-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2026 05 06_Atlantic
- Date: 2026-05-06 14:00 UTC
- Attendees: Nat Sakimura, Mike Leszcz (OIDF), Hideki Ikeda, Imran Ulghar (OBL), Robert Gallagher (Mastercard), Matthew Murphy (Mastercard), Filip Skokan, Christopher Robbertse, Lukasz Jaromin (Raidiam), Bjorn Hjelm, George Fletcher
- Regret: Peter Stanley (OBL), Dave Tonge (Co-chair Moneyhub), Dima Postnikov (Co-chair)
Mike Leszcz read the standard antitrust reminder. The notice references the OIDF antitrust policy, notes that a Contribution Agreement is required to participate in the FAPI Working Group and any other OIDF Working Groups, and that a Participation Agreement is required for OIDF Community Groups. All policies are available at openid.net/policies.
Nat confirmed that all present had signed participation agreements. Attendees were asked to add their names to the chat as part of the roll call.
Nat presented the standard agenda with one addition: item 6 (Migration Policy Discussion), carried over from the 22 April 2026 call. No further items were proposed. Agenda adopted.
Mike Leszcz thanked those who participated in the OIDF Workshop prior to IIW Spring 2026 (27 April), noting good turnout both in-person and online. The workshop recording and slide deck are published at https://openid.net/presentations-media/
- April 27 — OIDF Workshop prior to IIW Spring 2026, Mountain View (recording + deck published)
- May 12–15 — ID4Africa, Abidjan (Gail representing OIDF)
- May 19–22 — EIC 2026, Berlin (multiple OIDF sessions on published agenda)
- May 27–29 — OAuth Security Workshop (OSW), Leipzig, Germany
- June 2 — FIDO Authenticate APAC 2026, Singapore
- June 9–10 — Identity Week Europe, Amsterdam
- June 15–18 — Identiverse, Las Vegas
- June 22–24 — Dice 2026, Copenhagen
- July 18–24 — IETF 126, Vienna
- August 26 — OIDF-J OpenID Summit 2026 Special Edition, Tokyo
- September 1–3 — Global Digital Collaboration Conference 2026, Geneva
- September 14–17 — ISO/IEC JTC1/SC 17 Plenary, Chengdu, China
- October 19–21 — FIDO Authenticate 2026, Carlsbad, CA
- November 2 — OIDF Workshop prior to IIW Fall 2026, Mountain View
- November 3–5 — IIW Fall 2026, Mountain View
- November 14–20 — IETF 127, San Francisco
- December 7–9 — Gartner IAM US, Las Vegas
To submit events for inclusion in the OIDF calendar: mike.leszcz@oidf.org
- OBL UK — Regular check-in call held on 5 May. Update provided on OIDF efforts including the conformance scaling project and next steps. OIDF is working to conduct more regular updates with all ecosystem partners.
- FDX — Mike Leszcz, Gail, and Joseph met with Kevin and John Paul from FDX at IIW. Discussion focused on ongoing collaboration opportunities, with Canada identified as a key near-term area. OIDF has a call with the Canadian team the following day, after which it will follow up with FDX.
-
South America
- Mike Leszcz and Domingos are supporting ecosystem engagement workshops in Peru and Colombia later in May. Presentation will cover the Foundation overview, FAPI and other open data specs, the value of conformance and certification, and ecosystem engagement highlights. Links to be shared when finalised.
- OIDF is supporting a separate event in Colombia sponsored by Authlete and Capgemini, bringing together regulator leaders from South American ecosystems. OIDF's role is presentation support on FAPI and related specifications.
- While in the region, OIDF is planning visits to existing partners and emerging ecosystems in Brazil, Peru, Chile, and potentially others.
