<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">In the CIBA case the request object is sent in the back channel via a direct connection. <div class=""><br class=""></div><div class="">If it can be stolen and reused then so can all the other authentication methods and so can the authentication for the token endpoint.</div><div class=""><br class=""></div><div class="">Is there something specific that you are thinking of that might cause the request object to leak?</div><div class=""><br class=""></div><div class="">It could be a POP request object presented over MTLS but I suspect that might be overkill in most cases.</div><div class=""><br class=""></div><div class="">We do have existing requirements <a href="http://openid.net/specs/openid-connect-core-1_0.html#RequestObject" class="">http://openid.net/specs/openid-connect-core-1_0.html#RequestObject</a></div><div class=""><br class=""></div><div class="">The audience requirement is inherited from the general request. </div><div class=""><br class=""></div><div class="">I could see adding a JTI to allow the IdP to do replay protection if required.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 6, 2017, at 11:36 AM, <a href="mailto:Axel.Nennker@telekom.de" class="">Axel.Nennker@telekom.de</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Thanks, Dave.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Please see<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://bitbucket.org/openid/mobile/commits/f7fd8bed04dcb6b74437f7ced0d34061ac69afd4" style="color: purple; text-decoration: underline;" class=""><span lang="EN-US" class="">https://bitbucket.org/openid/mobile/commits/f7fd8bed04dcb6b74437f7ced0d34061ac69afd4</span></a></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><span class="Apple-converted-space"> </span>for a text change to authentication.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Latest version is (as always):<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.3.1" style="color: purple; text-decoration: underline;" class="">https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.3.1</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Although thinking longer about the signed request object I think that it could be stolen and reused. So we probably need to add additional requirement on it like “freshness” and “aud == OP” and …<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">//Axel<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Dave Tonge [<a href="mailto:dave.tonge@momentumft.co.uk" style="color: purple; text-decoration: underline;" class="">mailto:dave.tonge@momentumft.co.uk</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Dienstag, 30. Mai 2017 12:18<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Nennker, Axel <<a href="mailto:Axel.Nennker@telekom.de" style="color: purple; text-decoration: underline;" class="">Axel.Nennker@telekom.de</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Openid-specs Fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" style="color: purple; text-decoration: underline;" class="">openid-specs-fapi@lists.openid.net</a>>;<span class="Apple-converted-space"> </span><a href="mailto:openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline;" class="">openid-specs-mobile-profile@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-fapi] Initial review of MODRNA Client initiated Backchannel Authentication Flow 1.0<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">Hi Axel<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">Thanks for the email.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">Signed Request Object</span></b><span style="font-family: 'Trebuchet MS', sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">I'm glad for the change to recommend "Signed Request Object" although the current draft could be confusing for implementers, for example:<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""><o:p class=""> </o:p></span></div></div><blockquote style="border-style: none none none solid; border-left-width: 1pt; border-left-color: rgb(204, 204, 204); padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">The Client MUST authenticate to the Backchannel Authentication Endpoint using the authentication method registered for its client_id, as described in Section 9 of [OpenID.Core]. The RECOMMENDED method to authenticate the Client is using an OpenID Connect Signed Request Object as described in OpenID.Core.</span><o:p class=""></o:p></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">Section 9 of OIDC describes client authentication methods for the token endpoints (e.g client_secret_basic, client_secret_post, client_secret_jwt & private_key_jwt) - however it seems that the CIBA spec is recommending simply sending a signed request object without using any of these 4 methods. I think this is fine and we are taking a similar approach in FAPI when defining the<span class="Apple-converted-space"> </span><a href="https://bitbucket.org/openid/fapi/src/53d8de443d6727ea547fef173ee532858c183e14/Financial_API_WD_002.md?at=master&fileviewer=file-view-default#markdown-header-72-request" style="color: purple; text-decoration: underline;" class="">request object endpoint</a>. However, I think the current CIBA draft is confusing. Essentially we are defining a 5th method for client authentication - sending a signed request object</span>. It should be clear in both drafts that sending a signed request object is the recommended method and can (should?) be used instead of the client authentication methods described in section 9 of OIDC.<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class="">Binding Message</b><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Thanks for the explanation, I'm glad I've understood the use case.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">PSD2 requires Strong Customer Authentication (i.e. multi-factor), but it has been established that this can be performed on a single device (e.g. a smartphone). PSD2 also requires dynamic linking - that is an "authentication code" (PSD2 term) is bound to a specific amount and a specific payee; however it doesn't need to be bound to a specific transaction. I think you are right that the format of the binding message is in the competitive space, however, I would like to explore whether there is a requirement for the spec to support requiring the user to enter a binding message or code. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I agree with you that the binding message is to support the user, however, when it comes to payments, legislation shifts some of that liability from the user to the payment processor. If fraud occurred because a user didn't bother to compare binding messages it would be hard for a bank to push that liability to the user. Therefore to get this spec adopted by banks and the like, we may need to provide the functionality to require a user to enter some sort of binding code - perhaps this is different from the binding message.