3.1.   EIC (Dave)

Nat, Dave, Joseph, Ralph, etc. would be there.

Proposed workshop timetable: https://docs.google.com/document/d/1IrV_s7djw6tm1Q7iZbfGikqj-DhsgL3loffNCPSPxJg/edit?usp=sharing

3.2.   OAuth Security Workshop (Daniel)

Virtual event planned for Nov 30 - Dec 1, 2021

Daniel is in the process of setting it up before making an official announcement.

4.1.   Mike L. Report

Dave reported Mike's written report.

4.2.   Australia (Dima/Joseph)

Meeting scheduled for Tomorrow and Tuesday next week with ACCC to scope request from John Otway.

4.3.   Berlin Group (Francis)

Setup some time in one of the September WG meetings to discuss how to proceed and clear IP issues on both sides.

OIDF is still performing legal review. Nat will update once there is a definitive answer from OIDF consul (Tom).

OIDF exploring ways to use the model used for the OIDF Workshop “Note Well”. Will show the “Note Well” at the beginning and only those who have agreed to the “Note Well” will be allowed to stay. Awaiting feedback from the consul regarding this matter.

Francis and Danillo will on work on some material and present to the group for feedback.

4.4.   Brazil (Ralph/Taka)

• Last minute change on the spec. Signing is now mandated. Signed JWT. Everyone is madly implementing it.
• Some suggestions to push back the deadline for the submission of the conformance test for Phase 3 to August 30.
• Relying party testing meeting among the certification team planned for tomorrow. The team is considering following the UK examples.
• We may also need to encourage the RP libraries to support FAPI.

4.5.   FDX (Don)

• Expected to adopt FAPI in the next Summit.

4.6.   UK (Ralph/Chris)

• Ver. 3.1.9 is being published. Target release will be end of September.
• CMA supporting Variable Recurring Payment (VRP) for Sweeping transactions..
• Brand new payment type considered in the Roadmap, e.g., Smart Direct Debit. There is nothing similar outside of UKOB.
• Still waiting for CMA9's decision on the next step of the Open Banking IE. Still 2.5 weeks till we learn it.

4.7.   Russia (Don/Dima)

• Russia: Russian Federation: Open API standards https://openbankingrussia.ru/open-api-standards/
• Live ecosystem with FAPI 1.0 I-D2.
• Some certification programme.
• Running in pilot mode, 2 banks and 1 fintech. FAPI 1.0 ID2. 99% up to the spec. Only the difference is the cypher spec. It may be mandated in 1 or 2 years.

5.8.3.5. Криптографические ключи, используемые в протоколе TLS, и ключи протокола OIDC должны быть различными. 5.8.3.6. Должны использоваться только следующие криптонаборы: – TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC (Р 1323565.1.020), – TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC (Р 1323565.1.020), – TLS_GOSTR341112_256_WITH_28147_CNT_IMIT [37].

They had to write their own test suite but there may be value if OIDF could help by supporting their cypher suite.

Dima is reaching out to see how OIDF can help.

6.1.   #433 Track FAPI compliant RP libraries (Dave)

Joseph reported that for iOS AppAuth, it’s pretty much intractable a problem without forking the library, as there are various policies (e.g. supporting a very wide range of iOS versions and not pulling in third party libraries) that make it very hard to support FAPI. It was discussed a bit here https://github.com/openid/AppAuth-iOS/issues/290 though this was a while ago so I don’t know if much has changed. AppAuth is more intended for plain OIDC cases.

Daniel reported that on node.js, there are people uses Filip's library but otherwise they have to write their own.

Stuart reported that on Java side Biza has one for their own use but achieving abstraction is challenging. As a crypto library, Nimbus one seems to be the most popular, but requires a lot of wrappings to make it worthwhile.

Jose4J is another choice for crypto.

Can raise some issues to libraries with active maintainers.

6.2.   #432 FAPI2 Trust Framework structure (Dima)

Looks like there is a consensus on the need for FAPI2 Advanced authorization profile spec.

Naming and diagrams need review to make them less confusing.

New document to be prepared by Dima, Stuart, and Torsten to be adopted by the working group.

Need to come to agreement on names and scope of specs.

6.3.   #429 FAPI Certification with Lodged Intent or RAR - User Consent vs Technical Process Certification

Joseph explained to the WG that testing this is a bit complex, especially on the live bank system.

There is no pushback for the need for it though.

6.4.   #412 FAPI 2.0 - Hard requirement to support Grant Management Requirement

Consensus to remove hard requirement reference to Grant Management from the Baseline.

As a step, there needs to be a new document to put the removed material, then remove the reference.

6.5.   #434 Certification Team Query: error messages shown by OPs (Joseph)

There is a range of possibilities: From factually not incorrect to informative to developers.

Joseph believes the later is more useful for the integration work.

WG opinion is sought.