<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Dynamic registration is still a MUST for the AS to support as it allows runtime on boarding of new clients without the involvement of sysadmins or other technical acumen. <div class=""><br class=""></div><div class="">To Debbie’s question, dynamic registration has never been a MUST for clients to use, however. So for single-AS systems with public clients, this might make sense to profile separately.</div><div class=""><br class=""></div><div class="">That doesn’t help us with the multi-AS world, which is likely to occur with clients speaking to the same API deployed across different systems, nor does it help with key management, so we’ve got to handle this carefully.</div><div class=""><br class=""></div><div class=""> — Justin</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 31, 2016, at 4:05 PM, Glen Marshall [SRS] <<a href="mailto:gfm@securityrs.com" class="">gfm@securityrs.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class="">Why?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Helvetica, sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Glen F. Marshall<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Consultant<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Security Risk Solutions, Inc.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">698 Fishermans Bend<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Mount Pleasant, SC 29464<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Tel: (610) 644-2452<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Mobile: (610) 613-3084<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class=""><a href="mailto:gfm@securityrs.com" style="color: purple; text-decoration: underline;" class="">gfm@securityrs.com</a><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class=""><a href="http://www.securityrisksolutions.com/" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">www.SecurityRiskSolutions.com</span></a><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span><a href="mailto:agropper@gmail.com" class="">agropper@gmail.com</a> [<a href="mailto:agropper@gmail.com" class="">mailto:agropper@gmail.com</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Adrian Gropper<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, May 31, 2016 16:03<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Glen Marshall [SRS] <<a href="mailto:gfm@securityrs.com" class="">gfm@securityrs.com</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Debbie Bucci <<a href="mailto:debbucci@gmail.com" class="">debbucci@gmail.com</a>>; Justin Richer <<a href="mailto:jricher@mit.edu" class="">jricher@mit.edu</a>>; <a href="mailto:openid-specs-heart@lists.openid.net" class="">openid-specs-heart@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-heart] Pulling out Native Apps<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Sorry, dynamic registration is a MUST.<o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Adrian<br class=""><br class="">On Tuesday, May 31, 2016, Glen Marshall [SRS] <<a href="mailto:gfm@securityrs.com" style="color: purple; text-decoration: underline;" class="">gfm@securityrs.com</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class="">I also agree to adding native apps.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class="">As far as use cases for them, some will map on existing web app uses. But I can imagine a network connectivity hub, e.g., a medical home, connecting to multiple apps on behalf of multiple native apps. Dynamic registration needs to be a supported option, but not mandatory in HEART’s model. I wonder what this means to scalability. </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Helvetica, sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Glen F. Marshall</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Consultant</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Security Risk Solutions, Inc.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">698 Fishermans Bend</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Mount Pleasant, SC 29464</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Tel: (610) 644-2452</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class="">Mobile: (610) 613-3084</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class=""><a target="_blank" class="">gfm@securityrs.com</a></span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Helvetica, sans-serif;" class=""><a href="http://www.securityrisksolutions.com/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">www.SecurityRiskSolutions.com</span></a></span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Helvetica, sans-serif;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Openid-specs-heart [mailto:<a target="_blank" class="">openid-specs-heart-bounces@lists.openid.net</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Debbie Bucci<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, May 31, 2016 14:56<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Justin Richer <<a target="_blank" class="">jricher@mit.edu</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a target="_blank" class="">openid-specs-heart@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-heart] Pulling out Native Apps</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">So does that mean dynamic registration would not apply to native apps ?<o:p class=""></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Or could a device/native app/hub(?) dynamically connect for multiple apps?<span class="Apple-converted-space"> </span><o:p class=""></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Agree adding adding native apps<o:p class=""></o:p></p><p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On May 31, 2016 11:54 AM, "Justin Richer" <<a target="_blank" class="">jricher@mit.edu</a>> wrote:<br class="">><br class="">> From a conversation in our sister iGov working group, we think there might be a gap in the current client descriptions in HEART. Namely, native applications aren’t called out as being separate from web-based clients. Newer techniques like PKCE can allow native apps to connect more securely without per-instance registration, and software statements are going to be particularly important for these clients as well. There’s some question as to how we’ll manage key registration here, since we don’t want to encourage packing the same private key in a million copies of a piece of software.<br class="">><br class="">> What we’re proposing is that we separate out recommendations and requirements for native apps (and desktop apps) as a fourth category alongside the current “full app”, “in-browser app”, and “batch-process app” categories.<br class="">><br class="">> Note that we’re not proposing, at this time, relaxing the requirement that the AS make dynamic registration available.<br class="">><br class="">> — Justin<br class="">> _______________________________________________<br class="">> Openid-specs-heart mailing list<br class="">><span class="Apple-converted-space"> </span><a target="_blank" class="">Openid-specs-heart@lists.openid.net</a><br class="">><span class="Apple-converted-space"> </span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" target="_blank" style="color: purple; text-decoration: underline;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><o:p class=""></o:p></p></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class=""><br class="">--<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Adrian Gropper MD<br class=""><br class=""><span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class="">PROTECT YOUR FUTURE - RESTORE Health Privacy!<br class="">HELP us fight for the right to control personal health data.<br class="">DONATE:<span class="Apple-converted-space"> </span><a href="http://patientprivacyrights.org/donate-2/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(5, 99, 193);" class="">http://patientprivacyrights.org/donate-2/</span></a></span></div></div></div></div></div></div></div></div></div></div></blockquote></div><br class=""></div></body></html>