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I'd be interested in Nat and John's view on this though.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Thanks <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Dave<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On 26 May 2017 at 14:21, <<a href="mailto:Axel.Nennker@telekom.de" target="_blank" style="color: purple; text-decoration: underline;" class="">Axel.Nennker@telekom.de</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-width: 1pt; border-left-color: rgb(204, 204, 204); padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: 0cm;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi Dave,</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">thanks for the review!</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The latest editor version in HTML of CIBA is always at this location:</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default" target="_blank" style="color: purple; text-decoration: underline;" class="">https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The raw xml2rfc version is here:<span class="Apple-converted-space"> </span><a href="https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml" target="_blank" style="color: purple; text-decoration: underline;" class="">https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I created an issue regarding the Terminology Consumption Device:</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://bitbucket.org/openid/mobile/issues/53/ciba-terminology-consumption-device" target="_blank" style="color: purple; text-decoration: underline;" class="">https://bitbucket.org/openid/mobile/issues/53/ciba-terminology-consumption-device</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Typo fixed by<span class="Apple-converted-space"> </span><a href="https://bitbucket.org/openid/mobile/commits/be7ab6b50447b82dd7d77f4fc2044c101be44069" target="_blank" style="color: purple; text-decoration: underline;" class="">https://bitbucket.org/openid/mobile/commits/be7ab6b50447b82dd7d77f4fc2044c101be44069</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Regarding Client Authentication:</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I see CIBA as a generic spec introducing back-channel to MODRNA Authentication or OIDC.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">So FAPI should reference CIBA if back-channel is used in FAPI AND profile CIBA to FAPI’s higher security needs</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">e.g. by restricting the Client Authentication Methods.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">We currently RECOMMEND a signed request object for request authentication while prohibiting alg=none.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.3.1" target="_blank" style="color: purple; text-decoration: underline;" class="">https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.3.1</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The rationale is this: OAuth2 was specified as a simple authorization framework with client_id and client_secret as a simple form of client authentication.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">This was because developers and admins never managed to get the Liberty Alliance implementation right.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">So CIBA allows client_id and client_secret but use cases for Banks and PSPs need better security and should profile CIBA for better Client Authentication.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://openid.net/specs/openid-connect-core-1_0.html#NeedForSignedRequests" target="_blank" style="color: purple; text-decoration: underline;" class="">https://openid.net/specs/openid-connect-core-1_0.html#NeedForSignedRequests</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Binding_message: Binding_message was introduced in<span class="Apple-converted-space"> </span><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/openid-connect-modrna-authentication-1_0.xml?at=default#rfc.section.7" target="_blank" style="color: purple; text-decoration: underline;" class="">MODRNA Authentication</a><span class="Apple-converted-space"> </span>. Protects the user not the RP.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">If you want it to be MANDATORY for payments then please profile MODRNA Authentication and CIBA and specify FAPI.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">CIBA does not talk much about binding_message and binding_message potential use cases because CIBA is a quite generic protocol for back-channel authentication.<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.4" target="_blank" style="color: purple; text-decoration: underline;" class="">https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.4</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Payment and handling of binding_messages is out-of-scope for CIBA. If CIBA is used for payment transaction authorization then there probably should be a contract between the OP and the PSP specifying how the binding_message looks like. I like your petrol station use case that is exactly what CIBA is designed for. Also I am not sure what PSD2 actually mandates to be shown at the Authentication Device. The pump is showing the price and the binding_message “e.g. ‘</span><span class="m2097250357939078632st"><span lang="EN-US" class="">Correct<span class="Apple-converted-space"> </span></span></span><em class=""><span lang="EN-US" class="">Horse</span></em><span class="m2097250357939078632st"><span lang="EN-US" class="">Battery<span class="Apple-converted-space"> </span></span></span><em class=""><span lang="EN-US" class="">Staple</span></em><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">’” and the binding_message is also displayed on the user’s AT to protect the user. Potential PIN entry is a separate issue. Reentering the binding_message at the pump does improve the pump’s assurance but might introduce an error prone UX. YMMW.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Regarding Token Request Validation:</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://bitbucket.org/openid/mobile/commits/c2de67a23791bf8962602fd6746a66bef63e4168" target="_blank" style="color: purple; text-decoration: underline;" class="">https://bitbucket.org/openid/mobile/commits/c2de67a23791bf8962602fd6746a66bef63e4168</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I did not reference 3.1.3 because we have no redirect_url</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Regarding the authentication of the OP at the Client Notification Endpoint:</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://bitbucket.org/openid/mobile/issues/54/ciba-client-notification-endpoint" target="_blank" style="color: purple; text-decoration: underline;" class="">https://bitbucket.org/openid/mobile/issues/54/ciba-client-notification-endpoint</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Regarding signing results:</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://bitbucket.org/openid/mobile/issues/55/ciba-signed-result-objects" target="_blank" style="color: