<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hello Financial-Grade API Work Group Members <br class="">
<br class="">
As Ralph Bragg notes below…<i class="">”For the sake of global interoperability, we’ve been pushing alignment with all of the major market initiatives.” </i>Given many market initiatives, global interoperability is a particularly timely and important goal
of both the Financial-Grade API and eKYC and Identity Assurance Was. To that end, the OpenID Foundation has begun working closely with colleagues to replicate the success of recent in-person workshops in Tokyo and London with online equivalents.
<div class=""><br class="">
</div>
<div class="">In my recent blog; <a href="https://openid.net/2020/03/13/flatten-the-curve-openid-foundation-virtual-workshops-to-continue-momentum-and-progress/" class="">Flatten the Curve: OpenID Foundation Virtual Workshops to Continue Momentum and Progress</a> I
outlined how the OpenID Foundation is reaching out to liaison partners, members and the community at large to join us in maintaining the momentum advancing the development of these important standards. In addition to joining workgroups, we're encouraging our
partners and members to co-sponsor online workshops, contribute to our <a href="https://fapi.openid.net/" class="">FAPI-Mini Site </a>, and collaborate in new and creative ways.</div>
<div class=""><br class="">
</div>
<div class="">We are planning an online workshop soon with our liaison partner, the UK Open Banking Implementation Entity. This is timely given the cancellation of key conferences and many UK banks and TPPs will be recovering from a recent UK Financial Conduct
Authority (FCA) deadline. Feel free to share your comments, suggestions, etc.</div>
<div class=""><br class="">
</div>
<div class="">Don Thibeau : Executive Director, OpenID Foundation<br class="">
<a href="mailto:don@oidf.org" class="">Email: don@oidf.org</a><br class="">
Voice: +1 202.841.8222<br class="">
https://openid.net/foundation</div>
<div class=""><br class="">
</div>
<div class=""><span class=""><br class="">
On Mar 15, 2020, at 1:12 PM, Ralph Bragg via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" class="">openid-specs-fapi@lists.openid.net</a>> wrote:<br class="">
<br class="">
Hi Michael,<br class="">
<br class="">
No worries, if you could provide the delta or a comparison for discussion it would be greatly appreciated and massively speed up the effort. I’d be particularly interested in any recommendations based on poor vendor support or other justifications that would
prevent adoption of a strict reading of FAPI RW.<br class="">
<br class="">
In the UK, the Banks were given 12 months grace to utilise the “Open Banking security profile” which was a balance somewhere between FAPI R and FAPI RW in terms of security, implementation complexity and features necessary to be adopted to make the initial
ecosystem function. There wasn’t sufficient vendor support to enforce FAPI RW directly out of the gate onto providers, the Banks were requested to lean heavily on their suppliers to uplift capabilities to FAPI RW which they did. <br class="">
<br class="">
FAPI RW is now the only standard that the UK’s OBIE supports. For the sake of global interoperability, we’ve been pushing alignment to these profiles pretty hard with all of the major market initiatives so I’d be really to know your thoughts if elements of
the profile still suffer from implementation difficulties with your user groups.<br class="">
<br class="">
Kind Regards,<br class="">
Ralph<br class="">
<br class="">
From: "Peck, Michael A" <<a href="mailto:mpeck@mitre.org" class="">mpeck@mitre.org</a>><br class="">
Date: Sunday, 15 March 2020 at 17:02<br class="">
To: Ralph Bragg <ralph.bragg@raidiam.com>, Financial API Working Group List <openid-specs-fapi@lists.openid.net>, "openid-specs-ab@lists.openid.net" <openid-specs-ab@lists.openid.net><br class="">
Cc: OAuthOIDCProfiles <OAuthOIDCProfiles@groups.mitre.org><br class="">
Subject: Re: [Openid-specs-fapi] Tailored OAuth and OIDC Profiles<br class="">
<br class="">
Hi Ralph,<br class="">
<br class="">
No specific ask on our part from sharing our enterprise profiles, we are sharing them as informational for anyone who may be interested.<br class="">
We do welcome and appreciate the feedback.<br class="">
We’re comparing our enterprise profiles with the FAPI and draft FAPI v2 profiles now and will send comments/questions to the FAPI mailing list.<br class="">
We are interested in aligning our profiles (using one of the FAPI profiles as a baseline for ours) as that could greatly simplify what we need to specify, and as you say allow us to leverage FAPI’s adoption. From my reading so far, the current draft FAPI 2.0
Baseline Profile has strong requirements that I’m glad to see and hope will push implementations in the right direction if they’re not there yet.<br class="">
<br class="">
Our intention is to state mandatory requirements that we believe can be deployed today or in the near future, and state recommended/optional requirements to try to influence the future direction of implementations. PAR and RAR don’t seem to be widely implemented
