Agenda

• Create ICM Release Plan - #146
• Proposal to protect the /authorize endpoint for the Authorization Code Flow (Auth Code Flow) - RFC9101 - #128
• Proposed text on network-based authentication - #173

• Is the service API meant to validate the content of the access token and compare this against the API parameters ? - #174

• OIDC authorization code flow and/or CIBA - #176 

Minutes

Jesús Peña García-Oliva takes on the role of meeting moderator in Axel Nennker 's absence.

Agenda Confirmation:

• • Jesús Peña García-Oliva  shared the agenda prior to the meeting and received no feedback, implying consensus.
  • Priority is on discussing the release plan and related tasks to comply with the release management working group.

Topic Create ICM Release Plan - #146

Release Plan and Alpha Release Discussion:

• • The main topic was whether the alpha release is mandatory.
  • Tanja de Groot explained that the alpha release is primarily for API subprojects to start working with and must be approved by the TSC.
  • Herbert Damker highlighted that the alpha release allows for feedback and significant changes, while the release candidate should only involve bug fixes.
  • Jesús Peña García-Oliva expressed that the scope is almost closed, implying minimal expected changes. He suggested skipping the alpha release and directly generating the release candidate.
    Former user (Deleted) and Herbert Damker both supported skipping the alpha release if there are no significant changes expected.

Decision on Alpha vs. Release Candidate:

• • Also, given the delay from the original schedule, the consensus leaned towards creating a release candidate due to the stable state of the scope and dependencies with Commonalities.
  • Jesús Peña García-Oliva agreed to generate a pull request for the release candidate and handle the process during his upcoming vacation, with Axel Nennker or Sébastien Dewet continuing his work.

Actions:

• • Jesús Peña García-Oliva Create a pull request to generate the release candidate.
  • Team: Review the pull request and ensure smooth transition of tasks during Jesús's vacation.

Conclusion:

The team agreed to proceed with a release candidate directly, bypassing the alpha release, given the stability and closed scope of the current state.

Topic Proposal to protect the /authorize endpoint for the Authorization Code Flow (Auth Code Flow) - RFC9101 - #128

• • Jesús Peña García-Oliva introduced the next topic concerning issue 128.
  • The issue involves a proposal from Telefónica to support the use of RFC 9101.
  • This proposal aimed to address potential problems identified in previous discussions, including issues raised by other members (Vonage, Ming Hui , etc...).

Current Consensus and Opinions:

• • During the last call, there was no consensus on mandating the implementation of RFC 9101.
  • The proposal was to require both clients and operators to implement this RFC to effectively address the identified problems.
  • Feedback from participants, including Orange and Ericsson, indicated a preference against mandating this support at present.

Proposal to Exclude RFC 9101 from the Next Release:

• • Jesús Peña García-Oliva suggested excluding RFC 9101 from the scope of the next meta release also considering the time constraints.
    Former user (Deleted) agreed, recommending that the issue be closed for now and reopened in the future if necessary.

Decision and Next Steps:

• • The group agreed to close issue 128 for the current release cycle.
  • Jesús Peña García-Oliva will close the issue after the call, ensuring the scope for the next release is finalized.

Actions:

• • Jesús Peña García-Oliva Close issue 128 and finalize the scope for the next release.

Conclusion:

Issue 128 will be excluded from the current release, and the scope is now fully defined, allowing the team to proceed with generating the release candidate.

Topic Proposed text on network-based authentication - #173

• • Jesús Peña García-Oliva introduced the next topic, which involves reviewing a pull request affecting documentation included in the upcoming meta release. The pull request was submitted by Axel Nennker to clarify the network-based authentication mechanisms in the CAMARA-API-access-and-user-consent.md document.
  • Jesús is supportive of Axel's proposal and mentioned his own minimal suggestions, which are mainly formatting changes and making terminology more generic (e.g., changing "MSISDN" to "phone numbers"). Jesús suggested a review deadline by the end of the week, after which the pull request could be merged if there were no further comments.
  • Axel also mentioned in the PR that the glossary of terms in the document should be reviewed. However, he proposed this as a separate pull request. Jesús agreed, noting that reviewing and updating the glossary would require a thorough review of the entire document to ensure consistency.

Action Plan:

• • The team was asked to review pull request 173 and provide feedback by the end of the week. If no further comments are received, the pull request will be merged.
  • Herbert Damker Agreed with the proposed plan.
  • No further comments from other participants.

Actions:

• • Team: Review pull request 173 by the end of the week.
  • Jesús Peña García-Oliva Summarize this discussion in the meeting minutes and proceed to merge the pull request if no additional feedback is received.

Conclusion:

The pull request will be reviewed and potentially merged by the end of the week, ensuring the documentation is updated for the next meta release.

Topic Is the service API meant to validate the content of the access token and compare this against the API parameters ? - #174

Topic OIDC authorization code flow and/or CIBA - #176  - er

Action Items

Next meeting: https://lists.camaraproject.org/g/wg-icm/viewevent?repeatid=57069&eventid=2360389&calstart=2024-07-03