Skip to content

FAPI_Meeting_Notes_2025 04 03_Pacific

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI WG Agenda & Meeting Notes (2025-04-03)

The meeting was called to order at 00:00 UTC.

1.   Roll Call (Anoop)

  • Attendees: Nat, Mark, Dima, Anoop
  • Regrets:

2.   Events Update

  • ISO/IEC JTC 1/SC 27/WG5: March 10-15, 2025 in Fairfax
  • ISO/IEC JTC 1/SC 27: March 17-18, 2025 in Fairfax
  • MOSIP Connect: March 11-13 in Philippines
  • IETF Bangkok: March 15-21
  • OIDF Workshop prior to IIW: April 7
  • DCP Working Group meeting prior to the workshop at Google
  • IIW Spring 2025: April 8-10
  • OpenID Federation Interop Event, April 28-30, 2025
  • RSA 2025 (April 28-May 1) in San Francisco
  • EIC in Berlin (May 6-9)
  • Identiverse in Las Vegas (June 3-6)
  • FDX Global Summit (end of April in Washington, D.C.) - Joseph and Gail will present on the benefits of the "blue" profile
  • Federation Interop event in Sweden (end of April)

2.1.   OIDF calendar

OIDF calendar on website is current: https://openid.net/calendar/

3.   Liaison/Ext Org

4.   Pull Requests / Issues Discussion

4.1.   Issue #273 (Security considerations for large access tokens)

  • #273
  • No specific size limit is being proposed
  • The main issue is not just browser limitations but server-side header size limits
  • George Fletcher had proposed text for implementation guidance
  • Adding text to the troubleshooting section of the implementer guide
  • Similar issues exist for State parameter which in some implementations contains scopes that exceed URI limitations

4.2.   Issue #260 (Android app links)

  • #260
  • Multiple sets of guidance exist, including old blog posts from Joseph and Daniel that may be outdated
  • Recent guidance from Dima's ecosystem will be shared
  • Different behaviors observed between Android and Samsung Android that need documentation
  • Security concerns where malicious apps could claim somebody else's URL and respond to redirect requests
  • Issues affecting app-to-app communication specific to Samsung implementation
  • Dima will coordinate with Joseph on this next week

4.3.   Issue #290 (X-FAPI-Interaction-ID)

  • #290
  • Discussion focused on which X-FAPI headers to keep
  • Agreement to maintain X-FAPI-Interaction-ID as it provides value for tracing issues across transactions
  • Need for a customer present/not present header instead of using X-FAPI-Customer-IP-Address
  • Discussion on how to ensure clients set the flag correctly, particularly for background/offline jobs
  • Ecosystem monitoring as a solution for detecting misuse (e.g., if a relying party marks all API calls as customer present)
  • Mark mentioned that none of the other headers are consistently used or reliable:
    • X-FAPI-Auth-Date (time customer logged into RP) is not being used properly
    • Client headers pass-through not used consistently
  • Team will define a customer present flag with a default value (likely false if absent)

4.4.   Issue #306: Webhook support in FAPI

  • Anoop submitted this ticket a long time ago, initially considered for Grant Management
  • FDX has implemented a notification framework using webhooks to inform when data is available or systems are down
  • Dima suggested using Shared Signals for this purpose
  • Mark expressed interest in notification events for the Australian ecosystem
  • Anoop will present FDX requirements at the next call
  • Team agreed to start documenting use cases, potentially recruiting participants from US/Canada

4.5.   Issue #223 (Need of a customer unique/immutable identity as part of ID Token)

  • #223
  • https://github.com/openid/fapi/issues/223
  • This issue dates back to 2019 regarding UK Open Banking implementation
  • UK Open Banking was using consent ID in the subject field of ID tokens
  • This causes problems because consent IDs change (e.g., every 90 days), breaking the persistent user identification
  • Session mix-up scenarios discussed where users may share credentials
  • Nat emphasized that overloading the "sub" claim with something that is not a persistent identifier is a bad pattern
  • The team discussed potentially adding a warning to implementation guidance
  • Anoop will check the latest version of UK Open Banking to see if this is still an issue

4.6.   New Issue: Issuer Identifier with MTLS

  • Mark raised a new concern regarding issuer identifiers when using MTLS
  • Many Australian banks host their discovery document on one domain (e.g., cdr.bank.com.au) but have MTLS endpoints on a different domain (e.g., secure.cdr.bank.com.au)
  • Issue with what the correct issuer should be in this scenario
  • Dima offered to follow up with Mark offline
  • Mark will create a ticket to track this issue

5.   Action Items

  1. Dima to update PR regarding X-FAPI-Interaction-ID
  2. Dima to coordinate with Joseph regarding Android app links issue
  3. Anoop to prepare webhook use cases for next call
  4. Anoop to research current status of UK Open Banking subject claim implementation
  5. Mark to create a ticket on the issuer identifier with MTLS issue

6.   Next Call

Next call will be an Atlantic Call.

Clone this wiki locally