openid / openid/OpenID4VCI

Pre-Authorized Code Flow: When wallet must include `authorization_details` to the Token Request?

Open
#388 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

clarification ready-for-PR
Dominant language
No language data
Stars
125
Forks
41
PR merge metrics
No merged PRs in 30d

Description

In paragraph 6.1.1
there is the following text

Credential Issuers MAY support requesting authorization to issue a Credential using the authorization_details parameter. This is particularly useful, if the Credential Issuer offered multiple Credential Configurations in the Credential Offer of a Pre-Authorized Code Flow.

From a wallet perspective, it is not clear, IMHO, when authorization_details MUST be included to the token request in Pre-Authorized Code Flow.
From the Issuer perspective, it is also not clear how will can the wallet be informed that it MUST use authorization_details in Pre-Authorized Code Flow.

For instance, taking the example from 6.2 and assuming there was a credential offer with a Pre-Authorized Code Flow

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6Ikp..sHQ",
  "token_type": "bearer",
  "expires_in": 86400,
  "c_nonce": "tZignsnFbp",
  "c_nonce_expires_in": 86400,
  "authorization_details": [
    {
      "type": "openid_credential",
      "credential_configuration_id": "UniversityDegreeCredential",
      "credential_identifiers": [ "CivilEngineeringDegree-2023", "ElectricalEngineeringDegree-2023" ]
    }
  ]
}
  • How wallet would know that it should include authorization_details to the token request (to receive such a response)?
  • The same question can be put also from the Issuer side: In which way issuer conveys to the wallet that it must use authorization_details for a specific credential_configuration_id?

PS: In the authorization code flow, the absence/presence of a scope in the credential_configuration_id meta-data could be used as a hint. If scope is missing probably authorization_details should be used.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with paragraph 6.1.1 and the example in section 6.2, then trace the Pre-Authorized Code Flow requirements for the wallet and issuer. Review the four existing comments for decisions or proposed interpretations. Done means the specification clearly states when authorization_details is required and how that requirement is conveyed to the wallet.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.