FAPI_Meeting_Notes_2024 09 25_Atlantic

FAPI WG Agenda & Meeting Notes (2024-09-25)

• Date & Time: 2024-09-25 14:00 UTC
• Location: https://zoom.us/j/97456084642?pwd=bTRFVzk4ZmlRK1M3bEprRlN5c3JFZz09

Agenda

• 1.   Roll Call
• 2.   Events
• 3.   External Liaisons
  • 3.1.   USA
  • 3.2.   Canada
  • 3.3.   Chile
  • 3.4.   UAE
• 4.   PRs
  • 4.1.   518 - ID token signing
  • 4.2.   519 - HTTP Signing:
• 5.   Issues
  • 5.1.   #704 - RFC6125 is obsolete:
  • 5.2.   #706 - Signature-req and signature-input-req:
  • 5.3.   #701: FAPI Overview Page text change
• 6.   Any Other Business
• 7.   Action Items

1.   Roll Call

• Nat Sakimura
• Joseph Heenan
• Dave Tonge
• Bjorn Hjelm
• Brian Campbell
• Chris Wood
• Filip Skokan
• Dima Postnikov
• Hideki Ikeda
• Kelley Burgin
• Kosuke Koiwai
• Lukasz Jaromin
• Mark Andrus
• Mike Mitrowski
• Peter Stanley
• Peter Wallach

2.   Events

No material updates.

OIDF calendar on website is current: https://openid.net/calendar/

3.   External Liaisons

3.1.   USA

• LoI with FDX imminent. OIDF is readying the application to be SDO to CFPB but we might not do so depending on how the deal with FDX goes.
• FDX has applied to be SDO to CFPB. https://files.consumerfinance.gov/f/documents/cfpb_application-standard-setting-body-financial-data-exchange.pdf
• CFPB ruling expected in October.
• The first bank will be online six months after.

3.2.   Canada

• Recent meeting with Canadian regulator
• Timeline for implementation is about 2 years behind the US
• FAPI 2 likely to be used
• FDX may be the managing entity if they can set up an organization in Canada

3.3.   Chile

• Workshop planned with CMF on October 2nd
• John Bradley to participate in person; Mike, Mark Hain, and Joseph Heenan presenting remotely
• Registration link to be shared with working group mailing list

3.4.   UAE

• Waiting for mock bank (Ozone) to be ready for conformance test development
• Profile using PAR (Pushed Authorization Requests) and rich authorization requests

4.   PRs

4.1.   518 - ID token signing

• https://bitbucket.org/openid/fapi/pull-requests/518
• Dima Postnikov addressed most comments
• Awaiting further review

4.2.   519 - HTTP Signing:

• Dave Tonge needs to email the working group for adoption of the separate spec
• Mainly involves pulling out HTTP signing into a separate specification

5.   Issues

5.1.   #704 - RFC6125 is obsolete:

• #704
• Brian reviewed the updated RFC reference and found it sufficient
• Dave will incorporate the change, allowing time for review during the public review period

5.2.   #706 - Signature-req and signature-input-req:

• New issue from Taka regarding implementation of HTTP signing
• Concerns about linking signed requests/responses
• Current wording may need clarification
• Dave will make notes and address the issue

5.3.   #701: FAPI Overview Page text change

• #701
• Text change is complete.
• Some discussion on whether 1) Removal of "Financial" makes the scope broader 2) charter change will be simpler to wait until the process document change is implemented.

6.   Any Other Business

None.

7.   Action Items

• Dave to incorporate changes for Issue #704
• Dave to address and clarify Issue #706
• Working group to wait for the process document vote results before proceeding with charter changes
• Nat to review the process for charter changes and report back next week
• (NOTE: Items from the last week still remains)

The meeting adjourned at 14:30 UTC