<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Thanks Nat - this is really helpful.</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Do any of these considerations need to feed into the Read/Write Security Profile?</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Dave</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 24 March 2017 at 03:06, Nat Sakimura <span dir="ltr"><<a href="mailto:nat@sakimura.org" target="_blank">nat@sakimura.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
---<br>
Nat Sakimura<br>
Chairman, OpenID Foundation<br>
<br></span><span class="">
On 2017-03-24 07:48, Dave Tonge wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Hi Tom, Nat<br>
<br>
Thanks for the replies.<br>
<br>
Tom - as Nat said I fully expect the FI's to run their own checks, I'm<br>
just talking about kicking off the process. <br>
In Europe with PSD2 we have legislation that bank customers can use<br>
PISPs (payment initiation service providers) to initiate payments. <br>
<br>
Nat, thanks I didn't realise about the request object registration<br>
endpoint - it seems an excellent fit. The OIDC spec isn't particularly<br>
clear about it though,<br>
but <a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-12#section-10.3" rel="noreferrer" target="_blank">https://tools.ietf.org/htm<wbr>l/draft-ietf-oauth-jwsreq-12#<wbr>section-10.3</a><br></span>
[7] paragraph D explains it fully.<span class=""><br>
<br>
The 4 suggested endpoints look good, although I would maybe join 3 and<br>
4?<br>
</span></blockquote>
<br>
Possibly. But they are semantically different so it would be better<br>
to have separate endpoint from the REST principle, IMHO.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
I have a couple of follow up questions:<br>
<br>
1. Would you envisage passing the fine-grained payment details in the<br>
claims property of the request object?<br>
</blockquote>
<br></span>
Yes. The original intent of the signed request object was exactly this.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2. The "commit of intent" API I see as being an auth code flow.<br>
Essentially the resource owner is granting access to a very specific<br>
resource (a single payment transaction). However if we follow an auth<br>
code flow then we would expect to end up with an access token. That<br>
token could then be used to commit the intent. Does this make sense to<br>
you?<br>
</blockquote>
<br></span>
To me, the intent is committed once the user authorizes the transaction<br>
at the Authorization Endpoint. As the result, the AuthZ EP returns<br>
`code` and `id_token` (which actually is nothing but a detached signature<br>
for the response).<br>
<br>
The access token that you get using `code` is used for status check<br>
and to get the receipt, IMHO.<br>
<br>
Best,<br>
<br>
Nat<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<br>
Thanks again - I will feed this into the UK Open Banking group.<br>
I'm also working on the ability to share some of the proposed<br>
endpoints form that group with the FAPI WG.<br>
<br>
Thanks<br>
<br>
Dave<br>
<br>
<br>
<br>
On 23 March 2017 at 20:57, Nat Sakimura via Openid-specs-fapi<br>
<<a href="mailto:openid-specs-fapi@lists.openid.net" target="_blank">openid-specs-fapi@lists.openi<wbr>d.net</a>> wrote:<br>
<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi<br>
<br>
Just briefly on the point of the outbound access by the banks.<br>
<br>
Banks can provide request object registration endpoint that<br>
produces requiest_uri.<br>
This should solve the problem. In fact, this was one of the main<br>
use case.<br>
That's why the spec is saying "The request_uri value MUST be<br>
reachable by the Authorization Server, and SHOULD be reachable by<br>
the Client." in section 6.2 of the OpenID Connect Core.<br>
<br>
I do not think UMA has anything to do here.<br>
<br>
Also, I should note that any transfer/payment request is only<br>
request.<br>
After the request is being authorized by the user and committed,<br>
banks needs to screen it for AML purposes etc. So, having sufficient<br>
funds alone is not a sufficient condition for it to go through.<br>
Payment will not be synchronous.<br>
<br>