yet, but please correct me if I’m wrong. We could at least specify them as optional to show our interest.<br class="">
<br class="">
Thanks,<br class="">
Mike<br class="">
<br class="">
<br class="">
From: Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Ralph Bragg via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br class="">
Reply-To: Financial API Working Group List <openid-specs-fapi@lists.openid.net><br class="">
Date: Tuesday, March 3, 2020 at 1:18 PM<br class="">
To: Financial API Working Group List <openid-specs-fapi@lists.openid.net>, "openid-specs-ab@lists.openid.net" <openid-specs-ab@lists.openid.net><br class="">
Cc: Ralph Bragg <ralph.bragg@raidiam.com>, NSA ICAM Investigation <NSAICAM@groups.mitre.org><br class="">
Subject: [EXT] Re: [Openid-specs-fapi] Tailored OAuth and OIDC Profiles<br class="">
<br class="">
As a quick follow up - PAR and RAR address a lot of the requirements specific in this profile. It would be a shame to not advantage of the latest work from the group if you’re looking to promote this for wide spread adoption amongst government in the US. <br class="">
<br class="">
Any comparisons against FAPI and particularly the latest drafts for FAPI v2 which are on github would be very useful as a cursory read I’m struggling to identify where and why I’d use this profile over the gold standard especially as fapi certifications and
support are now very common amongst most vendor sets and come with a certification program, a testing harness and documented and academically reviewed threat model and analysis.<br class="">
<br class="">
Any help would be appreciated.<br class="">
<br class="">
From: Ralph Bragg <ralph.bragg@raidiam.com><br class="">
Sent: Tuesday, March 3, 2020 6:13:32 PM<br class="">
To: Financial API Working Group List <openid-specs-fapi@lists.openid.net>; openid-specs-ab@lists.openid.net <openid-specs-ab@lists.openid.net><br class="">
Cc: Russell, Mark L <mrussell@mitre.org>; NSA ICAM Investigation <NSAICAM@groups.mitre.org><br class="">
Subject: Re: Tailored OAuth and OIDC Profiles<br class="">
<br class="">
Hi,<br class="">
<br class="">
Can I ask what the ask is here, across Europe, Australia, New Zealand and other jurisdictions FAPI RW is rapidly being the standard regardless of sector and already we are looking at a new version of FAPI Advanced profile that has several improvements on what
is outlined in this profile.<br class="">
<br class="">
Has any comparison been performed between the current high security fapi profile VS this profile that’s proposed here?<br class="">
<br class="">
Could you confirm wha the ask is from the working group or what improvements this profile proposes on top of FAPI or issues it addresses.<br class="">
<br class="">
Kind Regards,<br class="">
Ralph<br class="">
<br class="">
From: Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Russell, Mark L via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br class="">
Sent: Tuesday, March 3, 2020 5:20:42 PM<br class="">
To: openid-specs-fapi@lists.openid.net <openid-specs-fapi@lists.openid.net>; openid-specs-ab@lists.openid.net <openid-specs-ab@lists.openid.net><br class="">
Cc: Russell, Mark L <mrussell@mitre.org>; NSA ICAM Investigation <NSAICAM@groups.mitre.org><br class="">
Subject: [Openid-specs-fapi] Tailored OAuth and OIDC Profiles<br class="">
<br class="">
Hello all,<br class="">
<br class="">
For anyone who may be interested: MITRE, in support of the U.S. Government, has developed tailored OAuth and OpenID Connect profiles for use in enterprise environments. We have leveraged previous standards efforts (e.g. work in the IETF and in the OpenID Foundation)
and have detailed requirements to use the standards in a secure and interoperable manner to address enterprise environment use cases.<br class="">
<br class="">
These profiles should be considered informational as we seek feedback from subject matter experts. We’re interested in working with standards bodies and others to move these concepts forward. We welcome any comments and suggestions at OAuthOIDCProfiles@groups.mitre.org .<br class="">
<br class="">
The profiles can be found at: https://www.mitre.org/publications/technical-papers/enterprise-mission-tailored-oauth-20-and-openid-connect-profiles<br class="">
<br class="">
[This message was previously sent to the OAuth IETF mailing list – apologies to anyone who receives it multiple times]<br class="">
<br class="">
Mark Russell<br class="">
Cyber Physical and Mobile Tech – T8A5<br class="">
The MITRE Corporation <br class="">
(o) 703-983-7941 (m) 202-492-5567<br class="">
mrussell@mitre.org<br class="">
<br class="">
_______________________________________________<br class="">
Openid-specs-fapi mailing list<br class="">
Openid-specs-fapi@lists.openid.net<br class="">
http://lists.openid.net/mailman/listinfo/openid-specs-fapi<br class="">
<br class="">
<div class="">--<br class="">
Don Thibeau : Executive Director, OpenID Foundation<br class="">
Email: don@oidf.org<br class="">
Voice: +1 202.841.8222<br class="">
https://openid.net/foundation<br class="">
</div>
<br class="">
</span></div>
</body>
</html>