Skip to content

FAPI_Meeting_Notes_2025 11 05_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI Working Group Meeting Notes

November 5, 2025

Meeting Information

Date: 2025-11-05
Time: 14:00 UTC
Meeting Type: FAPI Working Group Call

Attendees

  • Dima Postnikov - Chair
  • Mike Leszcz - OIDF
  • Joseph Heenan - OIDF & Authlete
  • Robert Gallagher - Mastercard
  • Matthew Murphy - Mastercard
  • Hideki Ikeda - Authlete
  • Kosuke Koiwai - KDDI
  • Nat Sakimura - ISO Liaison
  • Imran Ulghar - OBL
  • Ralph Bragg - Radium

Note: Lower attendance due to many colleagues attending IETF 124 in Montreal (November 1-7, 2025)

Agenda

  1. OIDF Note policies
  2. Roll Call
  3. Adoption of Agenda
  4. Events
  5. External Orgs & Liaisons
  6. Pull Requests (PRs)
  7. Issues
  8. Any Other Business (AOB)

1. Administrative and Housekeeping

OIDF Policies and Code of Conduct

Mike Leszcz reviewed the standard OIDF policies:

  • Code of Conduct: Act with integrity, honesty, and fairness; treat each other with respect. Goal is to provide an open and safe environment for everyone to participate.
  • Antitrust Policy: Referenced in note well
  • Contribution Requirements:
    • Signed contribution agreement required to contribute to OpenID Foundation working groups
    • Signed participation agreement required to participate in community groups
  • Policy Location: All policies available at openid.net/policies

Roll Call

  • Attendees asked to drop their names in chat for recording and note-taking purposes
  • Matthew Murphy from Mastercard identified as second-time attendee, participating as observer alongside primary representative Robert Gallagher
  • Mastercard already has signed participation agreement

2. Events and Calendar

Recent and Upcoming Events

Past Events:

Current Events:

  • November 1-7, 2025 - IETF 124 in Montreal (many colleagues attending, explaining lower call attendance)
  • November 6, 2025 - FDX Virtual Summit Fall 2025

Calendar Information:

  • OIDF calendar on website is current and up to date
  • OIDF Google calendar also current
  • Calendar available at: https://openid.net/calendar/
  • 2026 OIDF calendar to be confirmed soon
  • 2026 calendar shared with Board of Directors along with proposed 2026 board election schedule
  • Both will be published and promoted very soon
  • For any 2026 events to be added to calendar, contact: mike.leszcz@oidf.org

3. Ecosystem Engagement

  • Currently scheduling end-of-year coordination calls with all ecosystem partners
  • Purpose: Input into 2026 planning and budgeting

4. Member Reminders

Public Review Periods and Voting

  1. OpenID4VC High Assurance Interoperability Profile (HAIP) 1.0 Final Specification - Public Review Period: Through Monday, December 8, 2025 - Voting Opens: Tuesday, December 9, 2025 - Details: https://openid.net/public-review-period-for-proposed-openid4vc-high-assurance-interoperability-profile-1-final-specification/

  2. Authorization API 1.0 Final Specification - Public Review Period: Through Monday, December 22, 2025 - Voting Opens: Tuesday, December 23, 2025 - Details: https://openid.net/public-review-period-for-proposed-authorization-api-1-final-specification/

5. Pull Requests Discussion

Repository: https://bitbucket.org/openid/fapi/pull-requests/

PR #546

Link: https://bitbucket.org/openid/fapi/pull-requests/546

PR #548

Link: https://bitbucket.org/openid/fapi/pull-requests/548

  • Reviewed and discussed
  • Technical implementation details covered

PR #551

Link: https://bitbucket.org/openid/fapi/pull-requests/551

  • Reviewed during the call
  • Discussion of specification changes

PR #553

Link: https://bitbucket.org/openid/fapi/pull-requests/553

  • Discussed by the working group
  • Technical considerations addressed

PR #552

Link: https://bitbucket.org/openid/fapi/pull-requests/552

  • Reviewed for technical accuracy
  • Implementation implications discussed

PR #549

Link: https://bitbucket.org/openid/fapi/pull-requests/549

  • Technical review conducted
  • Specification alignment verified

PR #545

Link: https://bitbucket.org/openid/fapi/pull-requests/545

  • Comprehensive review
  • Discussion of impact on implementations

PR #540

Link: https://bitbucket.org/openid/fapi/pull-requests/540

  • Earlier PR reviewed
  • Status and next steps discussed

6. Issues Discussion

Repository: https://github.com/openid/fapi/issues

Issue #832: Submit FAPI 2.0 MS IANA Registrations

Link: https://github.com/openid/fapi/issues/832

  • Discussion regarding IANA registrations for FAPI 2.0 Message Security
  • Need to submit registrations to IANA
  • Status and timeline reviewed

Issue #831: Browser Swapping Attacks

Link: https://github.com/openid/fapi/issues/831

  • Security concern regarding browser swapping attacks
  • Technical discussion of attack vectors (See #831)
  • Potential mitigations considered
  • Further analysis needed

NOTE This is not a new attack. It has been discussed extensively in issue #543 back in 2022.

