-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2026 03 11_Atlantic
Nat Sakimura edited this page Jul 10, 2026
·
1 revision
Date: Wednesday, 11 March 2026 Chair: Dima Postnikov (acting; Nat Sakimura traveling)
| Name | Organization |
|---|---|
| Dima Postnikov | (Chair, acting) |
| Mike Leszcz | OpenID Foundation (OIDF) |
| Joseph Heenan | OIDF & Authlete |
| Christopher Robbertse | Open Banking Limited (OBL) |
| Imran Ulghar | Open Banking Limited (OBL) |
| Filip Skokan | (independent) |
| Matthew Murphy | Mastercard |
| Bjorn Hjelm | (independent) |
| Kosuke Koiwai | (independent) |
| Robert (Mstercard | Robert) | Mastercard |
Quorum: Confirmed — 11 participants. Apologies: Nat Sakimura (traveling); also noted absent for this call.
The OpenID Foundation Note Well was displayed on screen at the start of the call. No new participants were present, so no formal introductions were required.
The standard agenda was adopted without modification. No additional items were proposed.
Agenda (as posted in chat):
- Roll Call
- Adoption of Agenda
- Events (Mike L.)
- External Orgs & Liaisons (Mike L.)
- PRs
- Issues
- AOB
Mike Leszcz noted no material updates from the prior week. All events are listed on the OIDF website calendar and the OIDF Google Calendar. The OIDF Spring Workshop (April 27, prior to IIW) is still in planning; a host venue is being confirmed, after which a blog post and registration details will be published.
| Date | Event | Location |
|---|---|---|
| March 9–13 | ISO/IEC JTC 1/SC 27 WG Meeting | Nürnberg, Germany |
| March 14–20 | IETF 125 | Shenzhen, China |
| March 16–17 | ISO/IEC JTC 1/SC 27 Plenary | Nürnberg, Germany |
| March 16–19 | FDX Global Summit 2026 | Washington, DC |
| April 14 | OECD Working Party on Digital Security | Paris |
| April 22–23 | IAM Tech Day | São Paulo |
| April 27 | OIDF Workshop (prior to IIW Spring 2026) | Mountain View |
| April 28–30 | IIW Spring 2026 | Mountain View |
| May 12–15 | ID4Africa | Abidjan |
| May 19–22 | EIC 2026 | Berlin |
| May 27–29 | OAuth Security Workshop (OSW) | Leipzig, Germany |
| June 2 | FIDO Authenticate APAC 2026 | Singapore |
| June 15–18 | Identiverse | Las Vegas |
| June 22–24 | Dice 2026 | Copenhagen |
| July 18–24 | IETF 126 | Vienna |
| September 1–3 | Global Digital Collaboration Conference 2026 | Geneva |
| September 14–17 | ISO/IEC JTC1/SC 17 Plenary | Chengdu, China |
| October 19–21 | FIDO Authenticate 2026 | Carlsbad, CA |
| November 2 | OIDF Workshop (prior to IIW Fall 2026) | Mountain View |
| November 3–5 | IIW Fall 2026 | Mountain View |
| November 14–20 | IETF 127 | San Francisco |
| December 7–9 | Gartner IAM US | Las Vegas |
To add 2026 events to the OIDF calendar, contact: mike.leszcz@oidf.org
- Directed funding to support a new KSA FAPI 2.0 Profile has been received.
- Domingos Creado is leading the development work and is in contact with the Ozone and SAMA teams for profile definition.
- Ecosystem participants will certify to the new profile once it reaches production.
- Ralph Bragg confirmed that Erick Domingues (Raidiam) is the author of the UAE security profile and is holding the pen on its drafting.
- The UAE profile already incorporated all bits from FAPI 2.0 Final that were not present in FAPI 2.0 Implementers Draft 2 (the only available base at the time of drafting).
- The work is therefore mainly a matter of removing content that is now duplicated or superseded by moving to a profile of FAPI 2.0 Final.
- 2026 certifications confirmed.
- The certification programme team is managing a high volume of FAPI recertification requests from the Open Finance Brazil and Open Insurance Brazil ecosystems.
- The CMF (Comisión para el Mercado Financiero) is targeting a FAPI 2.0 Final go-live in the second half of 2026.
- A new implementation partner, Minsate, has been engaged and is expected to provide directed funding to support CMF FAPI 2.0 profile development and implementation.
- Peru is anticipated to go live in a limited fashion toward the end of 2026, with a larger-scale rollout planned for 2027.
- A vote to approve the proposed OpenID Connect Relying Party Metadata Choices 1.0 Final Specification opened on 11 March 2026.
- Members on the call were encouraged to vote and help achieve quorum.
- Link: https://openid.net/notice-of-vote-to-approve-proposed-openid-connect-relying-party-metadata-choices-1-0-final-specification/
- Mike Leszcz noted that weekly ecosystem updates are also posted to the OIDF Slack community and working group co-chair channels.
Dima Postnikov noted that most open PRs were prepared by Matt and Dave over the preceding weeks and require review and approval, assuming no substantive objections. Participants were encouraged to review and approve where possible.
- Summary: Instead of hard-coding key lengths in the specification, this PR references BCP 195 (TLS Best Current Practices) and the IANA registry.
- Discussion: Joseph Heenan raised a concern: it is not immediately clear why TLS best current practices (BCP 195) would govern JWS/JWKS key sizes. He noted he could not locate a strict key-length requirement in BCP 195, and that no specific section is being referenced. He also observed that pointing to a specific section in a BCP that may evolve is inherently awkward.
