openid / openid/OpenID4VP

Clarification on `aud` claim of Request object

Open
#684 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

Specification provides the following description

When the Verifier is sending a Request Object as defined in [RFC9101], the aud claim value depends on whether the recipient of the request can be identified by the Verifier or not:

  • the aud claim MUST be equal to the iss (issuer) claim value, when Dynamic Discovery is performed.
  • the aud claim MUST be "https://self-issued.me/v2", when Static Discovery metadata is used.
    Note: "https://self-issued.me/v2" is a symbolic string and can be used as an aud claim value even when this specification is used standalone, without SIOPv2.

Can you please clarify what this Dynamic vs Static discovery means when

  • we have a OpenID4VP authorization request (not combined with SIOP) and
  • wallet is a mobile application

To my understanding, in the above case a Verifier has the chance to "dynamically" discover the wallet only if

  • Verifier uses request_uri_method equal to post and
  • Wallet performs such a post, passing wallet_metadata

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked OpenID4VP specification section on the Request Object aud claim, then review its definitions of Dynamic Discovery, Static Discovery, request_uri_method, and wallet_metadata. Compare those definitions with the OpenID4VP authorization-request flow for a mobile wallet. Done means the issue receives a clear, specification-backed explanation of which discovery case applies.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.