Skip to content

FAPI_Meeting_Notes_2024 10 23_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI WG Meeting Notes (Atlantic) - 2024-10-23

1.   Participants

  • Peter Stanley (OBL)
  • Nat Sakimura
  • Hideki Ikeda
  • Imran Ulghar (OBL)
  • Kosuke Koiwai
  • Dima Postnikov
  • Peter Wallach (Mastercard)
  • Takahiko Kawasaki
  • Bjorn Hjelm
  • Joseph Heenan (OIDF & Authlete)
  • Brian Campbell
  • Filip Skokan
  • Dave Tonge

2.   External Organizations Updates

2.1.   CFPB Rule

  • New CFPB rule published on October 22, 2024
  • OpenID Foundation Board of Directors' Open Banking subgroup will meet to discuss and prepare recommendations
  • Recommendations will be presented at next Monday's board meeting
  • Link shared: CFPB Final Rules on Personal Financial Data Rights

2.2.   Upcoming Events

  • IIW next week
    • Several members confirmed attendance (Bjorn Hjelm, Dima Postnikov, Joseph Heenan)
    • Regular FAPI call will still be held as it's early enough (7 AM Pacific Time)
  • IETF meeting scheduled for the following week

3.   Pull Requests and Issues Discussion

3.1.   PR #522 - Audience/Issuer Discussion

  • Extended discussion on audience claim requirements
  • Key points of debate:
    • Whether to enforce string-only audience values vs. allowing arrays
    • Interoperability concerns with strict enforcement
    • Migration challenges for existing FAPI 1.0 implementations
    • Security implications of different approaches
  • Takahiko Kawasaki noted that the key consideration should be whether array elements should be limited to one, rather than the format itself
  • Decision: Further offline discussion needed to reach consensus

3.2.   PR #521 - Attacker Model Document

  • Received push back regarding security considerations section
  • Compromise reached to add minimal text stating "this entire document consists of security considerations"
  • Working group approved this approach
  • PR ready to be merged with current approvals

4.   Issues Discussion

4.1.   Issue #712 - use_mtls_endpoint_aliases naming

  • Awaiting response from Mike
  • Current naming follows existing metadata convention
  • Further clarification may be needed for new readers

4.2.   Issue #703 - JARM IANA Registrations

  • Brian Campbell volunteered to make the technical changes
  • Process for republishing and implementation needs to be determined

5.   Certification Updates

Joseph Heenan announced:

  • Certifications now open for:
    • FAPI 2 Security Profile
    • Message Signing Implementers Draft with DPoP
  • Official communication pending
  • Will be announced on OpenID.net and mailing list

6.   Next Steps

  1. Continue offline discussions regarding audience/issuer requirements
  2. Move forward with JARM IANA registration updates
  3. Progress on FAPI 1.0 errata
  4. Prepare for HTTP signatures work
  5. Address CIBA issues
  6. Work on next draft of message signing

6.1.   Next Meeting Next Week same time.

  • Confirmed for next week
  • Regular time slot maintained despite IIW conference

The meeting ended 20 minutes early.

Clone this wiki locally