openid / openid/OpenID4VCI

Multiple interactive authorization types allowed for one flow / allow fallback?

Open
#696 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

iae
Dominant language
No language data
Stars
125
Forks
41
PR merge metrics
No merged PRs in 30d

Description

When using the interactive authorization flow and you want to request presentation of a VP before issuance, it may happen that the user does not have the required credential to satisfy the presentation request.

We have an use case where there's a traditional OpenID based login, and now also a credential is issued based on the same data.

The preferred flow here is to present the credential using OID4VP and IAE. But if the wallet does not have the VC yet, it would be desirable to allow a fallback to the traditional OpenID login flow.

Is this something that could be supported using IAE? IAE allows falling back to redirect_to_web, but that is when you initially start the session.

Can a wallet initialize the IAE session again (possibly based on the same issuer_state if used), with the interaction_types_supported now not including the openid4vp_presentation type?

Should it first close the previous session with an OID4VP error response and access_denied error?

I'm trying to asses whether this pattern would be allowed and recommended? It makes a lot of assumptions about the flow, so may not be applicable to a general-purpose identity wallet.

There's not really a way currently to detect for a wallet whether a fallback is allowed, and thus it would be an trial and error to see if without the openid4vp_presentation interaction type the IAE returns redirect_to_web.

The alternative would be to make the user retrieve the VC that is required for the IAE presentation, but this can become really tricky (and generally requires knowledge of the specific credential type being requested to know which issuer can issue it).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the IAE interaction flow described in the issue, especially redirect_to_web, issuer_state, and openid4vp_presentation behavior. There are no files or tests named; determine whether retrying with a reduced interaction_types_supported set is allowed and what session/error handling is required. Done means documenting or specifying a clear, general fallback pattern.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.