Skip to content

FAPI_Meeting_Notes_2025 05 22_Pacific

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI Working Group Meeting Notes - May 21, 2025

  • Date: 2025-05-21 14:00 UTC
  • Location: Zoom

Attendees

  • Nat Sakimura (Chair)
  • Mike Leszcz (OIDF)
  • Robert Gallagher (Mastercard)
  • Hideki Ikeda
  • Peter Stanley (OBL)
  • Peter Wallach (Mastercard)
  • Jake Fenley
  • Lukasz Jaromin (Raidiam)
  • Christopher Robbertse
  • Dima Postnikov

Agenda

  1. Roll Call
  2. Adoption of Agenda
  3. Events (Mike L.)
  4. External Orgs & Liaisons (Mike L.)
  5. PRs (Nat)
  6. Issues (Nat)
  7. AOB (Nat)

Meeting Notes

OpenID Foundation Antitrust Statement

  • The chair noted that the full antitrust statement is available at www.openid.net/antitrust and was distributed with the previous agenda.

Events (Mike L.)

Mike Leszcz provided the following events update:

  • Gail and Elizabeth are in Ethiopia this week for the City Hub event (Monday) and ID4Africa.
  • Identiverse is coming up with several OIDF presentations scheduled.
  • Other upcoming events:
    • May 20-23: ID4Africa in Addis Ababa, Ethiopia
    • May (date TBD): Rwanda Open Banking Event/Workshop (private) - Mark Haine will participate virtually
    • June 3-6: Identiverse in Las Vegas
    • June 17-18: Identity Week Europe 2025 in Amsterdam
    • July 19-25: IETF 123 in Madrid
    • October 20: OIDF events including workshop prior to IIW
    • November 1-7: IETF 124 in Montreal

The OIDF calendar on the website and Google Calendar are current. Members can contact mike.leszcz@oidf.org with any events for the second half of 2025.

Nat noted there's a board panel on the first day of Identity for Africa, and offered to convey any working group messages if needed.

External Organizations & Liaisons (Mike L.)

  • Working diligently to get FAPI 2 final tests in place
  • Coordinating with Saudi Arabia (SAMA team) as they transition from FAPI 1 Advanced to FAPI 2
    • KSA FAPI profile for FAPI 2 expected in early June to align with their transition milestones
  • Majority of annual FAPI recertifications in Brazil completed for both Open Finance Brazil and Open Insurance

Member Reminders

Mike shared current public review periods for:

  • Proposed Final EAP ACR Values Specification
  • Proposed OpenID Attachments 1.0 Final Specification
  • Proposed OpenID for Verifiable Presentations Final Specification
  • Proposed Implementer's Draft of OpenID Connect Relying Party Metadata Choices

Pull Requests

PR #543

  • Simple title change
  • Already approved by Nat and Joseph
  • Mike approved during the call
  • Will allow JARM spec to move to public review

PR #539

  • Already approved by Nat and Joseph
  • Nat intends to merge after the call if others approve

PR #541

  • There's a pending comment regarding URL-safe values for state parameters
  • Needs concrete proposal or text changes before accepting

PR #540

  • Has ongoing discussions
  • Members asked to review and continue discussions for next week

PR #542

  • Related to FAPI 2 implementation guidance
  • Nat asked members to review it during the week

PR #529

  • Dima had previously commented on this
  • Will need to review again

Issues

Issue #730: FAPI 1 Baseline 5.2.3 Public Client Interpretation

Nat filed this issue just before the call after receiving a question earlier in the day. The issue concerns section 5.2.3 (Public Client) of FAPI 1 Baseline, specifically the interpretation of:

"If 'openid' is not in the scope value, then public client: 9. shall include the state parameter defined in Section 4.1.1 of [RFC6749]; 10. shall verify the scope received in the token response is either an exact match, or contains a subset of the scope sent in the request; 11. shall verify state received in the authorization response is identical to the state provided by the client in the authorization request."

The question is whether points 10 and 11 apply only if 'openid' is not in the scope (as the current text suggests), or if they should apply regardless. Peter Stanley noted that based on the structure, the natural reading would be that all three points (9, 10, 11) are conditional on 'openid' not being in the scope.

Since the test team was not present at the meeting, this discussion will be continued next week.

AOB (Any Other Business)

No additional items were raised.

Nat asked members to review the open issues and add comments before the next meeting. The meeting was adjourned early (returning 35 minutes to participants) as Nat needed to catch an early flight the next morning.

Next Steps

  • Members to review and comment on open issues
  • Members to review the mentioned PRs
  • Continue discussion on Issue #730 next week when test team members are present

Meeting adjourned.

Clone this wiki locally