Skip to content

FAPI_Meeting_Notes_2025 06 26_Pacific

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI WG Agenda & Meeting Notes (2025-06-26)

Date & Time: 2025-06-27 01:00 UTC

Location: https://zoom.us/j/97456084642?pwd=bTRFVzk4ZmlRK1M3bEprRlN5c3JFZz09

Attendees

  • Anoop
  • Nat
  • Mark
  • Dima
  • Victor

1. Meeting Opening & Policies

The new OpenID Foundation Note Well policy adopted by the Board on June 12th, replacing the previous antitrust policy.

Key points:

  • First page addresses conduct within meetings and events, references code of conduct policy
  • Second page covers:
    • Antitrust policy reference
    • Contribution agreement required for working group participation
    • Participation agreement required for community group participation
  • All policies available at openid.net/policies

https://openid.net/wp-content/uploads/2025/06/OIDF_Groups-Activities-Events-Code-of-Conduct-Policy_Final_2025-06-12.pdf

https://drive.google.com/file/d/1Fny7m6HdP_S0TZmyTX0yJIjMKTnnCI8i/view?usp=sharing

2. Agenda Adoption

Events Update

  • IGF (Internet Governance Forum): Happening today with Gail presenting on a panel
  • OpenID Foundation Japan AIdentity Meetup (last Friday).
    • Great attendance and participation . Focus on MCP and Related Technologies.
  • JF 25: July 1-3 in Geneva
  • IETF: Coming up in 4 weeks in Madrid
  • October 20: OIDF events including workshop prior to IIW
  • November 1-7: IETF 124 in Montreal

OIDF calendar

Liaison/Ext Org

FAPI 2 KSA Profile

  • Certification team working on profile
  • Working with SAMA team. Securing directed funding from SAMA team for development efforts

CMF Chile

  • Recent call confirmed adoption of grant management and RAR
  • Thanks to Dima for his efforts
  • Comprehensive overview of conformance testing and certification provided
  • CMF may adopt FAPI certification when going live in 2026

Canada Open Banking

  • Cleared quiet period post-election
  • Keen to reconnect and update on efforts, especially regarding CFPB developments in US
  • Call scheduled for week after next for whiteboarding session

Member Polls

  • Two current specification polls open for OIDF members:
  • Vote to Approve Proposed OpenID for Verifiable Presentations Final Specification
  • Vote to Approve Proposed Implementer's Draft of OpenID Connect Relying Party Metadata Choices

FAPI 2.0 Test review

  • Pretty close to launching certification tests for FAPI 2 final
  • 1-2 pull requests still need to be merged and retested
  • Proposal to launch tests for both FAPI 2 Security Profile Final and FAPI 2 Message Signing Final simultaneously
  • At least 3 people have run latest test set (without bug fixes)
  • Need rerun once bug fixes are implemented
  • Working group decision required for certification launch
  • FAPI 2 Message Signing Final
    • Spec doesn't exist in final form yet, but high confidence it will exist as currently structured
    • Risk assessment deemed acceptable

Bug Fixes Needed

  • Request URI handling issues (causing some tester confusion)
  • Implicit grant request rejection testing not yet implemented
  • RAR behavior issues when not using signed requests
  • Most issues identified were participant implementation problems rather than test suite bugs

Working Group Decision

Resolution: Working group gives go-ahead for opening FAPI 2 certification by July 7th, with certification team to fix known bugs by then. Earlier launch acceptable if fixes completed sooner.

  • Fix all currently identified issues
  • Retest existing participants
  • No new bug acceptance to avoid prolonged delays

Pull Requests Review

Issues Review

Issue #733: JARM Downgrade

  • Issue relates to providing more explicit guidance text
  • Not urgent as it's for errata
  • Deferred for future discussion

Issue #734: Recommendations Around Handling of Private Keys

  • Discussion on IdPro Slack highlighted lack of explicit guidance on private key security in FAPI specs.

Current Gap:

  • FAPI emphasizes cryptographic keys for security
  • No explicit text on proper key handling, storage, or HSM usage for high assurance cases

Proposed Solutions:

  • Add guidance to key compromise section in FAPI 2 (errata update)
  • Include in implementation deployment guidance
  • Reference existing NIST documents
  • Consider ETSI guidance for cloud wallet scenarios Action Items:
  • Add guidance to key compromise section in next errata
  • Create separate issue for deployment advice
  • Reference external standards appropriately

Issue #732: Allow OAuth 2.0 Attestation-Based Client Authentication

Background: Issue arose from DCP working group work on verifiable credential issuance where mobile wallet apps need to authenticate to credential issuers.

Problem: Traditional FAPI approach with native apps requires either:

  • Shipping secrets (not secure)
  • Per-client dynamic registration (problematic and requires state maintenance)

Proposed Solution - OAuth 2.0 Attestation-Based Authentication:

  • Mobile app gets attestation from backend confirming it's trusted
  • Attestation includes public key owned by official app instance
  • Client authenticates by providing attestation + proof of possession of the key
  • Allows multiple mobile app instances to use same client ID
  • Refresh tokens bound to key instead of client ID

Misc Items

Next Call

Next call will be an Atlantic Call.

Clone this wiki locally