purple; text-decoration: underline;" class="">https://bitbucket.org/openid/mobile/issues/55/ciba-signed-result-objects</a></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">kind regards</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Axel</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Openid-specs-fapi [mailto:<a href="mailto:openid-specs-fapi-bounces@lists.openid.net" target="_blank" style="color: purple; text-decoration: underline;" class="">openid-specs-fapi-bounces@lists.openid.net</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Dave Tonge via Openid-specs-fapi<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Freitag, 26. Mai 2017 12:59<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Openid-specs Fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" target="_blank" style="color: purple; text-decoration: underline;" class="">openid-specs-fapi@lists.openid.net</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>[Openid-specs-fapi] Initial review of MODRNA Client initiated Backchannel Authentication Flow 1.0</span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">Hi all,</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">We discussed on the last call that it would be good to review the MODRNA backchannel auth and user questioning specs from a FAPI perspective.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">I've started to go through them both and here are my initial thoughts on the<span class="Apple-converted-space"> </span><a href="http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-authentication-1_0.html#rfc.section.4.1" target="_blank" style="color: purple; text-decoration: underline;" class="">Backchannel Authentication spec</a>:</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">2. Terminology</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">The definition for Consumption Device states that it is “most probably a browser”. It is envisaged that this will often not be the case, for payment APIs, e.g. the flow could be initiated via a POS device.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">3. Overview</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">Spelling mistake - “inmediatly” -> “immediately”</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">4.1 Authentication Request</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">Client Authentication - this should be restricted to the methods listed in FAPI (i.e. private_key_jwt or MTLS)</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">Client_notification_token - this is a bearer token used by the OP when notifying the client via the `client_notification_endpoint`. In the FAPI spec we are moving away from bearer tokens to either sender contained tokens or OATB tokens. While this token is used for OP -> client rather than client -> OP should we still consider constraining the tokens?</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">A simpler approach may be to ensure that the OP signs any payload sent to the `client_notification_endpoint`. Currently, these payloads (error or success) are plain JSON payloads. The success payload contains an `id_token`, but this token contains claims about the identity of the user rather than acting as a detached signature for the access token (and refresh token)</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">Binding_message - as I understand it the binding message is shown to the user on both the consumption and the authentication device. The spec then relies on the user checking that both messages are the same. If the spec were to be used for payments then I would suggest that the binding message is shown on the consumption device and entered by the user on the authentication device. This would be more secure than relying on the user to cross-check both messages are the same.<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">For example, this spec could be used to support bank payments at a petrol station - the user could enter their phone number into the POS device, they would then receive a notification from their banking app asking them to authorise a payment. However what is to prevent someone entering the user’s phone number at the same time at the same petrol station when paying for fuel of the same amount. If the POS device displayed a 6 digit pin to the user, and the user entered that pin as part of the authorization flow in their banking app, then all parties would have a higher degree of confidence about the transaction.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">The binding message should be required and not optional for payments.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">4.2.1 Authentication Request Validation</span></b><span style="font-size: 11pt; font-family: Arial, sans-serif;" class=""></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">The authentication request is a plain JSON payload, but because this is happening over a channel protected by client authentication this should be sufficient.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">5. OpenID Provider Obtains End-user Consent/Authorization</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">The spec is focussed on user authentication rather than a user authorising a specific action, e.g. making a payment. The wording in this section could be confusing to those implementing it for a financial API.<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">In order to support fine-grained authorisation, the spec would need to support the OIDC claims parameter and guidance would need to be provided to implementers on example flows for payments and account information access.<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">6.1 Token Request Using Polling Mechanism</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">The spec should refer back to OIDC Core - 3.1.3 - token endpoint - as all the verification steps described there should be performed.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">In addition, it should be made clear in the spec that the `auth_req_id` MUST be bound to the client to which it was issued. At the moment it would seem that any client could send any `auth_req_id`.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">6.2 Successful Token Polling Response</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">To conform with FAPI, the tokens returned in this response should be bound to the client either using MTLS or OATB.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">6.3.1 Succesful Token Notification</span></b><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">As per the notes on client_notification_token, I suggest that this payload is signed to ensure source authentication and integrity.