Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add clarification about client_id for wallet attestation #441

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Add clarification about client_id for wallet attestation #441

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7ad26e1
add small text about the client_id of wallets
c2bo Jan 9, 2025
3d508a9
add missing comma in attestation jwt example
c2bo Jan 9, 2025
f28adb2
add document history
c2bo Jan 9, 2025
13da8e1
clarification of wallet instances
c2bo Jan 9, 2025
908b2d3
Apply suggestions from Kristinas review
c2bo Jan 27, 2025
27ccee1
privacy conisderations for wallet attestation client_id
c2bo Jan 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions openid-4-verifiable-credential-issuance-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1664,6 +1664,13 @@ for example, by including clear-text session information as a `state` parameter
it in a `redirect_uri` parameter. A third party may observe such information through browser
history, etc. and correlate the user's activity using it.

### Wallet Attestation Subject {#walletattestation-sub}

The Wallet Attestation as defined in (#wallet attestation) SHOULD NOT introduce a unique identifier specific to a single client.
The subject claim for the Wallet Attestation SHOULD be a value that is shared by all Wallet instances using this type of
wallet implementation. The value should be understood as an identifier of the Wallet type, rather than the specific Wallet
instance itself.

## Identifying the Credential Issuer

Information in the credential identifying a particular Credential Issuer, such as a Credential Issuer Identifier,
Expand Down Expand Up @@ -2532,7 +2539,7 @@ The following is a non-normative example of a Wallet Attestation:

```
{
"typ": "oauth-client-attestation+jwt"
"typ": "oauth-client-attestation+jwt",
"alg": "ES256",
"kid": "11"
}
Expand All @@ -2558,6 +2565,8 @@ The following is a non-normative example of a Wallet Attestation:

To use the Wallet Attestation towards the Authorization Server, the Wallet MUST generate a proof of possession according to Section 5.2 "Client Attestation PoP JWT" of Attestation-Based Client Authentication.

The `sub` claim of the Wallet Attestation JWT is picked by the Wallet Provider and represents the `client_id` of the Wallet. For privacy reasons, this value is the same across Wallet instances of that Wallet Provider, see (#walletattestation-sub) for more details.

# IANA Considerations

## OAuth URI Registry
Expand Down Expand Up @@ -2756,7 +2765,7 @@ The technology described in this specification was made available from contribut

-16

*
* add privacy considerations for the client_id used with wallet attestations

-15

Expand Down
Loading