- OpenID Federation 1.1 Final Specifications approved: https://openid.net/openid-federation-1-1-final-specifications-approved/
- Vote open until 15 May 2026: Proposed Implementer's Draft of OpenID Connect Advanced Syntax for Claims (ASC) 1.0: https://openid.net/public-review-period-for-proposed-implementers-draft-of-openid-connect-advanced-syntax-for-claims-1-0/
Context: The item was raised originally by Peter (OBL), who was absent today. Christopher Robbertse and Imran Ulghar (OBL) represented that perspective. Peter's concern, as understood, was to stay informed of upcoming specification changes.
Nat summarised the current situation:
- All changes agreed upon for the current errata are in the draft and will be published to openid.net/specs in the near future.
- No further changes beyond what was agreed in January are expected for that errata.
The broader migration policy question concerns future changes — in particular the anticipated need to retire legacy algorithms as part of Post-Quantum Cryptography (PQC) migration. Key points discussed:
- PQC migration will require retiring certain algorithms. NIST has defined several phases for this process; Nat indicated FAPI will likely follow the NIST framework.
- A phased approach was discussed:
- Phase 1: retiring old algorithms for new implementations (new deployments must not use them)
- Phase 2: banning them entirely
- The previously agreed lead-time for such changes is six months.
- Nat will open a dedicated Bitbucket issue to track the PQC/algorithm migration policy formally, so the WG can continue to discuss it in forthcoming calls or via the mailing list.
- Christopher noted he had made a note of the discussion to pass to Peter; Imran confirmed Peter would respond with an update.
Additional note: Nat announced that Dave Tonge has agreed to host a dedicated FAPI CIBA call the following week (13 May 2026), at the same time as the regular WG call.
No PRs were ready to move forward at this time. One PR relating to CIBA was noted as pending; Nat indicated he needs to follow up with Joe on a specific change he wants implemented. Given that the next call (13 May) will be dedicated to the FAPI CIBA topic, this was deferred to the following regular call (20 May).
Nat reviewed the following issues, working through the oldest open tickets. No issues were proposed by attendees.
#487 — RS must check x-fapi-interaction-id is an ASCII string
https://github.com/openid/fapi/issues/487
Outcome: ACTION
FAPI 2 does not include the x-fapi-interaction-id header, so there is little to act on in this context. Nat to contact Mark regarding his draft on the resource server profile. No other comments from attendees.
#293 — PKCE nonce security considerations
https://github.com/openid/fapi/issues/293
Outcome: OPEN
Very old issue (2020); relates to implementation/deployment advice. Waiting for the deployment advice document. The deployment advice document does not yet cover this topic. Nat commented on the ticket; issue kept open pending that document.
#327 — Dynamic client registration management
https://github.com/openid/fapi/issues/327
Outcome: OPEN
Same status as #293 — waiting for the deployment advice document. Kept open.
#469 — Add protocol version and variant
https://github.com/openid/fapi/issues/469
Outcome: CLOSE IN 2 WEEKS (20 May 2026)
Issue has been in backlog for 3 years. Filip Skokan noted this indicates no appetite to progress it. Nat commented on the ticket proposing closure. Will be closed on 20 May 2026 unless someone expresses intent to work on it.
#457 — Create JSON schema for grant management
https://github.com/openid/fapi/issues/457
Outcome: CLOSE IN 2 WEEKS (20 May 2026)
Raised by Stuart Lowe; no grant management specification exists. Issue has been in backlog for 3 years with no progress. Lukasz Jaromin agreed it should be closed, noting it can be reopened if real need arises (the eKYC WG maintains JSON schema for their specs as a reference). Nat commented; issue will be closed on 20 May 2026 unless someone commits to working on it.
#620 — Security profile for CAMARA
https://github.com/openid/fapi/issues/620
Outcome: CLOSED
Raised by Bjorn Hjelm. Bjorn confirmed CAMARA has moved in a different direction, so this is no longer relevant. Issue closed.
#432 — FAPI 2 trust framework structure
https://github.com/openid/fapi/issues/432
Outcome: DEFERRED
Both Dave and Dima were absent today. Deferred to the 20 May call (after the 13 May SIBA-dedicated call).
