Normative references to drafts in FAPI 1.0 Advanced

[Brian Campbell]

FAPI 1.0 Advanced Final has normative references to draft specifications that are not themselves final. Which is really kind of improper form for standards and creates risk/uncertainty/etc. for would-be implementers.

PAR and JAR link to their respective datatracker htmlized versions (https://tools.ietf.org/html/draft-ietf-oauth-par & https://tools.ietf.org/html/draft-ietf-oauth-jwsreq) which do show some indication (if you know what you’re looking at) of their RFC status that came after FAPI 1.0 final was published. And I don’t think there were any significant or breaking changes in the meantime. They should maybe be updated in a future errata to point to the actual RFCs?

JARM links to the head revision of a markdown file in the Bitbucket git repo https://bitbucket.org/openid/fapi/src/master/Financial_API_JWT_Secured_Authorization_Response_Mode.md which seems rather problematic to me. And I’m honestly not sure what can be done to improve it. But I think maybe an effort to get JARM finalized is needed?

‌

[Dave Tonge]

double check that there were no breaking changes to JAR or JARM and then update refs

[Brian Campbell]

Discussed on May 24 ‘23 call - reasonably sure there were not breaking changes so what’s needed for errata is only updating refs:

JAR -> RFC9101 maybe using https://www.rfc-editor.org/rfc/rfc9101.html

PAR -> RFC9126 probably w/ https://www.rfc-editor.org/rfc/rfc9126.html

JARM -> https://openid.net/specs/oauth-v2-jarm.html

‌

[Joseph Heenan]

Issue #615 was marked as a duplicate of this issue.

[Dave Tonge]

fixes #468 - Normative references to drafts in FAPI 1.0 Advanced

→ <<cset 4d8ec9831d53>>

[Dave Tonge]

Merged in fapi1_errata_468 (pull request #423)

fixes #468 - Normative references to drafts in FAPI 1.0 Advanced

Approved-by: Dima Postnikov Approved-by: Dave Tonge Approved-by: Nat Sakimura Approved-by: Joseph Heenan

→ <<cset 73bb071972f3>>