<html><head></head><body><div dir="auto">Hi Joseph, <br><br></div>
<div dir="auto">Re: JPoP<br><br></div>
<div dir="auto">JPoP was hastely done in a hurry to meet the IETF cut off so I am pretty sure that there are bunch of things that needs to be fixed for clarity and consistency. You can send your comments to the IETF OAuth list. It would also be great if you can file them at <br></div>
<div dir="auto"><a href="https://bitbucket.org/Nat/oauth-rjwtprof/issues?status=new&status=open">https://bitbucket.org/Nat/oauth-rjwtprof/issues?status=new&status=open</a> . <br><br></div>
<div dir="auto">You can also create a pull request there. <br><br></div>
<div dir="auto">For FAPI list, I needed to unmoderate you and did so presently. <br><br></div>
<div dir="auto">Best, <br><br></div>
<div dir="auto">Nat <br></div>
<div dir="auto"> </div>
<div class="gmail_quote" >On Mar 22, 2017, at 1:03 AM, Joseph Heenan <<a href="mailto:joseph@authlete.com" target="_blank">joseph@authlete.com</a>> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="blue">Hi Nat,<br><br>Thanks<br><br>Some things I would perhaps like to mention:<br><br>1) I wasn't sure how to comment on the jpop RFC? I guess it's not part of this WG so opening an issue in the FAPI bitbucket would be inappropriate?<br><br>2) On the RFC, I didn't find the explanation of nonces in 6.2 very clear - for example, "the value being what was received in the previous step" I'm not sure which previous step is being referred to; I think it might mean step 1 but step 1 didn't involve receiving a nonce. Compared to (say) RFC 7616 there's not very much discussion about the nonce, and I'm not sure if there's both a client generated and a server generated nonce.<br><br>3) I don't seem to be able to post to the FAPI list - the message I sent last week apparently never arrived (and I think someone else, I forget who - apologies, mentioned at the end of last week's call that they'd sent a message to the mailing list, which also never appeared, so I suspect I may not be the only one).<br><br>Thanks<br><br>Joseph<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> On 21 Mar 2017, at 08:15, Nat Sakimura via Openid-specs-fapi <openid-specs-fapi@lists.openid.net> wrote:<br> <br> Hi<br> <br> Here is the proposed agenda for March 20 call.<br> <br> Best,<br> <br> Nat<br> <br> <br><hr><br> FAPI WG Meeting Agenda (2017-03-20)<br><hr><br> Date & Time: 2017-03-20 23:00 UTC<br> Location: GoToMeeting <a href="https://global.gotomeeting.com/join/321819862">https://global.gotomeeting.com/join/321819862</a><br> <br> 1. Roll Call<br> 2. Adoption of the Agenda (Dave)<br> 3. Drafts<br> 3.1. Part 1: Read Only API Security Profile<br> 3.1.1. Issue 76 - Can vs May<br> 3.2. Part 2: Read & Write API Security Profile<br> 3.2.1. PoP other than Token Binding - <a href="https://tools.ietf.org/html/draft-sakimura-oauth-jpop-01">https://tools.ietf.org/html/draft-sakimura-oauth-jpop-01</a><br> 3.2.2. Other issues in Bitbucket<br> 3.3. Part 3: Open Data API<br> 3.4. Part 4: Protected Data API and Schema - Read only<br> 3.5. Part 5: Protected Data API and Schema - Read and Write<br> 4. External Orgs<br> 4.1. UK OBS (Dave, John)<br> 4.2. Others<br> 5. AOB<br> 5.1. Next Call (Atlantic)<br> <br> -- <br> Nat Sakimura<br> Chairman, OpenID Foundation<br><hr><br> Openid-specs-fapi mailing list<br> Openid-specs-fapi@lists.openid.net<br> <a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><br></blockquote><br></pre></blockquote></div></body></html>