Skip to content

FAPI_Meeting_Notes_2025 01 22_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

OIDF FAPI WG Meeting Notes - January 22, 2025

Attendees

  • Dave Tonge (Chair)
  • Nat Sakimura
  • Imran Ulghar (OBL)
  • Bjorn Hjelm
  • Robert Gallagher (Mastercard)
  • Lukasz Jaromin (Raidiam)
  • Filip Skokan
  • Kosuke Koiwai
  • Joseph Heenan (OIDF & Authlete)
  • George Fletcher

Apologies: Mike L., Peter

Agenda

  1. Roll Call
  2. Adoption of Agenda
  3. Events
  4. External Orgs & Liaisons
  5. PRs
  6. Issues
  7. AOB

Events Updates

  • OSW 2025: February 26-28 in Reykjavik, Iceland
  • DICE: March 4-5 in Zurich
  • ISO/IEC JTC 1/SC 27/WG5: March 10-15, 2025 in Fairfax
  • ISO/IEC JTC 1/SC 27: March 17-18, 2025 in Fairfax
  • MOSIP Connect: March 11-13 in Philippines
  • IETF: March 15-21 in Bangkok
  • OIDF Workshop prior to IIW: April 7th
  • IIW Spring 2025: April 8-10

External Engagement Updates

Brazil

  • Annual OFB and OPIN FAPI recertifications have begun
  • Team is managing the process

UAE

  • UAE FAPI TTP certifications are now open (priority)
  • UAE OP tests completed by Domingos and in production
  • Awaiting Ozone OP certification requests

FAPI 2 Voting Milestones

  • Final Specification vote announcement: January 25, 2025
  • Final Specification early voting opens: February 1, 2025
  • Final Specification voting period: February 8-15, 2025 (7 days)

Main Discussion Topics

1. FAPI CIBA and OpenID Connect Integration

  • Extensive discussion about whether FAPI CIBA should require OpenID Connect
  • Current status:
    • Core CIBA spec is heavily tied to OpenID Connect
    • Discussion about making it optional in FAPI CIBA profile
    • Concerns raised about maintaining consistency between core CIBA and FAPI CIBA
  • Key points:
    • Could borrow parameters like login_hint from OpenID Connect without requiring full implementation
    • Need to consider impact on existing implementations
    • Agreement to draft potential wording for making OpenID Connect optional

2. Security Considerations

  • Discussion of binding message limitations (#597)
  • Need to reference cross-device BCP and security analysis
  • Tim provided diagram illustrating binding message limitations
  • Agreement to reference relevant sections from cross-device BCP

3. Nordic Bank ID Use Case (#674)

  • Discussion of issue raised by Curity regarding same-device flows
  • Consensus that:
    • Same-device flows should use redirect rather than CIBA
    • Adding special tokens for same-device flows not recommended
    • May be better suited for discussion at OSW

Next Steps

  1. Draft wording for optional OpenID Connect support in FAPI CIBA
  2. Update references in CIBA spec
  3. Add security analysis reference (#718)
  4. Continue reviewing and addressing open CIBA issues

Next Meeting

The next meeting was not explicitly scheduled during this call.

Meeting adjourned after 51 minutes.

Clone this wiki locally