<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-ligatures:none;}
span.gmail-apple-converted-space
{mso-style-name:gmail-apple-converted-space;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Pedro,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">> 1) Is it OK to have a mismatch between the metadata `credential_issuer` and the issued VC `issuer` field?<o:p></o:p></p>
<p class="MsoNormal">One way to provide this (and is pretty mainstream in VC ecosystem from what I know) is to use
<a href="https://identity.foundation/specs/did-configuration/">Well Known DID Configuration (identity.foundation)</a> specification, which provides a bi-directional binding btw a DID and a domain (which can be credential_issuer URL) - aDID Document obtained
from an `iss` DID would contain a domain where a JSON document containing a DID is hosted. (whether this is needed with did:web where DID Document is already hosted under a domain is debated)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think it would be sufficient?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Would be great if you could raise an issue – sounds like we need an implementations considerations section or equivalent.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
<p class="MsoNormal">Kristina<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net>
<b>On Behalf Of </b>Pedro Felix via Openid-specs-ab<br>
<b>Sent:</b> Tuesday, January 10, 2023 10:06 AM<br>
<b>To:</b> Artifact Binding/Connect Working Group <openid-specs-ab@lists.openid.net><br>
<b>Cc:</b> Pedro Felix <pmhsfelix@gmail.com><br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID4VCI: relation between the metadata's credential_issuer and the issuer of an issued verifiable credential<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On the example above I meant "issuer" and not "id" as the top-level field.<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">{<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> (...)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "<b>issuer</b>": {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "id":"did:example:76e12ec712ebc6f1c221ebfeb1f",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "name": "Example University"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <span class="gmail-apple-converted-space"> </span><b>"another_id": "</b><a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcredential-issuer.example.com%2F&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=tha7kX1WSgB5tukx8yPAa%2Ff09EICIwGTB%2FXzkCf%2BUYI%3D&reserved=0" target="_blank"><b>https://credential-issuer.example.com</b></a><b>"<span class="gmail-apple-converted-space"> </span></b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> }<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Jan 10, 2023 at 4:21 PM Pedro Felix via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Hi David,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for the answer.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Just to confirm I'm understanding your proposal correctly...<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">- The W3C VC would have something like (following example <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.w3.org%2FTR%2Fvc-data-model%2F%23example-usage-of-issuer-expanded-property&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ye2hAqDn%2BOjMarJ3ArggfWF3%2BzMHsw7wm%2FToaM7rGyM%3D&reserved=0" target="_blank">
https://www.w3.org/TR/vc-data-model/#example-usage-of-issuer-expanded-property</a>)?<br>
<br>
{<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> (...)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "id": {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "id":"did:example:76e12ec712ebc6f1c221ebfeb1f",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "name": "Example University"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <b>"another_id": "</b><a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcredential-issuer.example.com%2F&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=tha7kX1WSgB5tukx8yPAa%2Ff09EICIwGTB%2FXzkCf%2BUYI%3D&reserved=0" target="_blank"><b>https://credential-issuer.example.com</b></a><b>"
</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> }<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">- "another_id" field name would be aligned with the field name inside the metadata. For instance, "another_id" could be "credential_issuer" (the current name in the OIDC VCI metadata)?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Did I understood it correctly?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I was thinking on taking a different route, where the OIDC VCI metadata would have an additional field with alternate issuer IDs, namely to avoid adding restrictions into the W3C VC shape (i.e. the VC issuer could still be a simple URI
string)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Metadata example<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">{<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "credential_issuer": "<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcredential-issuer.example.com%2F&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=tha7kX1WSgB5tukx8yPAa%2Ff09EICIwGTB%2FXzkCf%2BUYI%3D&reserved=0" target="_blank">https://credential-issuer.example.com</a>",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <b> "alternate_issuer_ids": ["did:example:76e12ec712ebc6f1c221ebfeb1f"]</b>,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "credential_endpoint": "...",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "credentials_supported": [...],<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">The Wallet would then check that the issued VC has an issuer matching
<b>credential_issuer</b> or one of the <b>alternate_issuer_ids.</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I'm assuming that for the final VC verifier, the OIDC issuer URL is not meaningful, only the VC issuer (string value or
<b>id</b> field).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It is interesting to have the OIDC VCI issuer URL in the VC, however I'm afraid that some profiles may restrict the VC issuer to be an URI and not an object.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Should I create a BitBucket issue exposing the problem and describing both solutions?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Pedro<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 10, 2023 at 11:11 AM David Chadwick via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p>Hi Pedro<o:p></o:p></p>
<p>the W3C VCDM issuer property can be an object or a URI. If the issuer uses the object form to identify itself then it is possible to have both a DID and a URL inside the object. We have used this format in our interop testing. In order to align the OpenID4VCI
draft with the VCDM one way could be to standardise the name of the property for the issuer's URL so that the property name inside the metadata matches the property name inside the issuer object of the VC.<o:p></o:p></p>
<p>Do you want to raise this as an issue with sourcetree?<o:p></o:p></p>
<p>Kind regards<o:p></o:p></p>
<p>David<o:p></o:p></p>
<div>
<p class="MsoNormal">On 09/01/2023 17:34, Pedro Felix via Openid-specs-ab wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Hi all,<br>
<br>
I've a question about the OpenID4VCI draft specification and the relation between credential issuers and the `credential_issuer` field on both the metadata and the credential offer.<br>
According to OpenID4VCI draft 10, `credential_issuer` needs to be an URL and there is a discovery process dependent on that fact. However, the issuer on a concrete verifiable credential (VC) may not be an URL.
<br>
For instance, the W3C VC data model allows the `issuer` field to be an URI, namely a DID based URI. Due to this, the `credential_issuer` metadata field may not match the `issuer` field on a W3C VC issued by that issuer, which seems strange. Wouldn't that be
similar to having an ID token with an `iss` that doesn't match the metadata `issuer`?<br>
Note that some VC profiles may mandate the VC issuer to be a DID with a specific method (e.g. EBSI), so the issuer doesn't have the freedom to use a URL instead.<br>
This also relates to the `aud` to use on a JWT proof token, sent on a credential request, which I presume should match the metadata `credential_issuer` but may not match the issued VC `issuer`.<br>
So,<br>
1) Is it OK to have a mismatch between the metadata `credential_issuer` and the issued VC `issuer` field?<br>
2) If not, could this be addressed by adding more information in the metadata, allowing a non-URL issuer to be announced there, eventually scoped to each `credentials_supported` entry?<br>
<br>
Thanks.<br>
Regards,<br>
Pedro<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Openid-specs-ab mailing list<o:p></o:p></pre>
<pre><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><o:p></o:p></pre>
<pre><a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openid.net%2Fmailman%2Flistinfo%2Fopenid-specs-ab&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=KqwZlwwW3ImaiYoEyNG3DI9rTd8H7VwM%2FkNsfsUtmb0%3D&reserved=0" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></pre>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openid.net%2Fmailman%2Flistinfo%2Fopenid-specs-ab&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=KqwZlwwW3ImaiYoEyNG3DI9rTd8H7VwM%2FkNsfsUtmb0%3D&reserved=0" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openid.net%2Fmailman%2Flistinfo%2Fopenid-specs-ab&data=05%7C01%7CKristina.Yasuda%40microsoft.com%7Cd259476e6caf44e2b3b708daf33553f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638089709508782349%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=KqwZlwwW3ImaiYoEyNG3DI9rTd8H7VwM%2FkNsfsUtmb0%3D&reserved=0" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></p>
</div>
</body>
</html>