So, in general, form the API point of view,<br>
<br>
1. Creation of the intent (registering of the request object:<br>
request object endpoint)<br>
2. Commit of the intent (preferably done on a second channel:<br>
authorization endpoint and user questioning)<br>
3. Payment status check / callback / notification (status check<br>
endpoint)<br>
4. Getting Payment result / receipt (payment result endpoint)<br>
<br>
are needed.<br>
<br>
Also, in case of the money transfer, it often is required to have:<br>
<br>
0.1. Destination information verification endpoint<br>
0.2. Pre-registered destination account information endpoint<br>
<br>
I have a bit of documentation explaining what NRI as a backend<br>
service provider for banks does in Japan, but they are in<br>
Japanese...<br>
<br>
Best,<br>
<br>
---<br>
Nat Sakimura<br>
Chairman, OpenID Foundation<br>
<br>
On 2017-03-24 01:16, Dave Tonge via Openid-specs-fapi wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Dear FAPI WG Members<br>
<br>
When it comes to payments, standard OAuth scopes are too<br>
coarse-grained to <br>
be the sole communication of the "access" to be authorised. The<br>
most<br>
common scenario<br>
for payments via a FAPI API is likely to be one-off payments of a<br>
specific amount<br>
to a specific payee (and from a specific account at a specific<br>
time).<br>
<br>
If the FAPI spec doesn't address the communication of this data,<br>
there<br>
are likely<br>
to be multiple incompatible implementions.<br>
<br>
Proposals that I've come accross include having a "staging"<br>
endpoint<br>
where the <br>
client registers "intent" to perform an action by sending a<br>
payload<br>
with the <br>
specific payment details and receives a "ticket id". This ticket<br>
id is<br>
then <br>
included along with high level scopes in an authorization code<br>
flow.<br>
The <br>
ticket id could be included in the claims parameter: <br>
<br>
</blockquote>
<a href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" rel="noreferrer" target="_blank">http://openid.net/specs/openid<wbr>-connect-core-1_0.html#ClaimsP<wbr>arameter</a><br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
[1]<br>
[1] <br>
or could be part of the request object:<br>
<a href="http://openid.net/specs/openid-connect-core-1_0.html#JWTRequests" rel="noreferrer" target="_blank">http://openid.net/specs/openid<wbr>-connect-core-1_0.html#JWTRequ<wbr>ests</a><br></div></div>
[2] [2]<span class=""><br>
<br>
While it could be preferable to avoid having a separate staging<br>
endpoint - and <br>
put any extra data in a signed request object, the reality is<br>
that the<br>
request <br>
could be too large. While this could be solved by passing in a<br>
"request_uri" <br>
that points at a request object, this has issues as many banks<br>
currently have <br>
strict restrictions on outbound network access. Also it seems<br>
that<br>
the <br>
"request_uri" option would work best when the parameters in the<br>
request object <br>
are fairly static.<br>
<br>
What do FAPI members think about this problem?<br>
Are there existing standards that we could refer, for example it<br>
would<br>
seem <br>
that the UMA spec would help here?<br>
</span><a href="https://docs.kantarainitiative.org/uma/rec-uma-core.html" rel="noreferrer" target="_blank">https://docs.kantarainitiative<wbr>.org/uma/rec-uma-core.html</a> [3] [3]<span class=""><br>
<br>
Thanks<br>
<br>
Dave<br>
<br>
--<br>
<br>
Dave Tonge<br>
CTO<br>
[4]<br>
10 Temple Back, Bristol, BS1 6FLt: +44 (0)117 280 5120<br>
<br>
Moneyhub Enterprise is a trading style of Momentum Financial<br>
Technology Limited which is authorised and regulated by the<br>
Financial<br>
Conduct Authority ("FCA"). Momentum Financial Technology is<br>
entered<br>
on the Financial Services Register (FRN 561538) at<br>
</span><a href="http://fca.org.uk/register" rel="noreferrer" target="_blank">fca.org.uk/register</a> [4] [5]. Momentum Financial Technology is<span class=""><br>
registered<br>
in England & Wales, company registration<br>
number 06909772 © . Momentum Financial Technology Limited<br>
2016. DISCLAIMER: This email (including any attachments) is<br>
subject<br>
to copyright, and the information in it is confidential. Use of<br>