Issue #812: FAPI1 ISO/IEC 25791-2 Review Comments

Link: https://github.com/openid/fapi/issues/812

  • Review comments from ISO/IEC 25791-2 process
  • Addressing feedback from ISO review
  • Need to incorporate comments into specification
  • Discussion of which comments to address and how

Issue #821: Use of Non-Standard Port Numbers for HTTPS

Link: https://github.com/openid/fapi/issues/821

Key Discussion Points:

  • Joseph Heenan raised concerns about non-standard port numbers
  • Ralph raised a new point about the authorization endpoint using non-standard ports
  • Joseph acknowledged this is "pretty bad" if authorization endpoint runs on ports other than 443
    • Likely to cause issues
    • However, considered "very unlikely to happen"
  • Dima understood the point and agreed with the concern

Proposed Solutions:

  • Add note in implementation advice document (short-term)
  • Potentially include in future baseline version if there's another version
  • Dima to suggest approach on the ticket
  • Leave open for another week to gather community feedback

Resolution: Issue remains open pending community input

7. Any Other Business

Holiday Call Cancellations

Proposal by Dima Postnikov:

  • Cancel call on December 25, 2025 (Christmas Day)
  • Cancel call on January 1, 2026 (New Year's Day)
  • Noted as "no-brainers" to cancel
  • Will be included in minutes for review
  • Open to objections or suggestions for other holiday cancellations

Action: To be documented in minutes and circulated for feedback

Issue #740 Resolution and Conformance Testing

Robert Gallagher (Mastercard):

  • Thanked Joseph Heenan and team for resolving Issue #740
  • Expressed appreciation for the work done
  • Previously had been pinged about potential meeting with Mastercard team
  • Requested information about meeting length and duration before scheduling

Joseph Heenan Response:

  • Agreed to take the discussion offline
  • Provided context for the group:
    • Issue relates to FAPI 2 conformance tests
    • Specifically for using client credentials grant without authorization endpoint
    • This is allowed in the FAPI 2 spec
    • Initial versions of tests are ready
    • Tests are waiting for code review and deployment
    • Currently have OP (OpenID Provider) tests; client tests still in progress
  • Will sync with Robert offline to find suitable meeting slot
  • Plan to have Mastercard team try out the tests

Testing and Certification:

  • Joseph noted they typically require 3 successful test runs before launching certification
  • Authlete instance already passes the tests
  • Looking for additional implementations to test

Dima Postnikov:

  • Offered to help with additional testing
  • Mentioned they have a register using the same profile
  • System-to-system implementation standardized on "Pocky"
  • Would be worthwhile to test for full compliance
  • No previous way to test this profile before
  • Will socialize with vendor and/or team when Joseph provides details

Actions:

  • Joseph to provide testing details to Dima
  • Dima to coordinate with vendor/team for testing
  • Joseph to schedule meeting with Mastercard team offline

8. Action Items Summary

  1. Mike Leszcz: - Continue scheduling end-of-year ecosystem partner calls - Publish 2026 calendar and board election schedule - Send calendar updates to community

  2. Dima Postnikov: - Suggest approach for Issue #821 on ticket - Leave Issue #821 open for one week for community feedback - Document holiday call cancellations in minutes (Dec 25, Jan 1) - Coordinate with vendor/team for conformance testing when Joseph provides details - Socialize conformance testing opportunity

  3. Joseph Heenan: - Schedule offline meeting with Robert Gallagher (Mastercard) - Provide conformance testing details to Dima - Complete code review and deployment of FAPI 2 conformance tests - Continue work on client tests (in progress)

  4. All Members: - Review and provide feedback on Issue #821 within one week - Review public review periods for HAIP 1.0 and Authorization API 1.0 - Submit any 2026 events for OIDF calendar

9. Key Links Referenced

Pull Requests:

Issues:

Other Resources:

10. Next Meeting

Date: November 12, 2025 (Next week)

Upcoming Cancellations:

  • December 25, 2025 (Christmas Day) - Proposed cancellation
  • January 1, 2026 (New Year's Day) - Proposed cancellation

Meeting Conclusion

  • Meeting ran longer than expected but covered substantial material
  • Good progress on multiple PRs and issues
  • Strong collaboration between Mastercard and Authlete teams on conformance testing
  • Call ended at approximately 55 minutes

Meeting adjourned by Dima Postnikov

Notes prepared from transcript and chat logs of FAPI Working Group meeting held November 5, 2025

Clone this wiki locally