FAPI_Meeting_Notes_2023 03 29_Atlantic

FAPI WG Agenda & Meeting Notes (2023-03-29)

• Date & Time: 2023-03-29T14:00Z
• Location: https://zoom.us/j/97456084642?pwd=bTRFVzk4ZmlRK1M3bEprRlN5c3JFZz09
• Self: https://github.com/openid/fapi/wiki/FAPI_Meeting_Notes_2023-03-15_Atlantic

Agenda

• 1.   Roll Call (Dave/Nat)
• 2.   Adoption of Agenda (Dave/Nat)
• 3.   Events (Mike L)
  • 3.1.   OpenID Foundation Workshop (Mike)
  • 3.2.   Events are now in the Foundation Google Calendar (Mike)
• 4.   Internal Liaisons
  • 4.1.   NIST SP800-63-4ipd Comments
  • 4.2.   FAPI2 Conformance test is now available (Mike)
• 5.   External Orgs & Liaisons (Mike L.)
  • 5.1.   Open Finance Brazil
  • 5.2.   Open Insurance Brazil
  • 5.3.   Saudi Arabia (Mike)
  • 5.4.   OECD
• 6.   Draft Updates
  • 6.1.   Message Signing (Dave)
  • 6.2.   Grant Management (Dima)
• 7.   PRs (Dave)
• 8.   Issues (Dave)
  • 8.1.   Proposed new FAPI certification test: private_key_jwt client authentication assertion where aud contains multiple values (Filip)
  • 8.2.   private_key_jwt audience requirements (Filip)
  • 8.3.   FAPI2SP appears to permit response_types "id_token", "id_token token" and "none" (Dave)
  • 8.4.   FAPI CIBA (Dave)
  • 8.5.   FAPI2MS: Rejection of non-JAR/non-JARM requests (Filip)
  • 8.6.   Network Layer Protections restrict use of more recent TLS 1.2 cyphers
• 9.   AOB (Nat)

The meeting was called to order at 14:02 UTC.

1.   Roll Call (Dave/Nat)

• Attending: Nat Gail, Mike, Dave, Bjorn, Craig, Dima, Domingos, Filip, George, Kelley, Kosuke, Takahiko
• Regrets:
• Guest:

2.   Adoption of Agenda (Dave/Nat)

• Adopted as presented as draft agenda.

3.   Events (Mike L)

3.1.   OpenID Foundation Workshop (Mike)

• Registration page is now open.

  • https://openid.net/2023/03/17/registration-workshop-at-microsoft/

3.2.   Events are now in the Foundation Google Calendar (Mike)

• In the new website, it is going to be a single source.

4.   Internal Liaisons

4.1.   NIST SP800-63-4ipd Comments

• Mark is leading the discussion. Several meetings.
• Deadlines were postponed to April 14.
• Nat has provided a few comments pointing to FAPI as a good practice for security - security is typically not composable and has to take the protocol as a whole with an appropriate security model and analysis to go with.

• Link to the comment sheet that OIDF is compiling:

  • https://docs.google.com/spreadsheets/d/1JHDypzbKg8x2AMfC_z4pzDBk4waVJBp2/edit#gid=571622526

4.2.   FAPI2 Conformance test is now available (Mike)

• https://openid.net/2023/03/21/fapi-2-conformance-tests-available/

5.   External Orgs & Liaisons (Mike L.)

5.1.   Open Finance Brazil

• They have seen some progress on CIBA spec.

5.2.   Open Insurance Brazil

• Recertification - good progress.

5.3.   Saudi Arabia (Mike)

• Increase on testing activities

  • Six KSA fintech are FAPI RP certified
  • Eight KSA Server testing (6 banks + alpha)

• KSA

  • OP Testing: https://openid.net/certification/fapi_op_testing/
  • RP Testing: https://openid.net/certification/fapi_rp_testing/

5.4.   OECD

• Online public consultation on the draft OECD Recommendation on the Governance of Digital Identity

  • https://www.oecd.org/fr/gouvernance/gouvernement-numerique/online-public-consultation-draft-oecd-recommendation-on-the-governance-of-digital-identity.htm

• Gail created a draft letter:

  • https://docs.google.com/document/d/1Vu-5Pt6K-4nPccNZ_0eC4RLavifUZntnGgBLKBEYsv0/edit

6.   Draft Updates

6.1.   Message Signing (Dave)

• Dave has sent the fixed Implementer's draft documents to Mike J.

6.2.   Grant Management (Dima)

• Dave is creating a submission package now.

7.   PRs (Dave)

• Apart from one PR that we are parking until HTTP signature is settled, there is no standing PR.
• Request/Response binding fix is waiting for IETF result next week.

8.   Issues (Dave)

8.1.   Proposed new FAPI certification test: private_key_jwt client authentication assertion where aud contains multiple values (Filip)

• https://github.com/openid/fapi/issues/403
• related to #501
• see https://github.com/openid/fapi/issues/403 as well.
• Filip is going to record the result of the discussion in the ticket.

8.2.   private_key_jwt audience requirements (Filip)

• https://github.com/openid/fapi/issues/581
• Agreed that the PR is OK.
• Nat to confirm with Torsten.

8.3.   FAPI2SP appears to permit response_types "id_token", "id_token token" and "none" (Dave)

• https://github.com/openid/fapi/issues/577
• Dave to create a PR.

8.4.   FAPI CIBA (Dave)

• https://github.com/openid/fapi/issues/580
• Discussed the changes it needs for supporting FAPI2.
• Whether signing is required or not should be based on whether the base profile requires signing (e.g., FAPI2 Message Signing + CIBA should require it, while FAPI2 Security Profile + CIBA should not.)
• 5.2.2.6
• Assigned to Filip.

8.5.   FAPI2MS: Rejection of non-JAR/non-JARM requests (Filip)

• https://github.com/openid/fapi/issues/576

8.6.   Network Layer Protections restrict use of more recent TLS 1.2 cyphers

• Moving to TLS 1.3 removes the restrictions on the cyphers.

• However, the certification suite does not support TLS 1.3.

  • Nat to create an issue on the tracker regarding this.

9.   AOB (Nat)

• none

The call adjourned at 14:59