Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added examples for 3 Authz request options #218

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Added examples for 3 Authz request options #218

Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
316eacd
Added examples for 3 Authz request options
deshmukhrajvardhan Jul 17, 2024
ea4dcf1
Update openid-4-verifiable-presentations-1_0.md
deshmukhrajvardhan Jul 23, 2024
8d97183
Update openid-4-verifiable-presentations-1_0.md
deshmukhrajvardhan Jul 23, 2024
d362b31
Addressed jogu's comments and cleanup
deshmukhrajvardhan Jul 24, 2024
dbd4ab6
Use existing key
deshmukhrajvardhan Jul 26, 2024
7b03a40
Removed key and scope from examples
deshmukhrajvardhan Jul 31, 2024
64b0161
incorporated feedback
deshmukhrajvardhan Aug 27, 2024
53942c0
nit
deshmukhrajvardhan Aug 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 71 additions & 8 deletions openid-4-verifiable-presentations-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,8 +232,6 @@ Presentation of Verifiable Credentials using OpenID for Verifiable Presentations

The Authorization Request follows the definition given in [@!RFC6749] taking into account the recommendations given in [@!I-D.ietf-oauth-security-topics].

The Verifier MAY send an Authorization Request as a Request Object either by value or by reference, as defined in the JWT-Secured Authorization Request (JAR) [@RFC9101].

This specification defines a new mechanism for the cases when the Wallet wants to provide to the Verifier details about its technical capabilities to
allow the Verifier to generate a request that matches the technical capabilities of that Wallet.
To enable this, the Authorization Request can contain a `request_uri_method` parameter with the value `post`
Expand Down Expand Up @@ -283,10 +281,17 @@ The following additional considerations are given for pre-existing Authorization
: OPTIONAL. Defined in [@!RFC6749]. The Wallet MAY allow Verifiers to request presentation of Verifiable Credentials by utilizing a pre-defined scope value. See (#request_scope) for more details.

`response_mode`:
: OPTIONAL. Defined in [@!OAuth.Responses]. This parameter is used (through the new Response Mode `direct_post`) to ask the Wallet to send the response to the Verifier via an HTTPS connection (see (#response_mode_post) for more details). It is also used to request signing and encrypting (see (#jarm) for more details). If the parameter is not present, the default value is `fragment`.
: OPTIONAL. Defined in [@!OAuth.Responses]. This parameter is used (through the new Response Mode `direct_post`) to ask the Wallet to send the response to the Verifier via an HTTPS connection (see (#response_mode_post) for more details). It is also used to request signing and encrypting (see (#jarm) for more details). If the parameter is not present, the default value is `fragment`.

The Verifier MAY send an Authorization Request using either of these 3 options:

The following is a non-normative example of an Authorization Request:
1. Passing as URL with encoded parameters
2. Passing a request object as value
3. Passing a request object by reference
deshmukhrajvardhan marked this conversation as resolved.
Show resolved Hide resolved

2 and 3 are defined in the JWT-Secured Authorization Request (JAR) [@RFC9101].

The following is a non-normative example of Authorization Request with URL encoded parameters:
```
GET /authorize?
response_type=vp_token
Expand All @@ -296,16 +301,75 @@ GET /authorize?
&nonce=n-0S6_WzA2Mj HTTP/1.1
```

The following is a non-normative example of an Authorization Request with a `request_uri_method` parameter (including the additional `client_id_scheme` and `client_metadata` parameters):
The following is a non-normative example of Authorization Request with request object as value:
```
GET /authorize?
response_type=vp_token
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

response_type isn't legal here, when request= is used response_type can only be inside the request object, it should be removed:

Suggested change
response_type=vp_token

Copy link
Contributor Author

@deshmukhrajvardhan deshmukhrajvardhan Aug 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! good catch! I've made the change

&client_id=https%3A%2F%2Fclient.example.org%2Fcb
&request=eyJrd...
```
Where the contents of `request` consist of base64url-encoding and signing (in the example with RS256 algo)
this json:
```
{
"iss": "s6BhdRkqt3",
"aud": "https://self-issued.me/v2",
"response_type": "vp_token",
"client_id": "s6BhdRkqt3",
"redirect_uri": "https//client.example.org/cb",
"presentation_definition": {
"id": "example_jwt_vc",
"input_descriptors": [
{
"id": "id_credential",
"format": {
"jwt_vc_json": {
"proof_type": [
"JsonWebSignature2020"
]
}
},
"constraints": {
"fields": [
{
"path": [
"$.vc.type"
],
"filter": {
"type": "array",
"contains": {
"const": "IDCredential"
}
}
}
]
}
}
]
},
"nonce": "n-0S6_WzA2Mj"
}
```

The following is a non-normative example of Authorization Request with request object as reference:
```
GET /authorize?
client_id=client.example.org
&client_id=https%3A%2F%2Fclient.example.org%2Fcb
&client_id_scheme=x509_san_dns
&client_metadata=...
&request_uri=https%3A%2F%2Fclient.example.org%2Frequest%2Fvapof4ql2i7m41m68uep
&request_uri_method=post HTTP/1.1
```
Later, the wallet might send the following non-normative example request to the `request_uri`:
```
POST /request/vapof4ql2i7m41m68uep HTTP/1.1
Host: client.example.org
Content-Type: application/x-www-form-urlencoded

wallet_metadata=%7B%22vp_formats_supported%22%3A%7B%22jwt_vc_json%22%3A%7B%22alg_values_supported
%22%3A%5B%22ES256K%22%2C%22ES384%22%5D%7D%2C%22jwt_vp_json%22%3A%7B%22alg_values_supported%22%3A%
5B%22ES256K%22%2C%22EdDSA%22%5D%7D%7D%7D&
wallet_nonce=qPmxiNFCR3QTm19POc8u
```

## `presentation_definition` Parameter {#request_presentation_definition}

Expand Down Expand Up @@ -1909,7 +1973,6 @@ The following is a non-normative example of a request that combines this specifi
```
GET /authorize?
response_type=vp_token%20id_token
&scope=openid
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This scope=openid should actually stay, as this section is showing an example of a SIOP request which does require openid. (openid should still be omitted in the new examples you're adding)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! i wasn't sure about this earlier.
I've made the change.

&id_token_type=subject_signed
&client_id=https%3A%2F%2Fclient.example.org%2Fcb
&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
Expand Down
Loading