<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">What if the client doesn’t care, it is happy with the minimum authentication level?<div class=""><br class=""></div><div class="">Is there some other MODRNA behaviour that is triggered by the presence of the acr value?</div><div class=""><br class=""></div><div class="">If there is something additional that we are signalling then they probably shouldn’t attempt to be generic values.</div><div class=""><br class=""></div><div class="">Per my other email I suspect that they need to have some business process behind them as well so probably are not as generic as plain authentication methods.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 22, 2015, at 4:30 PM, Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" class="">torsten@lodderstedt.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Hi Philippe,</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">there must be a way for a RP to indicate to the OP to turn on the MODRNA/Mobile Connect authentication machinery. Using the ACR values for that purpose seems the be the natural choice. So if ACR values are the only way to request MODRNA authentication, the respective parameter must be MANDATORY.<span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">best regards,</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Torsten.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><div class="moz-cite-prefix" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);">Am 19.11.2015 um 17:22 schrieb<span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:philippe.clement@orange.com">philippe.clement@orange.com</a>:<br class=""></div><blockquote cite="mid:21860_1447950145_564DF741_21860_479_1_BA1DE49CF3A1754F875D2318BF2412CD1301AE9B@OPEXCNORM73.corporate.adroot.infra.ftgroup" type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><font size="2" face="Calibri" class=""><span style="font-size: 11pt;" class=""><div class=""><font color="#1F497D" class="">Dear all, dear Jorg</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">Maybe you discussed this subject during the Nov 11<font size="1" class=""><span style="font-size: 7.3pt;" class=""><sup class="">th</sup></span></font><span class="Apple-converted-space"> </span>call that I didn’t attend, but I would like to have confirmation of the reasons why “acr_values” are considered as “REQUESTED”.<span class="Apple-converted-space"> </span></font></div><div class=""><font color="#1F497D" class="">Can someone remind me with the consequences of putting this parameter to “OPTIONAL” ?</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">Thanks a lot</font></div><div class=""><font color="#1F497D" class="">Philippe</font></div><div class=""><font size="2" face="Tahoma" class=""><span style="font-size: 10pt;" class="">_____________________________________________<br class=""><b class="">De :</b><span class="Apple-converted-space"> </span>CLEMENT Philippe IMT TECHNO<span class="Apple-converted-space"> </span><br class=""><b class="">Envoyé :</b><span class="Apple-converted-space"> </span>jeudi 19 novembre 2015 15:15<br class=""><b class="">À :</b><span class="Apple-converted-space"> </span>Lodderstedt, Torsten; '<a class="moz-txt-link-abbreviated" href="mailto:openid-specs-mobile-profile@lists.openid.net">openid-specs-mobile-profile@lists.openid.net</a>'<br class=""><b class="">Objet :</b><span class="Apple-converted-space"> </span>MODRNA WG Call 18 Nov 15 preliminary notes</span></font></div><div class=""> </div><div class=""> </div><div class=""><font color="#1F497D" class="">Dear all,</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">Please find below the preliminary notes of our call on 18 11 15. Please send me any feedback in case of needed adjustments</font></div><div class=""> </div><div class=""><font color="#1F497D" class=""><u class="">Participants:</u><span class="Apple-converted-space"> </span><a moz-do-not-send="true" name="BM_BEGIN" class=""></a>Bjorn, John, Jorg, Nat, Philippe, Torsten,<font class=""><span class="Apple-converted-space"> </span></font>Matthieu</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class=""><u class="">Agenda:<span class="Apple-converted-space"> </span></u></font></div><ol style="margin: 0px; padding-left: 54pt;" class=""><font color="#1F497D" class=""><li class="">Authentication document</li><li class="">AOB</li></font></ol><div class=""><font color="#1F497D" class=""> </font></div><ol style="margin: 0px; padding-left: 36pt;" class=""><font color="#1F497D" class=""><li class=""><u class="">Authentication document</u></li></font></ol><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">Discussion around ISO-29115:<span class="Apple-converted-space"> </span></font></div><div class=""><font color="#1F497D" class="">Authentication document mentions that it relies on ISO-29115.</font></div><div class=""><font color="#1F497D" class="">This ISO doc is however larger than the MODRNA scope, and addresses Identity proofing, Authentication proofing and Identity management.</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">On another hand, the authentication document mentions explicitly the 4 levels of assurance. It is mentioned that the eIDAS rules will rely on 3 levels (low, substantial, high) and that mentioning the 4 levels in MODRNA could lead to ambiguities regarding the usage of MODRNA in Europe.</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">John will propose an update of this part in the following days.</font></div><div class=""><font color="#1F497D" class=""> </font></div><ol start="2" style="margin: 0px; padding-left: 36pt;" class=""><font color="#1F497D" class=""><li class=""><u class="">Security discussions</u></li></font></ol><div class=""><font color="#1F497D" class="">Exchanges about OAuth and OIDC specific threats, use of code flow and ID token, nonce usage, AS impersonation and front channel code injection.</font></div><div class=""><font color="#1F497D" class="">Discussions to continue offline on serious attacks and countermeasures as security recommendations for implementing are required.</font></div><div class=""><font color="#1F497D" class=""> </font></div><div class=""><font color="#1F497D" class="">Jorg to make the feedback to GSMA regarding MODRNA work on security<span class="Apple-converted-space"> </span></font></div><div class=""> </div></span></font><pre class="">_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</pre><br class=""><fieldset class="mimeAttachmentHeader"></fieldset><br class=""><pre wrap="" class="">_______________________________________________
Openid-specs-mobile-profile mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-mobile-profile@lists.openid.net">Openid-specs-mobile-profile@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a>
</pre></blockquote><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Openid-specs-mobile-profile mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="mailto:Openid-specs-mobile-profile@lists.openid.net" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">Openid-specs-mobile-profile@lists.openid.net</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""></div></blockquote></div><br class=""></div></body></html>