<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi,<div><br></div><div>We briefly discussed the Native SSO for Mobile Apps specification today as part of the OpenID Connect working group call. The vote for 2nd implementors draft completed successfully so this email is about where we go from here.</div><div><br></div><div>One objection was raised, during the working group call, to moving the spec forward (more details in the minutes of today’s meeting) and if I understand the objection correctly, it applies to the entire concept of the spec not just a specific implementation aspect of it. In other words, the objector doesn’t believe that the OpenID Foundation should publish any document in this area. I appreciate the forthrightness and clarity of the objection.</div><div><br></div><div>On the other hand, multiple IDP SaaS vendors and relying parties have found the specification useful and have implemented it. </div><div><br></div><div>So, I’d appreciate feedback on next steps. I see a couple of options.</div><div>1. Take the current 2nd implementors draft to final</div><div>2. Work on significant updates to the current draft changing the way it leverages id_tokens and potentially adding sender-constrained aspects to the protocol. This would be a breaking change to the current spec.</div><div>3. Discard the specification completely</div><div><br></div><div>Personally, albeit I’m biased, and given that multiple parties have implemented the specification, I believe it has value for our industry. Being passed as a specification does not require any IDP or vendor to implement the spec but it does provide at least one way to provide this functionality. There may be other and better ways of doing so but none have been brought forward and I believe that helping developers do something sound is important (rather than the foundation being silent).</div><div><br></div><div>Therefore, my proposal is to tackle option 2 if there is sufficient interest from the community to do the work. Otherwise, my proposal will lean toward option 1.</div><div><br></div><div>Thanks,</div><div><br><div>
<div>George Fletcher</div><div>Identity Standards Architect</div><div>Practical Identity LLC</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br></div></body></html>