#618 — Android Carrier OpenID API
https://github.com/openid/fapi/issues/618
Outcome: CLOSED
Bjorn confirmed this is also related to CAMARA and noted there has been no recent progress. Closed in the meeting.
#677 — FAPI FedCM
https://github.com/openid/fapi/issues/677
Outcome: CLOSE IN 2 WEEKS (20 May 2026)
There is a long-running discussion on the W3C side. Last comment was from Brian (linking to his W3C ticket comment). Brian was not present. Nat will close in 2 weeks (20 May) if no further comment is received.
#702 — Multiple HTTP Message Signatures in a request
https://github.com/openid/fapi/issues/702
Outcome: ACTION
Last action: Dave assigned ticket to himself. Nat noted the issue appears outdated and will follow up with Taka (Takahiko Kawasaki). Kept open pending that check.
#700 — FAPI 1.0 Errata
https://github.com/openid/fapi/issues/700
Outcome: CLOSED
Nat proposed closure; no objections from attendees. Issue closed.
#710 — Algorithms for HTTP Message Signatures
https://github.com/openid/fapi/issues/710
Outcome: ACTION
Nat to review the HTTP Message Signatures spec to determine whether this has already been addressed. Old ticket — may have been resolved already but needs double-checking. Nat to follow up with Taka.
#707 — Error codes for HTTP Message Signatures
https://github.com/openid/fapi/issues/707
Outcome: ACTION
Treated as being in the same cluster as #710. Nat will add a comment to the ticket.
#621 — Implementations of FAPI 2 Message Signing
https://github.com/openid/fapi/issues/621
Outcome: OPEN
Tracking ticket to collect known implementations. If you have an implementation of FAPI 2 Message Signing, please comment on the ticket. Kept open.
#709 — The keyId parameter
https://github.com/openid/fapi/issues/709
Outcome: ACTION
Also in the HTTP Message Signatures cluster. No updates from attendees. Nat to check with Taka.
#433 — Track FAPI-compliant RP libraries
https://github.com/openid/fapi/issues/433
Outcome: OPEN
No updates.
#738 — Deprecation of FAPI 2.0 ID2 tests
https://github.com/openid/fapi/issues/738
Outcome: OPEN
Lukasz Jaromin had checked and confirmed the ID2 tests are still in use in UAE. Nat thanked him and asked him to add a comment to the ticket with details so the group can discuss it at the next regular call on 20 May.
Lukasz noted that several tickets covered today drew his attention and he plans to add comments on a few of them. Nat invited everyone to comment on any relevant tickets ahead of the 20 May call.
| Owner | Action | Due |
|---|---|---|
| Nat Sakimura | Open Bitbucket issue to track PQC/algorithm migration policy | Before 20 May call |
| Nat Sakimura | Contact Mark re: resource server profile draft (issue #487) | Before 20 May call |
| Nat Sakimura | Contact Taka (Takahiko Kawasaki) re: issues #710, #709, #702 | Before 20 May call |
| Nat Sakimura | Close issue #469 if no progress claimed by 20 May | 20 May 2026 |
| Nat Sakimura | Close issue #457 if no progress claimed by 20 May | 20 May 2026 |
| Nat Sakimura | Close issue #677 if no further comment by 20 May | 20 May 2026 |
| Hideki Ikeda | Ping Takahiko Kawasaki re: open HTTP Message Signature issues (#710, #709) | Before 20 May call |
| Christopher Robbertse | Share migration policy discussion notes with Peter (OBL) and relay his response | Before 20 May call |
| Lukasz Jaromin | Add comment to issue #738 with details on which ecosystems still use FAPI 2.0 ID2 tests | Before 20 May call |
| All | Comment on any open tickets where you have input, ahead of 20 May call | Before 20 May call |
- 13 May 2026 — Dedicated FAPI-CIBA call (hosted by Dave Tonge; same time slot as regular WG call)
- 20 May 2026 — Regular FAPI WG call
Please send corrections to the FAPI WG mailing list.