Repository navigation
OID4VC - Pre-Authorize Code Flow for VCDM / JWT-VC Variant #25537
Replies: 1 comment
|
I would like to use keycloak as an authorization server for credential issuance via the pre-authorized flow, but not actually issue the credential via keycloak. Issuance would be managed separately. It looks to me like the pieces are in place, such as the pre-authorized_code grant, but I am confused on how the examples are setup in keycloak-ssi-deployment. The request for the credential offer appears to be authenticated by the user who is receiving the credential. In a production implementation these would be separate roles - holder (wallet) receives the credential and the issuer presents the credential offer to the holder via QR code or other out-of-band means. The holder may use DPoP and/or attestation to authenticate to the /token endpoint but would not use any traditional OIDC flows for the pre-authorized flow. Typically the pre-authorized flow is used when there is no existing IAM database of users. This requires an external mechanism to proof the identity of the user who the credential is being issued to. This is typical in government scenarios. The issuer (resource owner) has to maintain a linkage between the unique identifier used to issue the credential and their database record - e.g. a permit DB record. So either the request for the credential offer (or just the grant) needs to include a unique identifier used by keycloak to manage the tokens or this needs to be done via another API call before making the offer request to setup a minimal user. Is this currently possible or are code changes required? Would be interested in any recommended approaches? |
Uh oh!
There was an error while loading. Please reload this page.
This discussion ticket can be used to refine the wonderful groundwork performed by wistefan at add-vci.
Some initial comments are in this pull request.
All reactions