FAPI_Meeting_Notes_2016 11 30

FAPI WG Meeting Notes (2016-11-30)

Date & Time: 2016-11-30 23:00 UTC

(16:00 PDT, 00:00 UK, 01:00+1 Denmark, 09:00+1 JST)

Location: GoToMeeting https://global.gotomeeting.com/join/321819862

Agenda

• 1.   Roll Call
• 2.   Adoption of the Agenda (Nat)
• 3.   Working Draft 02
  • 3.1.   Last call on Part 1: Read Only API Security Profile (Nat)
• 4.   Issues
  • 4.1.   #32: How to communicate back the partial errors to the client (Sascha)
  • 4.2.   #12: OAuth Profile should mandate per AS redirect URI for Clients with session comparison (Nat)
  • 4.3.   #16: Client Authentication -- Do we need TLS mutual authentication? (John)
  • 4.4.   #39: 2nd WD Part 1 6.2.1 -- Comments about DDA remains (Nat)
  • 4.5.   #40: 2nd WD: Part 1: 6.2.1: Constraint on the InteractionId string unclear (Nat)
  • 4.6.   #41: WD2Part1:6.2.2 Add the description of "service bureau" as a Note as well (Nat)
• 5.   Events
  • 5.1.   API Days (Nat)
  • 5.2.   CA World Report (Sascha via Nat)
  • 5.3.   Cloud Identity Summit Chicago (John)
• 6.   AOB
  • 6.1.   Change of Pacific Call time? (Nat)
  • 6.2.   Next Call (Pacific)

The meeting was called to order at 14:05 UTC.

1.   Roll Call

• Present: John, Nat, Anoop, Tony, Edmund, Henrik
• Regrets: Sascha
• Guest:

2.   Adoption of the Agenda (Nat)

• Adopted.

3.   Working Draft 02

• Financial_API_WD_001.md Financial API - Part 1: Read Only API Security Profile
• Financial_API_WD_002.md Financial API - Part 2: Read and Write API Security Profile
• Financial_API_WD_003.md Financial API - Part 3: Open Data API
• Financial_API_WD_004.md Financial API - Part 4: Protected Data API and Schema - Read only
• Financial_API_WD_005.md Financial API - Part 5: Protected Data API and Schema - Read and Write

3.1.   Last call on Part 1: Read Only API Security Profile (Nat)

• Part 1: Read Only API Security Profile

  • https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_001.md

• The participants agreed that we should do the last call for a week or two. Members should file issues if they are found and they will be fixed.

4.   Issues

4.1.   #32: How to communicate back the partial errors to the client (Sascha)

• #32
• Sascha sent a written note that now he is ready to start on it.

4.2.   #12: OAuth Profile should mandate per AS redirect URI for Clients with session comparison (Nat)

• #12
• The issue has been resolved for sometime and Nat will close the ticket.

4.3.   #16: Client Authentication -- Do we need TLS mutual authentication? (John)

• #16
• There is a draft now in IETF.

4.4.   #39: 2nd WD Part 1 6.2.1 -- Comments about DDA remains (Nat)

• #39
• Editorial error. Will remove.

4.5.   #40: 2nd WD: Part 1: 6.2.1: Constraint on the InteractionId string unclear (Nat)

• #40
• Callers agreed that it should be UUID.

4.6.   #41: WD2Part1:6.2.2 Add the description of "service bureau" as a Note as well (Nat)

• #41
• Callers agreed that it is clear enough that no change is needed.

5.   Events

5.1.   API Days (Nat)

• http://www.apidays.io/
• Sascha received the note that FAPI could have 20 minutes during a PSD2 talk of one of my company members. That would be on the 13th of December <-- Now 14th according to the schedule?
• Nat is in touch with CA team. Need to develop slides.

5.2.   CA World Report (Sascha via Nat)

• Nat reported on behalf of Sascha that Banking customers had strong interest in FAPI work.

5.3.   Cloud Identity Summit Chicago (John)

• Should put together what we can do there as a track.

6.   AOB

6.1.   Change of Pacific Call time? (Nat)

• Callers agreed to make it one hour earlier so that it would be slightly easier for Atlantic call participants to join if they so choose.

6.2.   Next Call (Pacific)

• 2016-12-07 15:00 UTC

  (07:00 PDT, 15:00 UK, 16:00 Denmark, 00:00+1 JST)