<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>Dear all,</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Please find below the preliminary minutes of our call on Tuesday July 10<font size="1"><span style="font-size:6.65pt;"><sup>th</sup></span></font> of 2018.</div>
<div>In case of error or misunderstanding of the talks, please let me know</div>
<a name="BM_BEGIN"></a>
<div style="margin-top:24pt;"><font face="Cambria" size="4" color="#1F497D"><span style="font-size:14pt;"><b>Roll Call</b><font color="#365F91"><b> </b></font><font face="Arial" size="2" color="#365F91"><span style="font-size:10pt;"><b>(extract from gotomeeting
session participants)</b></span></font></span></font></div>
<div>Bjorn Hjelm, John Bradley,<font color="#878787"> </font>Philippe Clement (Orange), Gonza, Jörg, Petteri (Ubisecure), James Manger, Dave Tonge, Brian Campbell,</div>
<div style="margin-top:24pt;"><font face="Cambria" size="4" color="#365F91"><span style="font-size:14pt;"><b>Adoption of the Agenda [Bjorn/John]</b></span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;">Agenda adopted</div>
<div style="margin-top:24pt;"><font face="Cambria" size="4" color="#365F91"><span style="font-size:14pt;"><b>Liaisons Updates</b></span></font></div>
<div style="margin-top:10pt;padding-left:14.2pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>GSMA [Siva]</b></span></font></div>
<div>Not addressed</div>
<div style="margin-top:24pt;"><font face="Cambria" size="4" color="#365F91"><span style="font-size:14pt;"><b>Working Group Updates</b></span></font></div>
<div style="margin-top:10pt;padding-left:14.2pt;"><font face="Cambria" size="3" color="#4F81BD"><span style="font-size:13pt;"><b>FAPI WG [John/Dave]</b></span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;">CIBA Discussion (from <a href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2018-06-20"><font color="blue"><u>June 20 call</u></font></a> and at <a href="https://bitbucket.org/openid/fapi/wiki/FAPI_Meeting_Notes_2018-06-27"><font color="blue"><u>Identiverse</u></font></a>)
and Brian’s e-mail input on CIBA.</span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Last week was an F2F meeting to speak of CIBA, which is gaining traction around banking. The question of a FAPI profile of CIBA is raised. OpenBanking will probably not use notification mode.</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>For FAPI WG, following <a href="http://lists.openid.net/pipermail/openid-specs-mobile-profile/Week-of-Mon-20180611/001183.html"><font color="blue"><u>Brian’s and others email</u></font></a>, the discussion addressed the concern to post back tokens for
the notification mode following the Authentication request. A proposal is to inform rather the client that the token is available at the OP endpoint, thus the way to get back tokens is more simple. </div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Discussions about the authentication request format, and posting JSON or Web form. Do we need both ? JSON seems more easy to implement. Brian suggests to remove the ambiguity.</div>
<ul style="margin:0;padding-left:72pt;">
<li>Brian to Open an issue on issue tracker.</li><li>Gonzalo to fix it on the spec regarding the format of request.</li></ul>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Discussion about Id_token_hint parameter, which seems problematic. Login_token_hint is different. In some cases, it could be impossible to validate signature because of key rotation. </div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Discussion about elevation of CIBA specs to other ID Connect WG ? legal things to see. </div>
<ul style="margin:0;padding-left:72pt;">
<li>Structure the document anyway. Makes more sense as a profile.</li></ul>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Discussion on account porting: RP doesn’t have to make a call to the old IdP.</div>
<div>Consensus on the group to get rid of the access token that the RP pushes back. Round trips to eliminate. Separate issue ? </div>
<ul style="margin:0;padding-left:72pt;">
<li>Brian to put it on the issue tracker</li></ul>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;">Best regards,</div>
<div style="margin-top:5pt;margin-bottom:5pt;">Philippe</div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>