decentralized-identity / decentralized-identity/presentation-exchange

Examples that show support for regular OIDC flow

Open
#92 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
88
Forks
35
PR merge metrics
No merged PRs in 30d

Description

In the examples section, we should probably also add one example that shows support for a normal OIDC flow.

Given the following OIDC auth request:

```
GET /authorize?
response_type=code
&scope=openid%20verifiable_presentation%20
&client_id=s6BhdRkqt3
&state=af0ifjsldkj
&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
```

The above would benefit from the normalization of a new scope `verifiable_presentation` that indicates that the response will contain a W3C Verifiable Presentation.

Note, if required, one could add the `submission_requirements` parameter which would result in something like the following:

```
GET /authorize?
response_type=code
&scope=openid%20verifiable_presentation%20
&client_id=s6BhdRkqt3
&state=af0ifjsldkj
&nonce=n-0S6_WzA2Mj
&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
&submission_requirements=<...>
```

Currently, the Presentation Exchange spec assumes there is only the distributed claims approach which is not really standardized in the OIDC core spec. It leaves a lot of room how people would interpret "reference". We should still certainly support that.

However, something simpler could also be done. According to OIDC core, the claims can be either included in the `id_token` or through the user info endpoint. Note, the OIDC code flow concludes with an access_token to access the user info endpoint.

Additionally, the current OIDC examples don't provide verifiable presentations, they only provide verifiable credentials. We could include verifiable presentations by using the `client_id` as the `domain` property and `nonce` | `at_hash` as the `challenge` property.

Example using `id_token`:

```
{
"iss": "http://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-0S6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970,
"presentation_submission": { ... },
"vp": {
// ...

"verifiableCredential" : [
// ...
],

// ... the W3C Verifiable Presentation ...
"proof" : {
"challenge": ,
"domain": ,
// ...
}
}
}
```

Example using user info:

```
{
"sub": "248289761001",
// optional presentation submission
"presentation_submission": { ... },
"vp": {
// ...

"verifiableCredential" : [
// ...
],

// ... the W3C Verifiable Presentation ...
"proof" : {
"challenge": ,
"domain": ,
// ...
}
}
```

@OR13 @wyc @csuwildcat any thoughts?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.