<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><br class=""><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Bjorn<div class="">Gonzalo</div><div class="">Nat</div><div class="">James</div><div class="">Shiva</div><div class="">Mohajeri</div><div class="">John </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">September WS we need agenda and info to book hotels.</div><div class=""><br class=""></div><div class="">Gonzalo Back channel draft.</div><div class="">New version uploaded last week.</div><div class=""><span style="font-family: Calibri, sans-serif; font-size: 14px;" class=""> </span><a href="https://bitbucket.org/openid/mobile/src/75eae8b8e50737059c069965c8c37e794843b510/draft-mobile-client-initiated-backchannel-authentication-01.html?at=default&fileviewer=file-view-default" style="font-family: Calibri, sans-serif; font-size: 14px;" class="">https://bitbucket.org/openid/mobile/src/75eae8b8e50737059c069965c8c37e794843b510/draft-mobile-client-initiated-backchannel-authentication-01.html?at=default&fileviewer=file-view-default</a> </div><div class=""><br class=""></div><div class="">Need discussion on the auth_req_id vs dymamic redirect_uri for post response</div><div class=""><br class=""></div><div class="">Need discussion on defining a new response_type vs a scope for signalling the flow.</div><div class=""><br class=""></div><div class="">Long discussion on poling response vs Post push.</div><div class=""><br class=""></div><div class="">We discussed the similarity with the device flow that uses long polling and may be updated to support out of band push for consent/authentication rather as well as the current type the URI method.</div><div class=""><a href="https://tools.ietf.org/html/draft-ietf-oauth-device-flow" class="">https://tools.ietf.org/html/draft-ietf-oauth-device-flow</a></div><div class=""><br class=""></div><div class="">John observed that polling may be easier logic for some RP to implement, and can work with non server devices.</div><div class="">Posting back to the client also introduces new security considerations, if mutual TLS is not used. </div><div class="">The whole response may need to be signed eg include the auth_req_id inside the id_token.</div><div class="">Connect is defining Session ID “sid” as part of logout, that might be something we could use instead of auth_req_id to correlate in the POST case, as it will be a id_token claim.</div><div class=""><br class=""></div><div class="">Shiva is going to get feedback from operators on the backchannel draft and circulate to the WG.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div></div></div><br class=""></body></html>