<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Pedro</p>
<p>the W3C VCDM issuer property can be an object or a URI. If the
issuer uses the object form to identify itself then it is possible
to have both a DID and a URL inside the object. We have used this
format in our interop testing. In order to align the OpenID4VCI
draft with the VCDM one way could be to standardise the name of
the property for the issuer's URL so that the property name inside
the metadata matches the property name inside the issuer object of
the VC.</p>
<p>Do you want to raise this as an issue with sourcetree?</p>
<p>Kind regards</p>
<p>David<br>
</p>
<div class="moz-cite-prefix">On 09/01/2023 17:34, Pedro Felix via
Openid-specs-ab wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAM-Bv-o4b+RBTK482sgbY-6-skfN=7O0QKzGO-VAVpGcSz=BxA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi all,<br>
<br>
I've a question about the OpenID4VCI draft specification and the
relation between credential issuers and the `credential_issuer`
field on both the metadata and the credential offer.<br>
According to OpenID4VCI draft 10, `credential_issuer` needs to
be an URL and there is a discovery process dependent on that
fact. However, the issuer on a concrete verifiable credential
(VC) may not be an URL. <br>
For instance, the W3C VC data model allows the `issuer` field to
be an URI, namely a DID based URI. Due to this, the
`credential_issuer` metadata field may not match the `issuer`
field on a W3C VC issued by that issuer, which seems strange.
Wouldn't that be similar to having an ID token with an `iss`
that doesn't match the metadata `issuer`?<br>
Note that some VC profiles may mandate the VC issuer to be a DID
with a specific method (e.g. EBSI), so the issuer doesn't have
the freedom to use a URL instead.<br>
This also relates to the `aud` to use on a JWT proof token, sent
on a credential request, which I presume should match the
metadata `credential_issuer` but may not match the issued VC
`issuer`.<br>
So,<br>
1) Is it OK to have a mismatch between the metadata
`credential_issuer` and the issued VC `issuer` field?<br>
2) If not, could this be addressed by adding more information in
the metadata, allowing a non-URL issuer to be announced there,
eventually scoped to each `credentials_supported` entry?<br>
<br>
Thanks.<br>
Regards,<br>
Pedro</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="https://lists.openid.net/mailman/listinfo/openid-specs-ab">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
</body>
</html>