> Needs a full read - possibly adding acknowledgements<o:p></o:p></p>
<p class="MsoNormal"> Ready for working group last call<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Native SSO for Mobile Apps Specification<o:p></o:p></p>
<p class="MsoNormal"> George updated us on the status<o:p></o:p></p>
<p class="MsoNormal"> He said that Okta is using it in an unanticipated way<o:p></o:p></p>
<p class="MsoNormal"> We should discuss how they're using it<o:p></o:p></p>
<p class="MsoNormal"> George will reach out to Aaron and Vittorio<o:p></o:p></p>
<p class="MsoNormal"> Ready to go to Implementer's Draft<o:p></o:p></p>
<p class="MsoNormal"> We agreed to give people two weeks to review - then we'll start the Implementer's Draft review<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">JARM (FAPI WG Specification)<o:p></o:p></p>
<p class="MsoNormal"> In review for Final status<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://openid.net/2022/08/27/public-review-period-for-proposed-final-jwt-secured-authorization-response-mode-for-oauth-2-0-jarm-specification/">
https://openid.net/2022/08/27/public-review-period-for-proposed-final-jwt-secured-authorization-response-mode-for-oauth-2-0-jarm-specification/</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Pull Requests<o:p></o:p></p>
<p class="MsoNormal"> PR #299: Add Error Codes<o:p></o:p></p>
<p class="MsoNormal"> Reviews requested<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Issues<o:p></o:p></p>
<p class="MsoNormal"> <a href="https://bitbucket.org/openid/connect/issues?status=new&status=open">
https://bitbucket.org/openid/connect/issues?status=new&status=open</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://bitbucket.org/openid/connect/issues/1632/issuer-metadata-clarification-needed">https://bitbucket.org/openid/connect/issues/1632/issuer-metadata-clarification-needed</a><o:p></o:p></p>
<p class="MsoNormal"> Mike said that letting the different servers have their own metadata is the most straightforward path<o:p></o:p></p>
<p class="MsoNormal"> Brian said that there is a legitimate question about the lifetime of the things we've signed and keys<o:p></o:p></p>
<p class="MsoNormal"> Different things likely need to be signed with keys with different properties<o:p></o:p></p>
<p class="MsoNormal"> Brian said that registering a new "use" value would not be the right thing to do<o:p></o:p></p>
<p class="MsoNormal"> David agreed that there should be two metadata files - each pointing to their own keys<o:p></o:p></p>
<p class="MsoNormal"> George agreed<o:p></o:p></p>
<p class="MsoNormal"> David asked which one to pass to the wallet to kick things off<o:p></o:p></p>
<p class="MsoNormal"> He'll add that context to the issue<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next Call<o:p></o:p></p>
<p class="MsoNormal"> The next call is the SIOP Special Topic call immediately following this one<o:p></o:p></p>
</div>
</body>
</html>