Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: openid credential issuer discovery example #100

Merged
merged 4 commits into from
Sep 6, 2023
Merged

fix: openid credential issuer discovery example #100

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
acac73a
fix: openid credential issuer discovery example
peppelinux Aug 29, 2023
88ad92f
chore: editorial improvement in (Q)EAA high level flow description
fmarino-ipzs Aug 31, 2023
c532590
Update docs/en/pid-eaa-issuance.rst
peppelinux Sep 1, 2023
12ca088
Merge branch 'versione-corrente' into issdisc
peppelinux Sep 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/en/pid-eaa-issuance.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ The :numref:`fig_High-Level-Flow-ITWallet-PID-Issuance` shows a general architec
Below a detailed description for each step represented in the previous picture:

0. **Wallet Instance Setup**: the first time the Wallet Instance is started a preliminary setup phase MUST be carried out. It consists of the release of a verifiable proof issued by the Attestation Service provided by the Wallet Provider that asserts the genuineness, the authenticity and the compliance with a trust framework of the Wallet Instance. The verifiable proof binds a public key corresponding to a local private key generated by the Wallet Instance.
1. **Obtaining the trusted PID Provider**: the Wallet Instance queries the Trust Anchor to fetch the trusted PID Provider.
1. **Obtaining the trusted PID Provider**: the Wallet Instance discovers the trusted PID Provider, eg: `https://trust-anchor.eudi.wallet.developers.italia.it/list?entity_type=openid_credential_issuer` and then inspects the metadata looking to the availability of the PID credential.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Following @rohe suggestions

Obtaining the trusted PID Provider has these steps:

  • Use the federation list interface with a query like what you specify: https://trust-anchor.eudi.wallet.developers.italia.it/list?entity_type=openid_credential_issuer

  • Then for each of the entity_ids returned collect their metadata and look for what ? credentials_supported:credential_definition:type == ??

@fmarino-ipzs I think that we should specify in the second point the domestic PID namespace used for discovering the credential availability upon a specific issuer

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the PID Provider Metadata we have credential_supported:credential_definition:type=PersonIdentificationData.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Anyway, I think that it is better to add a new section describing the discovery phase, with some non-normative examples, for the sake of readability. What do you think? This is a high-level view I wouldn't go into details here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I agree

peppelinux marked this conversation as resolved.
Show resolved Hide resolved
2. **Obtaining of PID Provider metadata**: the Wallet Instance establishes the trust to the PID Provider according to the Trust Model, obtaining the Metadata that discloses the formats of the PID, the algorithms supported, and any other parameter required for interoperability needs.
3. **PID request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] <https://openid.bitbucket.io/connect/openid-4-verifiable-credential-issuance-1_0.html>`_ the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. The PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider.
4. **End-user authentication**: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system.
Expand Down
Loading