<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="+1"><font face="Arial">Attending - Paul, John, Nat<br>
<br>
Discussion<br>
<br>
We reviewed the recent consent model thread<br>
<br>
Consent models can be characterized by<br>
</font></font><font size="+1"><font face="Arial"><font
face="Arial"><br>
1) where consent is collected - AS1 or AS2 (or TA?)<br>
2) when consent is collected - initial authz or subsequent
(for up-scoping)<br>
<br>
Agreed that consent should be collected at the AS appropriate
to a given RS, ie no federated consent<br>
<br>
If consent is collected at AS2, the first AS1 can deliver the
user's browser to the AS2 authz endpoint in an 'authenticated
state'<br>
<br>
The above mechanism would also enable SSO into web apps<br>
<br>
Discussion of, once consent collected by AS2, best mechanism
to deliver access token to TA<br>
<br>
1) AS2 returns code, to be exchanged for AT<br>
2) AS2 returns nothing, TA uses id_token obtained from AS1 to
get AT from AS2<br>
<br>
John will update spec to reflect<br>
<br>
1) consent model<br>
2) using id_token in JWT Assertion profile<br>
<br>
Discussion about a NAPPS F2F at IIW<br>
<br>
paul <br>
</font><br>
</font></font>
</body>
</html>