<div dir="ltr">Axel,<div>As noted, Dima has created a draft intended for IETF on purpose based on the discussions in the eKYC-IDA working group. Until introduced, we don't know the feedback from the IETF community on this proposal but it's my understanding that this isn't the first time this topic has been discussed within IETF. There's also a similar discussion about purpose taking place in the DPC working group worth noting that may impact the approach of a technical specification. </div><div><br></div><div>As Dima is traveling, I believe he'll add some additional details and insight to this e-mail thread.</div><div><br></div><div>Finally, I would highly encourage CAMARA to take issue to the OpenID Foundation when it relates to parameter usage (as mentioned about tweaking purpose into scopes) to ensure that the OpenID Connect specifications and profiles are utilized in accordance to its purpose and that the Foundation has offered up the wealth of knowledge that exists within the Foundation to assist CAMARA.</div><div><br></div><div>Kind Regards,</div><div>Bjorn</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 22, 2024 at 3:35 AM Axel.Nennker--- via Openid-specs-ekyc-ida <<a href="mailto:openid-specs-ekyc-ida@lists.openid.net">openid-specs-ekyc-ida@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg7282944508102710161">
<div lang="en-DE" style="overflow-wrap: break-word;">
<div class="m_-7652632874756110631WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">Hi,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">in <a href="https://github.com/camaraproject/IdentityAndConsentManagement/" target="_blank">
Camara</a> there is agreement that we need something like the purpose parameter that was removed from ekyc-ida with this issue.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11pt"><a href="https://bitbucket.org/openid/ekyc-ida/issues/1386/move-transaction-specific-purpose-out-of" target="_blank"><span lang="EN-US">https://bitbucket.org/openid/ekyc-ida/issues/1386/move-transaction-specific-purpose-out-of</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">We referenced the section from the ekyc-ida spec on the purpose parameter and wanted to use it.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt"><a href="https://github.com/AxelNennker/IdentityAndConsentManagement/blob/camara_oidc_profile/documentation/CAMARA-Security-Interoperability.md#purpose" target="_blank">https://github.com/AxelNennker/IdentityAndConsentManagement/blob/camara_oidc_profile/documentation/CAMARA-Security-Interoperability.md#purpose</a><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt"><u></u> <u></u></span></p>
<h2>Purpose<u></u><u></u></h2>
<p>A transaction specific request parameter purpose as specified in <a href="https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html#name-transaction-specific-purpos" target="_blank">
openid-connect-4-identity-assurance-1_0-13</a> MUST be used to allow a SP to state the purpose for the transfer of End-User data it is asking for. The purpose string MUST use below format for interoperability<u></u><u></u></p>
<p><code><span style="font-size:10pt">dpv:<dpvValue></span></code><u></u><u></u></p>
<p><code><span style="font-size:10pt"><dpvValue></span></code> is coming from <a href="https://w3c.github.io/dpv/dpv/#vocab-purpose" target="_blank">
W3C DPV purpose definition</a><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">Then, later, we discovered that ekyc-ida removed that parameter definition from the ekyc-ida protocol, bummer.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">We found that <a id="m_-7652632874756110631OWAAMF8D59EE6245B57489DB23AC2C8456186" href="mailto:dima@postnikov.net" target="_blank">
<span style="font-family:Aptos,sans-serif;text-decoration:none">@dima@postnikov.net</span></a> started writing a new Internet Draft for "purpose" in Oauth2.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><a href="https://cdn.connectid.com.au/specifications/oauth2-purpose-01.html#name-transaction-specific-purpos" target="_blank">https://cdn.connectid.com.au/specifications/oauth2-purpose-01.html#name-transaction-specific-purpos</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Deutsche Telekom would support that draft. Other Camara member as well, probably.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">We, DT, are willing to contribute to the new draft.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">In Camara we envisioned that the value of the purpose parameter is ONE from the W3C DPV purpose definition.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">We think that the value should not be a string provided by the client but from a fixed list an that the AZ then shows the end user a text that matches the user's and the AZ/RP's legislation/jurisdiction for
that purpose.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">An end user might give their consent to a location-service for the purpose of account takeover protection but not for some other purpose.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">A mobile banking app might ask for consent for a location-service, that helps the user find the nearest ATM, but the user does give their consent for this convenience function.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">A mobile banking app might ask for consent for a location-service, that validates that the user's mobile phone is in the vincinity of the ATM the user is withdrawing money from – and the end user is willing
to get that protection.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Or the client might have a <a href="https://w3c.github.io/dpv/dpv/#LegitimateInterest" target="_blank">
legitimate-interest</a> in using some API like location-service or sim-swap.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">The removed ekyc-ida purpose parameter sounds like the CIBA binding_message parameter.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><a href="https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#auth_request" target="_blank">https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#auth_request</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Camara also discussed tweaking purpose into scopes, but that did not turn out well. Mainly, I think, because technical scopes have very little relationship with legislation/jurisdiction.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Could you please provide some context on why ekyc-ida removed the purpose parameter?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">And, is there initial feedback from IETF Oauth2 WG on the new draft?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Kind regards<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Axel<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
</div>
-- <br>
Openid-specs-ekyc-ida mailing list<br>
<a href="mailto:Openid-specs-ekyc-ida@lists.openid.net" target="_blank">Openid-specs-ekyc-ida@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ekyc-ida" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ekyc-ida</a><br>
</div></blockquote></div><br clear="all"><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Kind Regards,<div>Bjorn</div></div></div>