FAPI_Meeting_Notes_2025 09 03_Atlantic

FAPI Working Group Meeting Notes

Date: 2025-09-03 14:00-22

Attendees

• Dima Postnikov (Chair)
• Peter Stanley
• Kosuke Koiwai
• Robert Gallagher (Mastercard)
• Peter Wallach (Mastercard)
• George Fletcher (participating via phone while driving)
• Bjorn Hjelm
• Joseph Heenan (OIDF & Authlete)

Apologies

• Dave Tonge
• Nat Sakimura
• Mike L.

---

Agenda Items

1. Roll Call

Completed with attendees listed above.

2. Adoption of Agenda

Agenda adopted without changes.

3. Events

Upcoming Events

September 8-10 - Finance of Tomorrow Conference, Rio de Janeiro - Mark Haine and Domingos Creado representing OIDF

September 10-11 - Identity Week America 2025, Washington, DC

October 13-16 - FIDO Authenticate Conference, Carlsbad, CA - Mike Jones likely to represent OIDF

October 20 - OIDF Workshop (prior to IIW) - NEW DATE based on IIW date changes - Cisco will be hosting the event - Details to be published on Eventbrite - Remote attendance available

October 21-23 - IIW Fall 2025, Mountain View - NEW DATES noted

November 1-7 - IETF 124, Montreal

November 6 - FDX Virtual Summit Fall 2025

Event Information

• All events are published in the OIDF calendar on the website
• OIDF Google calendar is also kept current
• Calendar link: https://openid.net/calendar/

4. External Organizations & Liaisons

Korea Engagement

• Basic introduction engagement with Korea Digital Identity Technology Standard Forum
• They are interested in joining community groups and working groups within OIDF

Member Reminders

FAPI 2.0 Message Signing Final Specification - Notice of Vote published today (September 3, 2025) - Voting period: September 10-24, 2025 - Link: https://openid.net/notice-of-vote-to-approve-fapi-2-message-signing-final-specification/

5. Pull Requests (PRs)

PR #545 - JAM Downgrade Discussion

• Status: Requires review
• Description: Provides guidance on handling responses non-compliant with JAM
• Action: Team members requested to review
• Link: https://bitbucket.org/openid/fapi/pull-requests/545

PR #540 - Deep Certificates and TLS

• Status: Under review with comments to be addressed
• Notes: Several people have reviewed and provided comments that need resolution before proceeding
• Assigned to: Dave Tonge
• Link: https://bitbucket.org/openid/fapi/pull-requests/540/overview

PR #542 - Stop Handles

• Status: Approved, requires merge
• Assigned to: Dave Tonge for merge
• Link: https://bitbucket.org/openid/fapi/pull-requests/542

PR #541 - Implementation Advice Document

• Status: Conflicted, needs resolution before merge
• Description: Provides guidance around fighting headers
• Issues: Merge conflicts need to be resolved
• Link: https://bitbucket.org/openid/fapi/pull-requests/541

PR #529 - CIBA Audience Validation

• Status: On hold (9 months old)
• Description: Straight validation of audience for CIBA
• Notes: Waiting for upstream specs to resolve
• Assigned to: Joe (not present on call)
• Link: https://bitbucket.org/openid/fapi/pull-requests/529

6. Issues

Issue #740 - FAPI 2.0 Conformance Suite for Machine-to-Machine

• Raised by: Robert Gallagher (Mastercard)
• Status: Under discussion
• Description: Request for tailored FAPI 2.0 conformance suite for non-interactive (machine-to-machine) profile

Discussion Points:

• Use Case (Mastercard): Gateway for customers (banks and merchants) that handles OAuth2 compliance, potentially driving high transaction volume
• Use Case (Dima): Factory-based ecosystem with system-to-system calls for reporting and configuration retrieval purposes
• Resolution: Profile is usable and tests can be created
• Effort Estimate: Joseph estimates approximately 2 weeks work for RP tests and OP tests
• Funding: Direct funding helps with prioritization
• Board Consideration: Number of potential certifiers affects board approval

Action Items:

- Robert to provide additional use case examples
- Dima to add his use case example to the issue
- Call for interest from existing ecosystems
- Mention to Ecosystem Support Community Group
- Joseph to provide ballpark quote if funding is pursued

Issue #706 - Signature Requirements

• Status: On hold
• Notes: Requires appropriate attendees for discussion

Issue #739 - FAPI 1.0 Collective Issues

• Status: Under discussion with Ned
• Notes: Ned compiled a list but doesn't contain all changes yet
• Action: Revisit when Ned returns
• Note: Peter Stanley just returned from holiday, no rush to progress

7. Any Other Business (AOB)

• No additional business raised
• Meeting concluded early, returning 30 minutes to attendees

---

Action Items Summary

1. All team members: Review PR #545 (JAM Downgrade)
2. Robert Gallagher: Provide additional use case examples for Issue #740
3. Dima Postnikov:
   • Add use case example to Issue #740
   • Call for interest in machine-to-machine certification
   • Mention Issue #740 to Ecosystem Support Community Group
4. Joseph Heenan: Provide ballpark quote for conformance test development if funding is pursued
5. Dave Tonge:
   • Merge PR #542 (when available)
   • Address comments and conflicts in other assigned PRs

Next Steps

• Await return of Dave Tonge and Nat Sakimura for progression of several PRs
• Continue discussion on Issue #740 based on additional use cases and interest
• Monitor voting period for FAPI 2.0 Message Signing Final Specification (September 10-24)