FAPI_Meeting_Notes_2025 05 15_Pacific

FAPI WG Agenda & Meeting Notes (2025-05-15)

• Date & Time: 2025-05-16 01:00 UTC
• Location: https://zoom.us/j/97456084642?pwd=bTRFVzk4ZmlRK1M3bEprRlN5c3JFZz09

Agenda

• 1.   Roll Call (Anoop)
• 2.   Events Update
  • 2.1.   OIDF calendar
• 3.   Liaison/Ext Org
• 4.   Pull Requests / Issues Discussion
  • 4.1.   Issue #273 (Security considerations for large access tokens)
  • 4.2.   Issue #290 (X-FAPI-Interaction-ID)
  • 4.3.   Issue #223 (Need of a customer unique/immutable identity as part of ID Token)
  • 4.4.   New Issue: Issuer Identifier with MTLS#. [ Follow up from last call ]
  • 4.5.   Issue #537 - DPoP vs MTLS
  • 4.6.   Issue #726: Create an ecosystem comparison table
• 5.   Next Call

The meeting was called to order at 00:00 UTC.

1.   Roll Call (Anoop)

• Attendees: Nat, Mark, Dima and Anoop
• Regrets:

2.   Events Update

• June 3-6 - Identiverse - Las Vegas
• June 17-18 - Identity Week Europe 2025 - Amsterdam
• July 19-25 - IETF 123 - Madrid

2.1.   OIDF calendar

OIDF calendar on website is current: https://openid.net/calendar/

3.   Liaison/Ext Org

4.   Pull Requests / Issues Discussion

4.1.   Issue #273 (Security considerations for large access tokens)

• https://github.com/openid/fapi/issues/273
• PR is created https://bitbucket.org/openid/fapi/pull-requests/539

4.2.   Issue #290 (X-FAPI-Interaction-ID)

• #290
• Dima added three decisions to #290

https://github.com/openid/fapi/issues/290

4.3.   Issue #223 (Need of a customer unique/immutable identity as part of ID Token)

• #223
• https://github.com/openid/fapi/issues/223
• Dave will add content to deployment advice document about using PPID or similar. Review the issue 223.

4.4.   New Issue: Issuer Identifier with MTLS#. [ Follow up from last call ]

• Mark raised a new concern regarding issuer identifiers when using MTLS
• Many Australian banks host their discovery document on one domain (e.g., cdr.bank.com.au) but have MTLS endpoints on a different domain (e.g., secure.cdr.bank.com.au)
• Issue with what the correct issuer should be in this scenario
• Dima offered to follow up with Mark offline
• Mark will create a ticket to track this issue

4.5.   Issue #537 - DPoP vs MTLS

https://github.com/openid/fapi/issues/537

Dave is documenting - https://bitbucket.org/openid/fapi/pull-requests/540

4.6.   Issue #726: Create an ecosystem comparison table

Dima started a Google doc (not yet shared with everyone) https://github.com/openid/fapi/issues/726 Action Items ============

5.   Next Call

Next call will be an Atlantic Call.