-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2025 10 29_Atlantic
Nat Sakimura edited this page Jul 10, 2026
·
1 revision
Date: October 29, 2025
Meeting ID: GMT20251029-135955
Duration: Approximately 46 minutes
- Nat Sakimura (Chair)
- Dave Tonge (Co-chair)
- Brian Campbell (left early)
- Kosuke Koiwai
- Robert Gallagher (Mastercard)
- Joseph Heenan (OIDF & Authlete)
- Dima Postnikov
- Kelley Burgin
- Filip Skokan
- Takahiko Kawasaki
- Bjorn Hjelm
- Christopher Robbertse (Open Banking)
- Imran Ulghar (OBL)
Absent: Mike Leszcz
- NoteWell
- Roll Call (Dave/Nat)
- Adoption of Agenda (Dave/Nat)
- Events (Mike L.)
- External Orgs & Liaisons (Mike L.)
- PRs (Dave)
- Issues (Dave)
- AOB (Nat)
Nat Sakimura opened the meeting and covered the standard OpenID Foundation policies and procedures:
- The OIDF works to provide a safe space where people of many different backgrounds are treated with dignity, decency, and respect
- Participants are required to: - Act with integrity, honesty, and fairness at all times - Treat all individuals with dignity and respect without regard to race, gender, national origin, age, religion, disability, sexual orientation, or political, business, or technical affiliation - Promote open and inclusive participation - Avoid behavior that could be perceived as exclusionary, harassing, dishonest, or discriminatory - Properly disclose and manage any actual or perceived conflicts of interest - Comply with the OIDF antitrust policy and intellectual property rights policy
- U.S. and international antitrust and competition laws govern the conduct of all attendees and participants in OIDF-sponsored activities
- Each attendee is responsible for knowing the content of the OIDF antitrust policy and complying with it
- Attendees must not use meetings or events as a forum for anti-competitive conduct or engage in discussions that might give rise to allegations of antitrust law violations
- The OIDF Antitrust Policy is available at: www.openid.net/antitrust
- To ensure all OIDF working groups develop specifications that are freely implementable, OIDF requires all contributors to sign the standard form contribution agreement
- The contribution agreement incorporates both the OpenID Intellectual Property Rights (IPR) Policy and the OpenID Process Document
- All policies are available at: OpenID.net/policies
All participants introduced themselves via the chat window. Brian Campbell noted he would need to leave early.
- The standard agenda was proposed
- No additional items were requested
- The agenda was adopted as presented
Mike Leszcz was not available, so Nat Sakimura read the events update:
- October 20, 2025 - OIDF workshop recording and deck have been published - Available at: https://openid.net/presentations-media/
- November 1-7, 2025 - IETF 124 in Montreal (next week) - Related FAPI topics will be discussed
- November 6, 2025 - FDX Virtual Summit Fall 2025 - Available to FDX members
- OIDF calendar on the website is current and up-to-date
- OIDF Google Calendar is also current
- 2026 OIDF calendar to be reviewed and confirmed by the board soon
- Members are encouraged to send any 2026 events to be added to the calendar to: mike.leszcz@oidf.org
Discussion: No additional events were raised by participants.
- OIDF is currently scheduling end-of-year coordination calls with all ecosystem partners for input into 2026 planning
- Dima Postnikov reported no updates at the moment
- He noted he had missed the last two ecosystem community group meetings
Discussion: No other updates from external partners or liaisons were reported.
Dave Tonge led the PR discussion and apologized for missing the last few calls.
- Link: https://bitbucket.org/openid/fapi/pull-requests/546/diff
- Description: Updating the errata set
- Status: Very straightforward update
- Decision: The group agreed to approve and merge the PR
- This PR is from a while ago
- Decision: The group agreed to leave this for now and not proceed at this time
- Dave mentioned he has some PRs that he still needs to tidy up
- No other PRs were ready to go at this time
Dave Tonge led the issues discussion.
