ICM 0.3.0 - preparing the scope for meta-release Spring25

[jpengar]

Problem description

This issue should serve for collecting topics to be addressed by next release of ICM.
Please add your proposals in the comments and open issues if needed.

Meta-release Spring25

M0:

• 30/09/2024 kick-off preparation

M1 (Commonalities & ICM):

• 15/10/2024

Ref: Milestone activities

Expected action

The WG should review as candidates those issues labeled with ICM-backlog to decide whether to include or discard them (at least for now). And WG participants can submit new proposals for the next release to be considered as well.

Proposed candidate topics:

• Documentation improvements
  • Improve Access and User Consent document #182. This PR is now split into:
    • PR #182 split - terms and definitions (part 1 of 3) #212
    • PR #182 split - better english improvements (part 2 of 3) #213
    • PR #182 split - info.description template review (part 3 of 3) #214
      • 📢They jointly fix issues 178, 190 and 200 (also partially fixed by PR 201).
  • The wording in the Mandatory template for info.description is unclear #178
  • ICM text should not state that Telco Operators are the ones providing these APIs #190
  • Clarity on the use of login_hint #191
  • Generalize documents by using "API provider" rather than "Telco Operator" #200
    • Replace telco and operator by more general terms #201 (Fixes profile document)
    • 📢ICM doc "CAMARA APIs access and user consent management" is fixed by PRs 212, 213 and 214 above.
  • OIDC authorization code flow error response #209
    • error_response_missing_openid_scope #210
  • New sections with error scenarios #211
    • Add response codes for error scenarios #220
  • Clarify case sensitivity of parameter names and values #221
  • Add exemples full CIBA flow for CIBA in CAMARA-ICM-examples.md #236
    • Update CAMARA-ICM-examples.md with CIBA examples #237
• CAMARA Security and Interoperability Profile - Restrictions
  • Proposal to Mandate Use of Signed Authentication Requests for CIBA #194
    • Recommend signed authentication requests for CIBA #217
  • Spring25: Proposal to RECOMMEND the use of Signed Request Object for the /authorize endpoint to prevent abuse #205
    • recommend auth code flow using signed requests #226
  • Proposal for CAMARA mandated minimum acceptable JWT token lifetime #208
    • Update section on client authentication #216
• New features
  • DPoP support in CAMARA OIDC Profile #125
    • Clarifications on using sender-constraint tokens DPoP #225
  • Allow to use operator_token (from TS43) to identify device on authentication request  #145
    • operator token login_hint format #218
• ...

Additional context
This issue is analogous to the one open in Commonalities: camaraproject/Commonalities#273

[eric-murray]

I added the following issue as a candidate for 0.3.0

• Proposal to Mandate Use of Signed Authentication Requests for CIBA #194

[murthygorty]

Let's please consider this issue for 0.3.0
DPoP support in CAMARA OIDC Profile #125

@gmuratk @mengan @AxelNennker

[shilpa-padgaonkar]

Please consider #145

[jpengar]

• Next Steps:
  • Should we start talking about the candidates to decide whether to include them in Spring25? Or do it after the M0 date and wait for more candidates until then?
  • Should we already include all ICM backlog labeled issues in the list of candidates for analysis, i.e. to decide if they will eventually be part of Spring25 scope?
  • Should we start working on PR Improve Access and User Consent document #182 and the rest of the documentation topics that seem to be needed for sure for Spring25?

[jpengar]

#200 was requested by @tanjadegroot. I'll add it to the list of candidates, as agreed in today's WG call.

[jpengar]

spring25-candidate label created for explicitly requested items as candidates for the next meta-release scope.

As agreed in today's WG call, other items labeled with ICM-Backlog but not explicitly requested by the issue owner or other WG participants will not be considered candidates by default, to avoid the overhead of having technical discussions about them without the support of the owner or other participants behind it.

[mhfoo]

Please consider #205 for Spring25-Candidate
@jpengar @AxelNennker

This is reopening Issue #128

[jpengar]

#211 is proposed as a Spring25 candidate.

[jpengar]

The versioning of the Spring25 release will be reviewed according to #207 and camaraproject/ReleaseManagement#94. So it may not end up being r0.3.0. cc @eric-murray @hdamker

[jpengar]

Added #208, which was missing from the list of candidates.

[jpengar]

Added #209 just fixed by #210, which was missing from the list of candidates.

[jpengar]

Heads up: The M1 milestone date has now passed and ICM has not proposed PRs for some of the listed issues that have been requested to be included in the Spring25 meta-release scope.

[jpengar]

Added @eric-murray's PR #221, which I missed.

[jpengar]

Added @AxelNennker's PR #225 and updated the status of issues and PRs.

[jpengar]

Added @AxelNennker PR #226 intended to fix #205

[jpengar]

ICM alpha release available at https://github.com/camaraproject/IdentityAndConsentManagement/releases/tag/r2.1

[jpengar]

Updated issue description according to current meta-release scope status. Added @sebdewet PR #237 intended to fix #236