FAPI_Meeting_Notes_2024 12 18_Atlantic

FAPI WG Meeting Notes - December 18, 2023

Attendees

• Nat Sakimura (Chair)
• Dave Tonge
• George Fletcher
• Mike Leszcz (OIDF)
• Peter Stanley (OBL)
• Chris Wood
• Bjorn Hjelm
• Robert Gallagher (Mastercard)
• Peter Wallach (Mastercard)
• Joseph Heenan
• Dima Postnikov

Agenda

1. Roll Call
2. Adoption of Agenda
3. Events
4. External Orgs & Liaisons
5. PRs
6. Issues
7. AOB

Events & Liaison Updates (Mike L.)

• Shared Signals interop sessions at Gartner IAM Summit in Dallas were successful
• OAuth Security Workshop 2025: Feb 26-28 in Reykjavik, Iceland
  • Final submission deadline: January 12
• Member reminder: Vote to approve proposed Implementer's Draft of OpenID4VP specification is open until December 24th
• UAE FAPI certification is now open
  • First couple of UAE TTPs have been certified
  • Step-by-step certification guide distributed
  • More certifications expected in coming weeks

Schedule Updates

• No calls on December 25th and January 1st
• Calls will resume January 8th with Dave hosting

PRs

• No new PRs to review
• Previous PR about splitting message signing and HTTP signing has been merged

Issues Discussed

1. FAPI 1 Errata - Private Key JWT Audience Restrictions (#714)

• Discussed options for handling private key JWT audience restrictions
• Decision: Wait for underlying specs (OpenID Connect Core or RFC) to be updated before making changes
• Will update example in FAPI 1 as non-normative change
• Agreed to wait and do single errata process rather than multiple updates

2. FAPI WG Charter Update (#425)

• Reviewed proposed charter text changes
• New scope focuses on security and privacy recommendations/protocols for all applications
• Removes specific references to financial use cases and JSON data schemas
• Process requires:
  • Creating complete charter document
  • Submitting to Specs Council
  • 15-day review period
• Dave to email working group for feedback before proceeding

3. JARM IANA Registrations (#703)

• Agreed to proceed with JARM errata process separately from FAPI 1 errata

4. Dynamic Client Registration Discussion

• Discussed future direction of dynamic client registration work
• Potential overlap with OpenID Federation work
• Need to consider:
  • Instance management for native apps/wallets
  • Trust management in FAPI ecosystems
  • Hardware/device attestation requirements
  • Balance between static and dynamic registration options

Next Steps

1. Dave to email working group about charter update
2. Proceed with JARM errata process
3. Schedule meeting to discuss HTTP signing issues with Justin and Taka
4. Continue work on implementation guidelines in new year

Next Meetings

• No meetings December 25th and January 1st
• Next meeting: January 8th, 2024