<html><body><div dir="ltr">Below are the meeting notes from today’s call. As a reminder, we will not be having a call on the 18th due to IETF 122 in Bangkok.<div><br></div><div dir="ltr">Please make sure you read the <a href="https://drafts.aaronpk.com/ipsie-openid-sl1/draft-openid-ipsie-sl1-profile.html ">draft</a> for using OIDC at SL1 and the <a href="https://github.com/openid/ipsie/labels/sl1">issues tagged for SL1</a> in GitHub. During the next two weeks, we’ll make progress asynchronously through the mailing list and GitHub issues.</div><div dir="ltr"><br></div><div dir="ltr">-dhs</div><div dir="ltr"><br><div><br></div><div dir="ltr">—</div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"># IPSIE WG Meeting Minutes</div><div dir="ltr">Date: 2025-03-11</div><div dir="ltr"><br></div><div dir="ltr">## Attendees</div><div dir="ltr">- Dean H. Saxe (Beyond Identity)</div><div dir="ltr">- Sean Miller (RSA)</div><div dir="ltr">- Kenn Chong (RSA)</div><div dir="ltr">- Jon Bartlett (Zscaler)</div><div dir="ltr">- Matt Topper (UberEther)</div><div dir="ltr">- Bjorn Hjelm (Yubico)</div><div dir="ltr">- Tom Clancy (MITRE)</div><div dir="ltr">- Robin Martherus (Cisco)</div><div dir="ltr">- Dick Hardt (Hellō)</div><div dir="ltr">- Karl McGuinness (Self)</div><div dir="ltr">- Vatsal Gupta (Apple)</div><div dir="ltr">- Filip Skokan (Okta)</div><div dir="ltr">- Victor Lu (Independent)</div><div dir="ltr">- Jen Schreiber (Workday)</div><div dir="ltr">- JD Pawar (Workday)</div><div dir="ltr">- Travis Tripp (HPE)</div><div dir="ltr"> </div><div dir="ltr"><br></div><div dir="ltr">## Agenda</div><div dir="ltr"><br></div><div dir="ltr">- Welcome and antitrust policy reminder</div><div dir="ltr">- OpenID Contributor Agreement reminder <a href="https://openid.net/intellectual-property">https://openid.net/intellectual-property</a></div><div dir="ltr">- Reminder about OpenID Slack</div><div dir="ltr"> - invite link: <a href="https://join.slack.com/t/oidf/shared_invite/zt-30zg9louv-3HgJEwIL7vB3uWv2KEbLtw">https://join.slack.com/t/oidf/shared_invite/zt-30zg9louv-3HgJEwIL7vB3uWv2KEbLtw</a></div><div dir="ltr">- Update on upcoming call schedule - no call March 18 due to IETF</div><div dir="ltr">- Review OpenID and SAML SL1 profiles</div><div dir="ltr"> - OpenID SL1 Editor's Copy - <a href="https://drafts.aaronpk.com/ipsie-openid-sl1/draft-openid-ipsie-sl1-profile.html">https://drafts.aaronpk.com/ipsie-openid-sl1/draft-openid-ipsie-sl1-profile.html</a> </div><div dir="ltr"> - Open issues - <a href="https://github.com/openid/ipsie/labels/sl1">https://github.com/openid/ipsie/labels/sl1</a></div><div dir="ltr"> - SAML SL1</div><div dir="ltr"> </div><div dir="ltr"><br></div><div dir="ltr">Notetaker: Tom Clancy</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">## Minutes</div><div dir="ltr"><br></div><div dir="ltr">- Antitrust policy reminder </div><div dir="ltr">- Slack invite link updated as of last night</div><div dir="ltr">- Call schedule updates - no call for March 18 due to IETF</div><div dir="ltr"> - IIW week schedule TBD, likely to cancel or move to a new day to minimize conflict</div><div dir="ltr"> - Keep the conversation going during the gap by communicating on Slack</div><div dir="ltr">- Start reviewing SL1 profile for OpenID -- editor's copy</div><div dir="ltr">- Already some discussion on GitHub, Slack, etc on issues</div><div dir="ltr">- Dean: let's start by collecting feedback on the draft</div><div dir="ltr"> - Dick, Karl, others have already indicated there is feedback, others?</div><div dir="ltr">- Karl: I opened a GitHub issue <a href="https://github.com/openid/ipsie/issues/61">https://github.com/openid/ipsie/issues/61</a></div><div dir="ltr"> - Do we want to start with the strongest foundation, such as FAPI2, or are we starting with a more accessible profile?</div><div dir="ltr"> - SAML, as example, doesn't require confidential clients -- how do we want to begin?</div><div dir="ltr"> - Do we want to address broader delegated access use cases?</div><div dir="ltr">- Filip: I don't have an answer on whether SL1 should allow public clients</div><div dir="ltr"> - Attacker model drives requirements in FAPI... What would attacker model say to drive public client</div><div dir="ltr"> - SAML flow is more analogous to response_type=id_token which results in no access tokens issued, the need for client auth likely mostly stems from protecting the issuance of access tokens to protected resources. If SL1 is not about resource access then we should not use flows that result in issued access tokens</div><div dir="ltr">- </div><div><br></div><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<br><div dir="ltr">Dean H. Saxe, <a href="https://idpro.org/cidpro/">CIDPRO</a> (he/him)</div><div dir="ltr">Principal Engineer</div><div dir="ltr">Office of the CTO</div><div dir="ltr">Beyond Identity</div><div dir="ltr"><a href="mailto:dean.saxe@beyondidentity.com">dean.saxe@beyondidentity.com</a></div><div><br><div><br></div></div></div></div></div></div></div></div></body></html>