Repository navigation
FAPI_Meeting_Notes_2026_09_ 17_Pacific
Date: 2026-09-17
Time: 17:00 PST
Location: Zoom
Please review the OIDF All referenced policies are published at https://openid.net/policies.
| Name | Affiliation |
|---|---|
| Nat Sakimura (Chair) | NAT.Consulting |
| Dima Postnikov (Co-Chair) | Individual |
| Anoop Saxena (Co-Chair) | Individual |
| Phillip Koumides | Australian Treasury (Data Standards Body, CDR) |
| Alfred Ho | Australian Treasury (Data Standards Body, CDR) |
The default agenda was adopted:
- Roll Call
- Adoption of Agenda
- Events
- External Orgs & Liaisons
- PRs
- Issues
- AOB
| Dates | Event | Location |
|---|---|---|
| 2026-08-26 | OIDF-J OpenID Summit 2026 Special Edition | Tokyo |
| 2026-09-01 to 2026-09-03 | Global Digital Collaboration Conference 2026 | Geneva |
| 2026-08-31 | DCP and DCHP WG meetings (ahead of GDC) | Geneva |
| 2026-09-14 to 2026-09-17 | ISO/IEC JTC 1/SC 17 Plenary | Chengdu, China |
| 2026-10-19 to 2026-10-21 | FIDO Authenticate 2026 | Carlsbad, CA |
| 2026-11-02 | OIDF Workshop prior to IIW Fall 2026 | Mountain View |
| 2026-11-03 to 2026-11-05 | IIW Fall 2026 | Mountain View |
| 2026-11-14 to 2026-11-20 | IETF 127 | San Francisco |
| 2026-11-17 to 2026-11-18 | Finance of Tomorrow | Rio de Janeiro |
| 2026-12-07 to 2026-12-09 | Gartner IAM US | Las Vegas |
| 2027-02-02 to 2027-02-04 | 2027 OIDF Global Conference (save the dates) | London |
2027 events for inclusion on the calendar should be sent to mike.leszcz@oidf.org.
Two votes are open and member participation was requested. Abstentions count towards quorum.
| Vote | Closes |
|---|---|
| Proposed Implementer's Drafts of two OpenID Federation extensions | Friday 2026-09-04, 12:00 PT |
| Proposed Implementer's Draft of OpenID Connect Key Binding (noticed 2026-08-10) | Monday 2026-09-07, 12:00 PT |
Mark Haine has stepped down as OIDF Technical Director to focus on another project, and the Foundation is now recruiting a replacement. [Editorial flag 4] Attendees were asked to circulate the job description to anyone who might be interested.
The background (Phillip/Dima) : the Australian CDR (Open Banking in Australia) is migrating to FAPI 2.0. The DSB has prepared a FAPI 2.0 profile and is seeking help from working group participants to review parts of it.
The text as posted:
The Data Standards Body (DSB) is continuing work on proposed changes to the Australian Consumer Data Right (CDR) Standards to support the adoption of FAPI 2.0 (CD210 – FAPI 2.0 Alignment). To support the ongoing development of these standards, the DSB is seeking expressions of interest from participants who would like to contribute to the review. A representative from Treasury will also be attending the FAPI Working Group Atlantic call on 26 August to support engagement on these proposed changes. To register your interest, please contact
contact@dsb.gov.au.
Phillip Koumides raised the FAPI 2.0 Security Profile clause requiring that the authorization server:
shall distribute discovery metadata (such as the authorization endpoint) via the metadata document as specified in [OIDD] and [RFC8414];
The CDR is currently built on OpenID Connect profiles and mandates the OIDD (/.well-known/openid-configuration) endpoint only. Phillip's question: if RFC 8414 metadata discovery is not also mandated, is the ecosystem still FAPI 2.0 compliant, or are both required?
Outcomes (Review and follow up from Atlantic call:
- Joseph Heenan opened issue #862 on the "and" wording around discovery in the FAPI 2.0 Security Profile. He noted that, having looked at the text again, he is no longer confident the conformance suite interprets it correctly, so the wording needs to be pinned down before anything else follows.
- Joseph Heenan opened issue #863 covering the suggested additional conformance test for discovery consistency.
- Dima's recommendation for the CDR specifically: given a closed OpenID Connect-only ecosystem, mandate that clients use the OIDD endpoint outright. Servers may still publish both.
- Phillip indicated the DSB is comfortable proceeding with OpenID Connect Discovery for now, and will consider mandating an OAuth discovery endpoint if it proves to be required — noting it means additional implementation work for authorization server operators even though the metadata itself would be identical.
Issue #857, opened by Joseph Heenan, concerns claim-name consistency in Grant Management. The normative text defines a last_updated field, while the example uses last_updated_at.
-- Related: issue #648
Nat Sakimura noted he has circulated an intent to progress the FAPI 1.0 private_key_jwt-related work on 2026-09-09, referencing issue #848. He asked that Peter Stanley be connected on it.
Issue #849 was revisited, having last been discussed two weeks earlier; Nat noted the AI space moves fast enough to warrant frequent refreshes.
| Item | Link |
|---|---|
| Notice of vote — two OpenID Federation extensions | https://openid.net/notice-of-vote-to-approve-proposed-implementers-drafts-of-two-openid-federation-extensions/ |
| Notice of vote — OpenID Connect Key Binding | https://openid.net/notice-of-vote-for-proposed-implementers-draft-of-openid-connect-key-binding/ |
| OIDF seeks Technical Director | https://openid.net/openid-foundation-seeks-technical-director/ |
| 2027 OIDF Global Conference | https://openid.net/conference/ |
| DSB expression of interest | contact@dsb.gov.au |