Issue #821 - Use of Non-Standard Port Numbers for HTTPS
- Link: https://github.com/openid/fapi/issues/821
- Discussion: - The issue concerns whether to restrict non-standard ports for HTTPS URLs - Dima Postnikov explained that some OpenID Providers (OPs) may change ports during implementation, which could cause issues for Relying Parties (RPs) that restrict certain ports - This is more of an ecosystem-specific problem rather than a general FAPI issue
- Decision: - The group decided to add implementation advice warning about this scenario - No changes will be made to FAPI conformance tests - Dima would like the ability to add this to ecosystem-specific conformance test profiles - Dave added a note to the issue documenting this decision
Issue #778 - FAPI1 ISO/IEC 25791-1 Review Comments
- Link: https://github.com/openid/fapi/issues/778
- Background: This is a two-part comment from ISO.
- Comment: Instead of listing out algorithms, the spec should refer to a NIST document or similar authoritative source
- Resolution: This has been addressed by referring to BCP195
- Status: Resolved
- Comment: Introducing FAPI-specific headers yields no security benefit and should not be endorsed at the ISO level, as it only constrains implementation
- Proposed Response: - These headers are not security mechanisms; they help to correlate logs and aid in troubleshooting - FAPI-specific headers are used by over a dozen open banking ecosystems and are in high demand - The working group has tried several times to remove them but has received strong pushback from the ecosystems
- Discussion: - Dave Tonge thought the proposed response looked good - No objections were raised by other participants
- Decision: Nat will report to the ISO reviewers with this response
- Note: This was the only substantial comment remaining from the ISO review
Issue #813 - FAPI1 ISO/IEC 25791-2 Review Comments
- Link: https://github.com/openid/fapi/issues/813
- Status: Referenced in chat but not discussed in detail during the meeting
- Raised by: Filip Skokan
- Description: An issue related to JARM (JWT Secured Authorization Response Mode) for registrations
- Status: Dave acknowledged this issue may have "slipped between the cracks" and agreed to pick it up after the meeting
- Status: Already discussed in previous meetings
- Assigned to: Dima Postnikov
- Dave noted that he had promised several calls ago to do a comprehensive review of all open issues to identify which ones can be closed
- He has not been able to complete this review yet
- The group needs someone with time to go through issues and propose which ones to close
Discussion: No other issues were raised for immediate discussion.
- Kosuke Koiwai informed the group that the eKYC (Electronic Know Your Customer) call scheduled immediately after this meeting has been canceled - He received this notification via email from Hodari
- Nat thanked Kosuke for the notification
No other business was raised.
-
Dave Tonge: - Merge PR #546 (Errata Set Update) - Pick up the JARM registration issue after the meeting - Complete review of open issues to identify candidates for closure (ongoing) - Tidy up his own pending PRs
-
Nat Sakimura: - Report to ISO reviewers with the agreed-upon response regarding FAPI-specific headers (Issue #778)
-
Dima Postnikov: - Continue work on authorization code issue - Note: Has interest in adding port restriction testing to ecosystem-specific conformance test profiles
-
All Members: - Submit any 2026 events to mike.leszcz@oidf.org for addition to the OIDF calendar
- PR #546: Approved for merge (Errata Set Update)
- JARM Downgrade PR: Left for now, not proceeding at this time
- Issue #821 (Non-standard ports): - Add implementation advice warning about the scenario - No changes to FAPI conformance tests - Ecosystem profiles may add port restriction testing if desired
- Issue #778 (FAPI-specific headers): - Keep the headers in the specification - Respond to ISO reviewers explaining their value for log correlation and troubleshooting - Note strong ecosystem demand and previous pushback when removal was attempted
- Monitor IETF 124 discussions in Montreal (November 1-7)
- Continue work on open issues and PRs
- Prepare for end-of-year ecosystem coordination calls
- Note: Next eKYC call is canceled
- Meeting ended approximately 10 minutes early
- Duration: Approximately 46 minutes
- Nat thanked everyone for joining
- OIDF Antitrust Policy: www.openid.net/antitrust
- OIDF Presentations & Media: https://openid.net/presentations-media/
- OIDF Calendar: https://openid.net/calendar/
- Bitbucket Repository: https://bitbucket.org/openid/fapi/
Notes prepared from: VTT transcript and Zoom chat log
Meeting format: Virtual (Zoom)