1. OpenID Foundation Avatar OpenID Foundation
  2. WGs
  3. fapi

Wiki

Clone wiki

fapi / FAPI_Meeting_Notes_2022-02-02_Atlantic

View History

FAPI WG Meeting Notes (2022-02-02)

The meeting was called to order at 14:03 UTC.

1.   Roll Call (Dave/Nat)

  • Attending:
    • Ali Adnan
    • Brian Campbell
    • Chris Michael
    • Dave Tonge
    • Dima Postnikov
    • George Fletcher
    • Joseph Heenan
    • Kosuke Koiwai
    • Michael Palage
    • Mike Leszcz
    • Nat Sakimura
    • Domingos Creado
    • Lukasz Jaromin
    • Ralph Bragg
    • Rifaat Shekh-Yusef
    • Takahiko Kawasa
  • Regrets:
  • Guest:

3.   Events (Dave/Nat)

3.1.   Identiverse

June 21, 2022 Denver, Colorado

https://identiverse.com/

Awaiting results for speakers.

3.2.   EIC

The EIC closing date for proposals Feb 28 - https://www.kuppingercole.com/events/eic2022/callforspeakers

OIDF will host workshop on Tuesday, 9:00 AM - 12:30 PM localtiime

Will have a different agenda this year.

  • There will be pre-conference workshops.
  • Deeper technical dive workshops on Wednesday and Thursday.

Presenters are being accepted.

George will talk about Dynamic Client Registration

3.3.   TechSprint (Michael Palage)

FDIC and Fincen event focusing on identity.

Planning on accepting 10 teams/participants for 6-week event.

There will be two weeks at the end of January to solicit interest.

Selected teams will have 6 weeks to formulate proposals and present them to a panel.

Judges will select winners for several categories.

4.   External Organizations (Dave/Nat)

4.1.   Australia (Gail/Mike L.)

There was a call with the CDR team to follow up on FAPI 2 security analysis and identifying which university to participate and maybe in partnership with University of Stuttgart.

There were some discussions about certification for Australia and Joseph will follow up.

4.2.   Brazil (Mike L.)

Currently, still receiving some RP certifications.

Still waiting to confirm details for CIBA certification for Brazil which was originally scheduled for the end of Q1/beginning of Q2. Mostly likely will be extended.

4.3.   Berlin Group (Dave)

Waiting to hear from them. Dave will follow up.

4.5.   GAIN (Gail/Mike L.)

Draft MOU for G5 has been presented for feedback and will be presented to the executive committee this Thursday for review and approval.

Participation agreement has been circulated. Comments are due at the end of today (Feb 2, 2022).

POC agreement will be reviewed with EC Thursday also.

4.7.   ISO/TC68 (Nat/Dave)

  • ISO NP 24377 Natural person identifier (NPI) -- authentication, issuance

and identification

New work is being started. Will need to keep updates on it.

4.8.   The Middle East and North Africa (Ali)

Waiting for OIDF response to MOU.

DFC made a request for a 2 or 3 pager document summarizing what OIDF does so they can explain to counter parties within their organization.

Ali will follow up with Mike and Gail.

4.9.   Nigeria (Gail)

Gail is in talks with Open Banking Nigeria and will have a call in a couple of weeks.

4.13.   USA (Gail)

NIST.IR.8389-draft - https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8389-draft.pdf

We will discuss it as an independent topic below.

5.   Draft NISTIR8389 Cybersecurity Considerations for Open Banking Technology and Emerging Standards

https://docs.google.com/document/d/10GTmFGtyZO96CpigzvZ1kyl5rIqVqsjwfR9IMAay3yk/edit

Comments are Due March 3, 2022

Dima started working on a response.

Dima went over basic structure of document

Basic introduction on Open Banking

Described use cases, current state of various jurisdictions, UK, US, AU, India

People from these jurisdictions should review

Very small section on API security

OIDF can help with this section

Can talk about formal security analysis, OAuth 2 best security practices, best current practices

This section is very concerning since NIST papers are trusted sources of information around the world

Use cases are not comprehensive

Use cases have different importance in different markets

Doesn’t talk about alternatives to card payments and retail payments

Purpose, audience, and significance of the paper are unclear which makes if difficult to decide if it even warrants a response

Title mentions Cybersecurity Considerations but there is not much content regarding it

Response format will be decided depending on the amount of commentary.

WG previously discussed getting in touch with the authors.

Need more feedback from wider audience

Focus feedback on 7.3

6.   Response to OIDF Strategic Taskforce

The Strategic Task Force, a subset of the Board, is keen to learn more about how OIDF might support healthcare and IoT use cases. At least one market is considering FAPI for healthcare. IoT is another area where our standards might find traction. If you or one of your colleagues have experience and relationships in those domains please contact Gail (gail@oidf.org) and/or Mike Lescz(mike.leszcz@oidf.org), as we’re keen to see how we might add value to those domains.

Currently coordinating a call with Deb Bucci, former co-chair of HEART WG, regarding healthcare.

8.   PRs (Dave/Nat)

  • PR #305 - FAPI2 Baseline: Align the chapter etc. structure to FAPI 1
    • OK to merge
  • PR #307 -Rework the TLS section re issue 461

9.   Issues (Dave/Nat)

  • #469 - Add protocol version and variant identifier
    • Need more details on where the version and identifiers are sent, e.g. on every call, at registration etc..
    • Sounds like a version of API security instead of a version of the API. This might confuse people.
    • It’s needed so that appropriate verification methods can be invoked.
    • Might be easier just to document which FAPI version an API conforms to.
    • Building the conformance level into the messaging layer doesn’t seem like a good idea and might create interoperability problems.
    • Need more discussion and a concrete text proposal.
  • #410 - FAPI and UMA 2.0
    • Perform analysis for using UMA with FAPI
    • UK Pensions Dashboard project is planning to use UMA
    • Can be used for delegated authorizations and step up authentication.
    • Can use existing acr claim to do step up authentication.

10.   AOB (Nat)

The call adjourned at 15:00 UTC

Updated