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">Other notes:</span><o:p class=""></o:p></div><p style="margin-right: 0cm; margin-left: 36pt; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 0.0001pt; vertical-align: baseline;" class=""><span style="font-size: 10pt; font-family: Symbol;" class="">·</span><span style="font-size: 7pt;" class=""> <span class="Apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">No mention of what happens if the client notification endpoint is down (e.g. retries)</span><o:p class=""></o:p></p><ul type="disc" style="margin-bottom: 0cm;" class=""><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; vertical-align: baseline;"><span style="font-size: 11pt; font-family: Arial, sans-serif;" class="">No mention of what acknowledgement the client should give to the OP when it receives a notification</span><o:p class=""></o:p></li></ul></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br clear="all" class=""><o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">_________</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif;" class=""></span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">I believe that this spec could be useful for Financial APIs, however, it is more coupled to OIDC than the current FAPI drafts. It could be that we have to draft a new part to the FAPI spec that references this spec, but is more in line with the rest of the FAPI draft and geared towards the use-case of financial APIs.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">I have started a review of the user questioning API and will send that to the list shortly. However, on initial inspection, it doesn't result in access tokens being issued to the client and would, therefore, be unsuitable for "account information" access. </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">This was my first review of the MODRNA specs and I may well have misinterpreted some of the specs. I hope that members of this group or are also members of the MODRNA group will help to correct any mistakes I may have made. </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: 'Trebuchet MS', sans-serif;" class="">Thanks</span><o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">--<o:p class=""></o:p></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">Dave Tonge</span></b><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">CTO</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""><a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(131, 94, 165); text-decoration: none;" class=""><img border="0" width="200" height="50" id="m_2097250357939078632_x005f_x0000_i1025" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png" alt="Moneyhub Enterprise" style="width: 2.0833in; height: 0.5208in;" class=""></span></a></span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">10 Temple Back, Bristol, BS1 6FL</span><o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">t: </span></b><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">+44 (0)117 280 5120</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(97, 97, 97);" class=""> </span><o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">Moneyhub Enterprise is a trading style of Momentum Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Momentum Financial Technology is entered on the Financial Services Register (FRN </span><b class=""><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">561538</span></b><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">) at<span class="Apple-converted-space"> </span><a href="http://fca.org.uk/register" target="_blank" style="color: purple; text-decoration: underline;" class="">fca.org.uk/register</a>. Momentum Financial Technology is registered in England & Wales, company registration number </span><b class=""><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">06909772</span></b><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""> </span><span style="font-size: 7.5pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">©</span><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""> . Momentum Financial Technology Limited 2016. </span><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(136, 136, 136);" class="">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Limited or of any other group company.</span><o:p class=""></o:p></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></blockquote></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class=""><br clear="all" class=""><o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">--<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">Dave Tonge<o:p class=""></o:p></span></b></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">CTO<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""><a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(131, 94, 165); text-decoration: none;" class=""><img border="0" width="200" height="50" id="_x0000_i1026" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png" alt="Moneyhub Enterprise" style="width: 2.0833in; height: 0.5208in;" class=""></span></a><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">10 Temple Back, Bristol, BS1 6FL</span><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""><o:p class=""></o:p></span></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">t: </span></b><span style="font-size: 8.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">+44 (0)117 280 5120</span><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(97, 97, 97);" class=""><o:p class=""> </o:p></span></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">Moneyhub Enterprise is a trading style of Momentum Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Momentum Financial Technology is entered on the Financial Services Register (FRN </span><b class=""><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">561538</span></b><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class="">) at<span class="Apple-converted-space"> </span><a href="http://fca.org.uk/register" target="_blank" style="color: purple; text-decoration: underline;" class="">fca.org.uk/register</a>. Momentum Financial Technology is registered in England & Wales, company registration number </span><b class=""><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(0, 164, 183);" class="">06909772</span></b><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""> </span><span style="font-size: 7.5pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">©</span><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""> . Momentum Financial Technology Limited 2016. </span><span style="font-size: 8pt; font-family: 'Open Sans', serif; color: rgb(136, 136, 136);" class="">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Limited or of any other group company.</span><span style="font-size: 10.5pt; font-family: 'Open Sans', serif; color: rgb(51, 51, 51);" class=""><o:p class=""></o:p></span></div></div></div></div></div></div></div></div></div></div></div></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Openid-specs-mobile-profile mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Openid-specs-mobile-profile@lists.openid.net</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote></div><br class=""></div></body></html>