FAPI_Meeting_Notes_2019 08 21_Atlantic

FAPI WG Meeting Notes (2019-08-21)

Date & Time: 2019-08-21 14:00 UTC

Location: GoToMeeting https://global.gotomeeting.com/join/321819862

Agenda

• 1.   Roll Call
  • 1.1.   Attending:
  • 1.2.   Regrets:
• 2.   Adoption of the Agenda (Nat)
• 3.   Certification
• 4.   External Organizations
  • 4.1.   FDX
• 5.   Pull requests
  • 5.1.   #131 first proposal to integrate JARM as equal option
  • 5.2.   #137 changed the draft to use the application/x-www-form-urlencoded encoding
  • 5.3.   #134 FAPI-R/RW: client authentication restrictions apply to all endpoints
  • 5.4.   #130 Initial attempt at listing requirements for FAPI HTTP signing
  • 5.5.   #129 First Cut
  • 5.6.   #113 FAPI-R: Clarify authorization code reuse requirements
  • 5.7.   #135 FAPI-RW: Apply cipher restrictions to < TLS 1.3
  • 5.8.   Code reuse issue
  • 5.9.   #125 CIBA: let AS determine whether signed request is mandatory
• 6.   Issues
  • 6.1.   #239 FAPI part 2 should mention/require discovery? (Joseph)
  • 6.2.   #250 certification clarification request: grant_types_supported in discovery (Joseph)
• 7.   AOB

The meeting was called to order at 14:04 UTC.

1.   Roll Call

1.1.   Attending:

1. Nat Sakimura
2. Dima Postnikov
3. Kosuke Koiwai
4. Joseph Heenan
5. Dave Tonge
6. Anthony Nadalin
7. Brian Campbell
8. Torsten Lodderstedt
9. Eric Tedeschi
10. Bjorn Hjelm
11. Ralph Bragg

1.2.   Regrets:

1. Anoop Saxena

2.   Adoption of the Agenda (Nat)

• Added Certification

3.   Certification

2 Banks paid. One has not submit the result yet. The other has, but not yet publisheable. Request from Open Banking to separate FAPI Certification result. This was discussed and those on the call agreed that it would be beneficial to separate the FAPI results from the OIDC results. Jospeh to speak to the certification team about this.

4.   External Organizations

4.1.   FDX

• Sept. 13, 14 in Detroit.
• Presso needed. If you have one already, please send it to Bjorn and nat.

5.   Pull requests

5.1.   #131 first proposal to integrate JARM as equal option

JOseph is doing the final review.

5.2.   #137 changed the draft to use the application/x-www-form-urlencoded encoding

Related to issue #253. Changes the JSON POST to form encoding.

Brian asked that posting raw JSON may be simpler.

5.3.   #134 FAPI-R/RW: client authentication restrictions apply to all endpoints

Joseph will make the change to pull request.

5.4.   #130 Initial attempt at listing requirements for FAPI HTTP signing

Accepted as a new document.

5.5.   #129 First Cut

5.6.   #113 FAPI-R: Clarify authorization code reuse requirements

5.7.   #135 FAPI-RW: Apply cipher restrictions to < TLS 1.3

Just qualifying TLS cipher restrictions.

5.8.   Code reuse issue

Merged.

5.9.   #125 CIBA: let AS determine whether signed request is mandatory

Merged.

6.   Issues

6.1.   #239 FAPI part 2 should mention/require discovery? (Joseph)

In Open Banking, Discovery is mandated so there is no deployment impact in that respect. Two good comments from Brian and Torsten. Joseph will create a pull request.

6.2.   #250 certification clarification request: grant_types_supported in discovery (Joseph)

People in the call agreed that it should be advertised, but we did not get to the conclusion whether it should be "SHALL" or "SHOULD".

Discussion is going to be continued on the ticket and we will come back to it in the next call.

7.   AOB

The meeting was adjourned at 15:09 UTC.