- Dima recalled a similar concern was raised on the Pacific Call, and that an earlier search for such a requirement in BCP 195 had not found anything definitive. Joseph agreed to post a comment on the PR so Nat can review the reference.
- Status: Under review; Joseph to post a comment. Participants invited to review and approve if satisfied.
- Link: https://bitbucket.org/openid/fapi/pull-requests/562
- Summary: Editorial clarification. Aligns the specification's language so that cipher suites deprecated in BCP 195 are explicitly marked MUST NOT, while cipher suites that are merely not recommended (but not deprecated) are handled separately.
- Status: Review and approval requested.
- Link: https://bitbucket.org/openid/fapi/pull-requests/566
- Summary: Clarifies that FAPI Part 1 and Part 2 use request objects, ID tokens, and JARM to achieve message source authentication.
- Status: Review and approval requested.
- Link: https://bitbucket.org/openid/fapi/pull-requests/565
-
Summary: Editorial clarification ensuring that, where
openidis not in thescopevalue, a particular requirement applies only to the relevant clause. - Discussion: Filip Skokan raised a concern that the PR introduces a break in a numbered Markdown list, which could cause the renderer to restart numbering at 1. Joseph Heenan checked the rendered output and confirmed the list renders correctly — the specific Markdown implementation used appears to handle this case. Dima noted it would be prudent to double-check once the change is published.
- Status: Review and approval requested.
- Link: https://bitbucket.org/openid/fapi/pull-requests/567
- Summary: Editorial. References a specific section of RFC 6749 clarifying what scopes can be returned when not all requested scopes are granted.
- Status: Review and approval requested.
- Link: https://bitbucket.org/openid/fapi/pull-requests/564
- Summary: Addresses the handling of ChaCha cipher suite algorithms — the outcome of several months of discussion. The approach aligns with BCP 195 referencing, permitting only the recommended cipher suites (not merely non-deprecated ones).
- Discussion: Joseph Heenan noted a prior miscommunication about whether the intent was to block deprecated ciphers or to accept only recommended ones. The current implementation in the conformance suite accepts only recommended ciphers and is awaiting release to production.
- Dima asked Joseph to verify how the RFC reference syntax renders in the built artefacts. Joseph confirmed the rendering did not appear as intended; he agreed to post a comment for Nat to review.
- Status: Needs rendering verification (Joseph to comment); awaiting review.
- Link: https://bitbucket.org/openid/fapi/pull-requests/563
- Blocked pending input from Joe (not present on this call). No further action taken; the PR has been open for some time.
Dima opened the issue tracker for review. Participants were invited to raise specific issues for discussion.
Issue tracker: https://github.com/openid/fapi/issues?q=is%3Aissue%20state%3Aopen
Issue #835 — FAPI 5.2 Network Layer Protections (ChaCha Algorithms)
- Link: https://github.com/openid/fapi/issues/835
- Discussion: Joseph Heenan confirmed this issue is substantially addressed. The earlier miscommunication — whether to block deprecated ciphers or to exclusively allow recommended ones — has been resolved. The conformance suite now accepts only recommended cipher suites and the fix is deployed to staging, pending production release.
- Status: Considered resolved pending the production release of PR #563.
- Several issues noted as related to ISO/IEC alignment adjustments (referenced as "ISO 31 adjustments").
- Issue #841 — noted as dealt with.
- Issue #731 — related to message source authentication; noted as addressed by PR #565.
- Issue #806 — a proposal raised in discussion with contributors; Nat had suggested rejection in October 2025. Dima deferred further action until Nat is back on the call, as the issue is approximately five months old and no action has been taken.
- Issue #778 — has an associated PR (#562). No further discussion needed.
- Dima noted he would not progress older issues without Nat or Dave present.
- Robert (Mastercard) attempted to raise a question by voice but could not be heard (microphone issue). He posted in chat asking when his team can help test the new conformance suite release.
- Joseph Heenan confirmed: - The new release (covering cipher suite changes) is already deployed to the staging environment. - Mastercard/Robert's team can begin testing on staging immediately. - Joseph will aim to push the changes to the production environment within approximately one week.
- Action: Robert / Mastercard to contact Joseph Heenan to coordinate staging or production testing.
| # | Action | Owner | Due |
|---|---|---|---|
| 1 | Post comment on PR #562 regarding BCP 195 / JWS key-length reference concern, so Nat can review | Joseph Heenan | Before next call |
| 2 | Post comment on PR #563 regarding RFC reference rendering issue (confirm how syntax renders in built artefacts) | Joseph Heenan | Before next call |
| 3 | Review and approve PRs #562, #563, #564, #565, #566, #567 (where no objections) | All participants | Before next call |
| 4 | Coordinate with Robert (Mastercard) for cipher suite conformance suite testing on staging | Joseph Heenan / Robert (Mastercard) | Within ~1 week |
| 5 | Push cipher suite conformance suite changes to production | Joseph Heenan | Within ~1 week |
| 6 | Confirm host for OIDF Spring Workshop (April 27) and publish blog + registration | Mike Leszcz / OIDF | ASAP |
| 7 | Members to vote on OpenID Connect RP Metadata Choices 1.0 Final Specification to achieve quorum | All OIDF members | Ongoing |
| 8 | Add Member Updates as a standing item on the FAPI WG Atlantic Call agenda |
Dima Postnikov | Next call |
Next call: 18 March 2026 (tentative — standard weekly cadence)