hyperledger-identus / hyperledger-identus/sdk-swift
Support Authorization Code Flow 1a for JWT in the OID4VCI protocol in the Swift SDK
- Dominant language
- Swift
- Stars
- 11
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
### Proposed feature
The SDK should support the [Authorization Code Flow 1a](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-3.4) the [Wallet-Initiated Issuance after Installation](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-wallet-initiated-issuance-a)
### Feature description
### Story
(1a) The Wallet-initiated flow begins as the End-User requests a Credential via the Wallet from the Credential Issuer. The End-User either selects a Credential from a pre-configured list of Credentials ready to be issued, or alternatively, the Wallet gives guidance to the End-User to select a Credential from a Credential Issuer based on the information it received in the presentation request from a Verifier.
An End-User comes across a Verifier app that is requesting the End-User to present a Credential, e.g., a driving license. The Wallet determines the requested Credential type(s) from the presentation request and notifies the End-User that there is currently no matching Credential in the Wallet. The Wallet selects a Credential Issuer capable of issuing the missing Credential and, upon End-User consent, sends the End-User to the Credential Issuer's End-User experience (Web site or app). Once authenticated and consent is provided for the issuance of the Credential into the Wallet, the End-User is redirected back to the Wallet. The Wallet informs the End-User that Credential was successfully issued into the Wallet and is ready to be presented to the Verifier app that originally requested presentation of that Credential.
### Use case
`Given` the OID4VCI issuer is configured in the cloud-agent and the account for the user is created in the AIM (Keycloak)
`And` the edge agent SDK `knows` the CredentialIssuerMetadata endpoint
`Then` the edge agent fetches the metadata
`And` selects the credential for the issuance
`And` sends the Authorization Request to the OIDC Credential Issuer (cloud-agent)
`Then` the cloud-agent receives the Authorization Request
`And` replies with the redirect to the authentication web page
`Then` the user of the edge agent gets authenticated and receives the [code](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-5.2)
`And` the edge-agent exchange the `code` to the `token`
`And` the edge-agent make the Credential Request to the cloud-agent
`Then` the cloud-agent issues the requested VC
Contributor guide
Research direction
No files or tests are named. Start by locating the SDK's existing OID4VCI metadata, authorization-request, token-exchange, and credential-request flows, then compare them with OID4VCI sections 3.4 and 5.2. Done means the wallet-initiated Authorization Code Flow 1a completes authentication, code exchange, and requested VC issuance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100