Question regarding metadata

[Daniel Fett]

Part 1 currently says:

1. shall support [OIDD] and may support [RFC8414];
1. shall only distribute discovery metadata (such as the authorization endpoint) via the metadata document as specified in [OIDD] and [RFC8414].

What is the meaning/purpose of “only” in the second clause? That metadata should not be distributed through other means than the metadata document? What would be the purpose of this?

[Joseph Heenan]

That metadata should not be distributed through other means than the metadata document?

Exactly, yes. This goes back to the discussion about http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20200601/007785.html

(which didn’t go forward as there was no interest from anyone in the WG or OB UK to take it forward.)

[Dave Tonge]

shall not distribute metadata by any other means….

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/212/clean-up-wording-around-discovery-metadata

‌

[Tom Jones]

what the various sites do with metadata is out-of-scope for open id. Also note that the dictionary element of the aggregated claim distributes metadata.

[Dave Tonge]

Fixed with this PR