hyperledger-identus / hyperledger-identus/sdk-swift

Support Authorization Code Flow 1a for JWT in the OID4VCI protocol in the Swift SDK

Open
#175 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Swift
Stars
11
Forks
10
PR merge metrics
No merged PRs in 30d

Description

### Proposed feature

The SDK should support the [Authorization Code Flow 1a](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-3.4) the [Wallet-Initiated Issuance after Installation](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-wallet-initiated-issuance-a)

### Feature description

### Story

(1a) The Wallet-initiated flow begins as the End-User requests a Credential via the Wallet from the Credential Issuer. The End-User either selects a Credential from a pre-configured list of Credentials ready to be issued, or alternatively, the Wallet gives guidance to the End-User to select a Credential from a Credential Issuer based on the information it received in the presentation request from a Verifier.

An End-User comes across a Verifier app that is requesting the End-User to present a Credential, e.g., a driving license. The Wallet determines the requested Credential type(s) from the presentation request and notifies the End-User that there is currently no matching Credential in the Wallet. The Wallet selects a Credential Issuer capable of issuing the missing Credential and, upon End-User consent, sends the End-User to the Credential Issuer's End-User experience (Web site or app). Once authenticated and consent is provided for the issuance of the Credential into the Wallet, the End-User is redirected back to the Wallet. The Wallet informs the End-User that Credential was successfully issued into the Wallet and is ready to be presented to the Verifier app that originally requested presentation of that Credential.

### Use case
`Given` the OID4VCI issuer is configured in the cloud-agent and the account for the user is created in the AIM (Keycloak)
`And` the edge agent SDK `knows` the CredentialIssuerMetadata endpoint
`Then` the edge agent fetches the metadata
`And` selects the credential for the issuance
`And` sends the Authorization Request to the OIDC Credential Issuer (cloud-agent)
`Then` the cloud-agent receives the Authorization Request
`And` replies with the redirect to the authentication web page
`Then` the user of the edge agent gets authenticated and receives the [code](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-5.2)
`And` the edge-agent exchange the `code` to the `token`
`And` the edge-agent make the Credential Request to the cloud-agent
`Then` the cloud-agent issues the requested VC

Contributor guide

Open the contributing guide

Research direction

No files or tests are named. Start by locating the SDK's existing OID4VCI metadata, authorization-request, token-exchange, and credential-request flows, then compare them with OID4VCI sections 3.4 and 5.2. Done means the wallet-initiated Authorization Code Flow 1a completes authentication, code exchange, and requested VC issuance.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.