this<br>
email or of any information in it other than by the addressee is<br>
unauthorised and unlawful. Whilst reasonable efforts are made to<br>
ensure that any attachments are virus-free, it is the recipient's<br>
sole<br>
responsibility to scan all attachments for viruses. All calls and<br>
emails to and from this company may be monitored and recorded for<br>
legitimate purposes relating to this company's business. Any<br>
opinions<br>
expressed in this email (or in any attachments) are those of the<br>
author and do not necessarily represent the opinions of Momentum<br>
Financial Technology Limited or of any other group company.<br>
<br>
Links:<br>
------<br>
[1]<br>
<br>
</span></blockquote>
<a href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" rel="noreferrer" target="_blank">http://openid.net/specs/openid<wbr>-connect-core-1_0.html#ClaimsP<wbr>arameter</a><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[1]<br>
[2]<br>
<a href="http://openid.net/specs/openid-connect-core-1_0.html#JWTRequests" rel="noreferrer" target="_blank">http://openid.net/specs/openid<wbr>-connect-core-1_0.html#JWTRequ<wbr>ests</a><br>
[2]<br>
[3] <a href="https://docs.kantarainitiative.org/uma/rec-uma-core.html" rel="noreferrer" target="_blank">https://docs.kantarainitiative<wbr>.org/uma/rec-uma-core.html</a> [3]<br>
[4]<br>
<br>
</blockquote>
<br>
</blockquote><span class="">
<a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" rel="noreferrer" target="_blank">http://www.google.com/url?q=ht<wbr>tp%3A%2F%2Fmoneyhubenterprise.<wbr>com%2F&sa=D&sntz=1&<wbr>amp;usg=AFQjCNGUnR5opJv5S1uZOV<wbr>g8aISwPKAv3A</a><br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[5]<br>
[5] <a href="http://fca.org.uk/register" rel="noreferrer" target="_blank">http://fca.org.uk/register</a> [4]<span class=""><br>
<br>
______________________________<wbr>_________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid<wbr>.net</a><br>
</span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer" target="_blank">http://lists.openid.net/mailma<wbr>n/listinfo/openid-specs-fapi</a> [6]<br>
</blockquote><span class="">
<br>
______________________________<wbr>_________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid<wbr>.net</a><br>
</span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer" target="_blank">http://lists.openid.net/mailma<wbr>n/listinfo/openid-specs-fapi</a> [6]<br>
</blockquote>
<br>
--<br>
<br>
Dave Tonge<br>
CTO<br>
[8]<span class=""><br>
10 Temple Back, Bristol, BS1 6FLt: +44 (0)117 280 5120<br>
<br>
Moneyhub Enterprise is a trading style of Momentum Financial<br>
Technology Limited which is authorised and regulated by the Financial<br>
Conduct Authority ("FCA"). Momentum Financial Technology is entered<br>
on the Financial Services Register (FRN 561538) at<br>
</span><a href="http://fca.org.uk/register" rel="noreferrer" target="_blank">fca.org.uk/register</a> [4]. Momentum Financial Technology is registered<span class=""><br>
in England & Wales, company registration<br>
number 06909772 © . Momentum Financial Technology Limited<br>
2016. DISCLAIMER: This email (including any attachments) is subject<br>
to copyright, and the information in it is confidential. Use of this<br>
email or of any information in it other than by the addressee is<br>
unauthorised and unlawful. Whilst reasonable efforts are made to<br>
ensure that any attachments are virus-free, it is the recipient's sole<br>
responsibility to scan all attachments for viruses. All calls and<br>
emails to and from this company may be monitored and recorded for<br>
legitimate purposes relating to this company's business. Any opinions<br>
expressed in this email (or in any attachments) are those of the<br>
author and do not necessarily represent the opinions of Momentum<br>
Financial Technology Limited or of any other group company.<br>
<br>
Links:<br>
------<br>
[1] <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" rel="noreferrer" target="_blank">http://openid.net/specs/openid<wbr>-connect-core-1_0.html#ClaimsP<wbr>arameter</a><br>
[2] <a href="http://openid.net/specs/openid-connect-core-1_0.html#JWTRequests" rel="noreferrer" target="_blank">http://openid.net/specs/openid<wbr>-connect-core-1_0.html#JWTRequ<wbr>ests</a><br>
