-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2025 06 25_Atlantic
Nat Sakimura edited this page Jul 10, 2026
·
1 revision
- Nat Sakimura (Chair)
- Mike Leszcz - OIDF
- Dima Postnikov
- Kosuke Koiwai
- Jake Fenley
- Joseph Heenan (OIDF & Authlete)
- Peter Wallach (Mastercard)
- Chris Wood
- Hideki Ikeda
- Bjorn Hjelm
- Brian Campbell
- Christopher Robbertse - Open Banking
Mike Leszcz introduced the new OpenID Foundation Note Well policy adopted by the Board on June 12th, replacing the previous antitrust policy. Key points:
- First page addresses conduct within meetings and events, references code of conduct policy
- Second page covers:
- Antitrust policy reference
- Contribution agreement required for working group participation
- Participation agreement required for community group participation
- All policies available at openid.net/policies
Agenda was adopted without modifications.
- IGF (Internet Governance Forum): Happening today with Gail presenting on a panel
- GC25: July 1-3 in Geneva
- IETF: Coming up in 4 weeks in Madrid
-
OpenID Foundation Japan AIdentity Meetup (Last Friday):
- Hybrid event with 50 people face-to-face
- Over 600 online registrations, 300+ concurrent participants
- Total attendance exceeded 500
- Focus on MCP and related technologies
- Certification team working on profile
- In contact with SAMA team on their profile
- Support from Chris Michael and Ozone team
- Securing directed funding from SAMA team for development efforts
- Recent call confirmed adoption of grant management and RAR
- Thanks to Dima for his efforts
- Comprehensive overview of conformance testing and certification provided
- CMF may adopt FAPI certification when going live in 2026
- Cleared quiet period post-election
- Keen to reconnect and update on efforts, especially regarding CFPB developments in US
- Call scheduled for week after next for whiteboarding session
Two current specification polls open for OIDF members:
- Vote to Approve Proposed Implementer’s Draft of OpenID Connect Relying Party Metadata Choices Starts: June 21, 2025 Ends: July 5, 2025
- Vote to Approve Proposed OpenID for Verifiable Presentations Final Specification Starts: June 24, 2025 Ends: July 8, 2025
- Pretty close to launching certification tests for FAPI 2 final
- 1-2 pull requests still need to be merged and retested
- Proposal to launch tests for both FAPI 2 Security Profile Final and FAPI 2 Message Signing Final simultaneously
- Spec doesn't exist in final form yet, but high confidence it will exist as currently structured
- Risk assessment deemed acceptable
- At least 3 people have run latest test set (without bug fixes)
- Need rerun once bug fixes are implemented
- Working group decision required for certification launch
- No formal policy exists for certification launch timing
- Working group can decide based on certification team recommendation
- Current assessment: tests ready pending identified fixes and participant retesting
- Request URI handling issues (causing some tester confusion)
- Implicit grant request rejection testing not yet implemented
- RAR behavior issues when not using signed requests
- Most issues identified were participant implementation problems rather than test suite bugs
Resolution: Working group gives go-ahead for opening FAPI 2 certification by July 7th, with certification team to fix known bugs by then. Earlier launch acceptable if fixes completed sooner.
Conditions:
- Fix all currently identified issues
- Retest existing participants
- No new bug acceptance to avoid prolonged delays (as suggested by Filip Skokan)
- Potential completion this week or by July 7th at latest
- Tests already available on production server with "potentially incomplete" warning
- Dima confirmed urgency for ConnectID scheme compliance by end of August
Most PRs owned by Dave (who was absent). Group encouraged to review and provide comments or approvals.
Issue #733: JARM Downgrade
- Brian Campbell unable to speak during meeting
- Issue relates to providing more explicit guidance text
- Not urgent as it's for errata
- Deferred for future discussion
Issue #734: Recommendations Around Handling of Private Keys (Joseph Heenan)
Discussion on IdPro Slack highlighted lack of explicit guidance on private key security in FAPI specs.
Current Gap:
- FAPI emphasizes cryptographic keys for security
- No explicit text on proper key handling, storage, or HSM usage for high assurance cases
Proposed Solutions:
- Add guidance to key compromise section in FAPI 2 (errata update)
- Include in implementation deployment guidance
- Reference existing NIST documents
- Consider ETSI guidance for cloud wallet scenarios
Action Items:
- Add guidance to key compromise section in next errata
- Create separate issue for deployment advice
- Reference external standards appropriately
Issue #732: Allow OAuth 2.0 Attestation-Based Client Authentication (Joseph Heenan)
Background: Issue arose from DCP working group work on verifiable credential issuance where mobile wallet apps need to authenticate to credential issuers.
Problem: Traditional FAPI approach with native apps requires either:
- Shipping secrets (not secure)
- Per-client dynamic registration (problematic and requires state maintenance)
Proposed Solution - OAuth 2.0 Attestation-Based Authentication:
- Mobile app gets attestation from backend confirming it's trusted
- Attestation includes public key owned by official app instance
- Client authenticates by providing attestation + proof of possession of the key
- Allows multiple mobile app instances to use same client ID
- Refresh tokens bound to key instead of client ID
Benefits:
- Enables asymmetric key-based authentication in native mobile apps
- Avoids dynamic client registration complexity
- Maintains FAPI security properties
- Addresses exploding number of clients (AI agents, etc.)
Current Status:
- IETF draft not yet finalized
- Changes expected around Madrid IETF meeting
- VCI spec may reference FAPI but ignore client authentication requirements
- High assurance interoperability profile expected to mandate this method
Working Group Position:
- Good to keep on radar
- Security analysis needed (similar to FAPI 2)
- Suitable for FAPI 2.1 or future extension
- Revisit after Madrid IETF for stable version
FAPI 2.0 for Identity-Only Use Cases:
- Mark's ecosystem only needs ID tokens, no API access
- No refresh tokens or access tokens required
- Current FAPI 2 spec mandates client support for refresh tokens
- Question: Can this be profiled for identity-only scenarios?
- Dima to raise formal issue
- May be candidate for FAPI 2.1 or OpenID Connect profile for FAPI 2.0
- Joseph Heenan: Complete FAPI 2 test suite bug fixes by July 7th (or earlier if possible)
-
Dima Postnikov:
- Coordinate participant retesting once fixes are complete
- Raise formal issue for identity-only FAPI 2 use cases
-
Nat Sakimura:
- Send note to mailing list about FAPI 2 certification approval
- Update issue tracking for private key guidance
- All Members: Review and approve pending pull requests
- Working Group: Continue monitoring OAuth 2.0 attestation-based authentication progress
Meeting adjourned at 15:00 GMT. Next steps focused on completing FAPI 2 certification launch preparations and continued standards development work.