<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">>> <span style="color:black">it might be nice for it to have some error information so the AP knows that the IdP will no longer be attempting. Or, after 48 hours (or whatever the retry span is), that it was ultimately unsuccessful and
what the corresponding error was.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is reminiscent of another question that arose earlier in the group: Should there be a cancellation flow to abort an in-process registration and clean up data on both sides? While possible, it felt like one of those things that nobody
would actually spend time implementing, and they’d just rely on the expiration windows to let things naturally reap. But, I don’t have a strong opinion here. Let us know if anyone else does. (Vendors could still add their own cancellation buttons, but it
would only cleanup their local data. It wouldn’t call across to the other Provider to wipe their bits.)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, in all transparency, I may change my mind. This is because I need to add more implementation guidance in the spec for how people edit/delete an existing federation relationship that was setup via FastFed. Along the way, I may smack
myself in the forehead and realize we need something new in the spec ; ) <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Brian Rose <brian.rose@sailpoint.com><br>
<b>Date: </b>Friday, October 18, 2019 at 10:51 AM<br>
<b>To: </b>"McAdams, Darin" <darinm@amazon.com>, Openid-specs-fastfed <openid-specs-fastfed@lists.openid.net><br>
<b>Cc: </b>Matt Domsch <matt.domsch@sailpoint.com><br>
<b>Subject: </b>RE: [Openid-specs-fastfed] Question about 7.2.4 (Handshake Finalization)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Yes, that would be great. Would there be any other information returned in the payload? Or is it going to be just enough for the AP finalize call to know the issuer and tenant? At an absolute minimum, “iss” and “sub” are what I would
need. <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Also, related to the payload, section 7.2.4 states “<span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">the Identity Provider MUST invoke this endpoint after
<b>successfully</b> processing…”. Should </span>the finalize endpoint ALWAYS get called, even if there is an error somewhere in the handshake? If so, it might be nice for it to have some error information so the AP knows that the IdP will no longer be attempting.
Or, after 48 hours (or whatever the retry span is), that it was ultimately unsuccessful and what the corresponding error was.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Brian Rose</span></b><span style="font-family:"Arial",sans-serif"><br>
</span><i><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Staff Software Engineer</span></i><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><br>
</span><a href="mailto:brian.rose@sailpoint.com"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#00B5E2;text-decoration:none">brian.rose@sailpoint.com</span></a><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#00B5E2">
</span><span style="font-family:"Arial",sans-serif"><br>
</span><a href="http://www.sailpoint.com"><b><span style="font-size:8.0pt;font-family:"Arial",sans-serif;color:#00B5E2;text-decoration:none">www.sailpoint.com</span></b></a><o:p></o:p></p>
</div>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> McAdams, Darin <darinm@amazon.com> <br>
<b>Sent:</b> Wednesday, October 16, 2019 6:19 PM<br>
<b>To:</b> Brian Rose <brian.rose@sailpoint.com>; openid-specs-fastfed@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-fastfed] Question about 7.2.4 (Handshake Finalization)<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Good catch. Would it help if a signed JWT came along in this request as well?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Openid-specs-fastfed <</span><a href="mailto:openid-specs-fastfed-bounces@lists.openid.net"><span style="font-size:12.0pt">openid-specs-fastfed-bounces@lists.openid.net</span></a><span style="font-size:12.0pt;color:black">>
on behalf of Openid-specs-fastfed <</span><a href="mailto:openid-specs-fastfed@lists.openid.net"><span style="font-size:12.0pt">openid-specs-fastfed@lists.openid.net</span></a><span style="font-size:12.0pt;color:black">><br>
<b>Reply-To: </b>Brian Rose <</span><a href="mailto:brian.rose@sailpoint.com"><span style="font-size:12.0pt">brian.rose@sailpoint.com</span></a><span style="font-size:12.0pt;color:black">><br>
<b>Date: </b>Thursday, October 10, 2019 at 11:12 AM<br>
<b>To: </b>Openid-specs-fastfed <</span><a href="mailto:openid-specs-fastfed@lists.openid.net"><span style="font-size:12.0pt">openid-specs-fastfed@lists.openid.net</span></a><span style="font-size:12.0pt;color:black">><br>
<b>Subject: </b>[Openid-specs-fastfed] Question about 7.2.4 (Handshake Finalization)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">Hey all,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">In my current POC implementation, I am attempting to set a flag to indicate that the full round trip has been completed in the finalization step. How does the Application Provider know the provider domain and the tenant id so that it can
verify that it has been previously whitelisted and update any associated data that the Application Provider might want to log? During the registration, the JWT contains all of the necessary information to do the look up. Also, as a result, is that this endpoint
is wide open.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
<p class="MsoNormal">Brian Rose<o:p></o:p></p>
<p class="MsoNormal">SailPoint<o:p></o:p></p>
</div>
</body>
</html>