[3] <a href="https://docs.kantarainitiative.org/uma/rec-uma-core.html" rel="noreferrer" target="_blank">https://docs.kantarainitiative<wbr>.org/uma/rec-uma-core.html</a><br></span>
[4] <a href="http://fca.org.uk/register" rel="noreferrer" target="_blank">http://fca.org.uk/register</a><br>
[5]<br>
<a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" rel="noreferrer" target="_blank">http://www.google.com/url?q=ht<wbr>tp%3A%2F%2Fmoneyhubenterprise.<wbr>com%2F&amp;sa=D&amp;<wbr>sntz=1&amp;usg=AFQjCNGUnR5<wbr>opJv5S1uZOVg8aISwPKAv3A</a><br>
[6] <a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer" target="_blank">http://lists.openid.net/mailma<wbr>n/listinfo/openid-specs-fapi</a><br>
[7] <a href="https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-12#section-10.3" rel="noreferrer" target="_blank">https://tools.ietf.org/html/dr<wbr>aft-ietf-oauth-jwsreq-12#secti<wbr>on-10.3</a><br>
[8]<span class=""><br>
<a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" rel="noreferrer" target="_blank">http://www.google.com/url?q=ht<wbr>tp%3A%2F%2Fmoneyhubenterprise.<wbr>com%2F&sa=D&sntz=1&<wbr>amp;usg=AFQjCNGUnR5opJv5S1uZOV<wbr>g8aISwPKAv3A</a><br>
</span></blockquote>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-size:1em;font-weight:bold;line-height:1.4"><div style="color:rgb(97,97,97);font-family:'Open Sans';font-size:14px;font-weight:normal;line-height:21px"><div style="font-family:Arial,Helvetica,sans-serif;font-size:0.925em;line-height:1.4;color:rgb(220,41,30);font-weight:bold"><div style="font-size:14px;font-weight:normal;color:rgb(51,51,51);font-family:lato,"open sans",arial,sans-serif;line-height:normal"><div style="color:rgb(0,164,183);font-weight:bold;font-size:1em;line-height:1.4">Dave Tonge</div><div style="font-size:0.8125em;line-height:1.4">CTO</div><div style="font-size:0.8125em;line-height:1.4;margin:0px"><a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" style="color:rgb(131,94,165);text-decoration:none" target="_blank"><img alt="Moneyhub Enterprise" height="50" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png" title="Moneyhub Enterprise" width="200" style="border:none;padding:0px;border-radius:2px;margin:7px"></a></div><div style="padding:8px 0px"><span style="color:rgb(0,164,183);font-size:11px;background-color:transparent">10 Temple Back, Bristol, BS1 6FL</span></div><span style="font-size:11px;line-height:15.925px;color:rgb(0,164,183);font-weight:bold">t: </span><span style="font-size:11px;line-height:15.925px">+44 (0)117 280 5120</span><br></div><div style="color:rgb(97,97,97);font-size:14px;font-weight:normal;font-family:lato,"open sans",arial,sans-serif"><font color="#00a4b7"><span style="font-size:11px;line-height:15.925px"><br></span></font><div style="color:rgb(51,51,51);line-height:1.4"><span style="font-size:0.75em">Moneyhub Enterprise is a trading style of Momentum Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Momentum Financial Technology is entered on the Financial Services Register </span><span style="font-size:0.75em;background-color:transparent">(FRN </span><span style="font-size:0.75em;background-color:transparent;color:rgb(0,164,183);font-weight:bold">561538</span><span style="font-size:0.75em;background-color:transparent">) at <a href="http://fca.org.uk/register" target="_blank">fca.org.uk/register</a>. Momentum Financial Technology is registered in England & Wales, company registration number </span><span style="font-size:0.75em;color:rgb(0,164,183);font-weight:bold;background-color:transparent">06909772</span><span style="font-size:0.75em;background-color:transparent"> </span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;background-color:transparent"><font size="1">©</font></span><span style="font-size:0.75em;background-color:transparent"> . </span><span style="background-color:transparent;font-size:0.75em">Momentum Financial Technology Limited 2016. </span><span style="background-color:transparent;font-size:0.75em;color:rgb(136,136,136)">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Limited or of any other group company.</span></div></div></div></div></div></div></div></div></div></div></div>
</div>