feat: openid4vci mdoc-issuanc #2069
Conversation
|
Signed-off-by: Martin Auer <martin.auer97@gmail.com>
auer-martin
force-pushed
the
feat/mdoc-issuance
branch
from
8514d8e
to
0c4a093
Compare
demo-openid/src/Issuer.ts
Outdated
| format: ClaimFormat.MsoMdoc, | ||
| docType: universityDegreeCredentialMdoc.doctype, | ||
| issuerCertificate: trustedCertificates[0], | ||
| holderKey, |
There was a problem hiding this comment.
Can't we return the holder binding like we do with sd-jwt?
There was a problem hiding this comment.
We can, but then we need to decide internally how to e.g. extract a key from a did-holder biding with mdoc, which I think should be up to the user?
There was a problem hiding this comment.
Hmm how to extract the key is generally straigtforward. You resolve the did, find the key with the key id, transform it to a key instance (like you do now). I think we should just not allow did holder binding when using mdoc?
There was a problem hiding this comment.
hmm but I understand now what you mean, it will break the API. Okay let's keep it like this 👍
Could we also add the key to the binding / credential request mapper? Then you at least don't have to call the mdoc service.
| export type MdocCredentialHolderDidBinding = { | ||
| method: 'did' | ||
| didUrl: string | ||
| } |
There was a problem hiding this comment.
Can you bind a mdoc to a did? I think only a key right?
There was a problem hiding this comment.
Yes, I mean, the reason for the method was simply compatibility. For example, the credentialRequestToCredentialMapper gives you the holder binding in this format. So at some level we need to extract the key from the holder binding. Where should that be done? I think everyone needs to implement the getKeyFromMdocCredentialHolderBinding method in the credentialRequestMapper itself if we don't provide it. But I understand your reasoning.
What would you suggest?
| holderBinding: MdocCredentialHolderBinding | ||
| ) { | ||
| let holderKey: Key | ||
| if (holderBinding.method !== 'jwk') { |
There was a problem hiding this comment.
| if (holderBinding.method !== 'jwk') { | |
| if (holderBinding.method === 'did') { |
But again, i don't think we should allow the did holder binding without the did actually being put in the mdoc (like is the case with sd-jwt, the binding actually represents what gets put in the cred, did or jwk). So do we need mdoc holder binding at all? I think jwk is closest to what gets put in the actual mdoc
Signed-off-by: Martin Auer <martin.auer97@gmail.com>
auer-martin
force-pushed
the
feat/mdoc-issuance
branch
from
fe28471
to
7000ca8
Compare
|
LGTM but CI is failing |
Signed-off-by: Martin Auer <martin.auer97@gmail.com>
auer-martin
force-pushed
the
feat/mdoc-issuance
branch
from
8aaed66
to
cba86a8
Compare
|
Still failing :( |
Signed-off-by: Martin Auer <martin.auer97@gmail.com>
TimoGlastra
merged commit 5695055
into
openwallet-foundation:main
No description provided.