<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Please find below the minutes of our call. In any case of error or misunderstanding, please let me know.</div>
<div> </div>
<a name="BM_BEGIN"></a>
<ol style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;"><u>Roll Call</u><u> </u><u>: </u></li><li style="margin-top:5pt;margin-bottom:5pt;">- Petteri, John, Jörg, Bjorn, Philippe, Siva, Gonzalo, Celestin</li><li style="margin-top:5pt;margin-bottom:5pt;"> </li><li style="margin-top:5pt;margin-bottom:5pt;"><u>Adoption of the Agenda [Bjorn/John]</u></li><li style="margin-top:5pt;margin-bottom:5pt;">– agreed</li><li style="margin-top:5pt;margin-bottom:5pt;"> </li><li style="margin-top:5pt;margin-bottom:5pt;"><u>Liaisons Updates</u></li></ol>
<ul style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;">GSMA [Siva]</li><li style="margin-top:5pt;margin-bottom:5pt;">- no update</li></ul>
<ol start="4" style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;"><u>Working Group Updates</u></li></ol>
<ul style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;">FAPI WG</li><li style="margin-top:5pt;margin-bottom:5pt;">- John : another FAPI workshop is scheduled in January with Open Banking people to educate on standard.</li><li style="margin-top:5pt;margin-bottom:5pt;">Questions with the FAPI group about sending the all registration as a JWT, some people could want to have a signed registration, and OB group has already a key to use. Probable Incompatibility with OIDC dynamic
registration.</li></ul>
<ol start="5" style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;"><u>Issue Tracker</u></li></ol>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">Not addressed</span></font></div>
<ul style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;"><u>Authentication Profile</u></li></ul>
<div style="padding-left:18pt;"><font face="Arial" size="2"><span style="font-size:10pt;">Open issues for the authentication profile: </span></font></div>
<ul style="margin:0;padding-left:72pt;">
<font face="Arial" size="2"><span style="font-size:10pt;">
<li>Bjorn to send a mail to the group for progressing on the status</li></span></font>
</ul>
<ol start="6" style="margin:0;">
<li style="margin-top:5pt;margin-bottom:5pt;"><u>AOB</u></li></ol>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">BBVA case</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Gonzalo : a proposal following a meeting with BBVA bank in Spain. </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">BBVA Has concerns with the way that OP gives the token back to the SP. Mobile Connect doesn’t allow both modes (push and pull). They want to have a synchronized way to get the token. The proposal
is to include into CIBA a way to return the token directly in the first request because different countries will have different approaches on requesting consent of the user, some won’t have this mandatory and some others will.</span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">BBVA is not interested in the authentication mode and wish to get back the token in the first access, eventually limited by a timeout written in the system.</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">The concern with polling is that it is not allowed in Mobile Connect. Are we inventing a new kind of polling ?. To be correlated with the pairwise identifier approach. The SP only wants an access
token to access the protected resource.</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">BBVA said in some cases there is no use to send back an evidence of consent, this one could be taken out of band, and no need to return an ID Token. </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">In any case, we need a process in place to be sure that no other entity will try to connect to the resource with the same PPID.</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Investigate to give BBVA a sector identifier and in any case, avoid to create a new flow. </span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Adding something to the client registration could be: I want to collect the consent, the MNO says yes or no in return. But both flows could be CIBA. </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;"> </span></font></div>
<ul style="margin:0;padding-left:72pt;">
<font face="Arial" size="2"><span style="font-size:10pt;">
<li>Gonzalo to write an issue tracker on this.</li></span></font>
</ul>
<div> </div>
<div><font face="Arial" size="2"><span style="font-size:10pt;"><u>Next call</u> on the dec 26th.</span></font></div>
<div> </div>
<div> </div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Kind regards,</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Philippe</span></font></div>
<div> </div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>