Mobile Driver's License with OIDC - Revision history

Tom: /* Example 1 */

2024-08-27T19:14:39Z

‎Example 1

Tom: /* Example */

2024-08-27T19:13:38Z

‎Example

Tom: /* References */

2021-08-09T15:02:33Z

‎References

Tom: /* Example */

2021-05-24T00:17:14Z

‎Example

Tom: /* Example */

2021-05-24T00:14:09Z

‎Example

Tom: /* Solutions */

2021-05-24T00:12:11Z

‎Solutions

Tom: /* Problems */

2021-05-23T21:42:16Z

‎Problems

Tom: /* Context */

2021-05-23T19:57:58Z

‎Context

Tom: /* Context */

2021-05-23T19:56:08Z

‎Context

Tom: /* Context */

2021-05-23T19:54:27Z

‎Context

@@ Line 55: / Line 55: @@
 ==Example 1==
-Managing mDL Credentials using OpenID using a [[Verifiable Presentation]] from WaltID.
+Managing mDL ISO 18013-5 Credentials using OpenID using a [[Verifiable Presentation]] from WaltID.
 Issue, store and verify mDL credentials via OID4VC/VP via WaltID issuer, verifier and wallet API services.
@@ Line 64: / Line 64: @@
 * Verifier API: https://bit.ly/4dGH56B
 * Wallet API: https://bit.ly/3YJXcME
 ==Example 2==
 From 18013-5

@@ Line 54: / Line 54: @@
 * Even after reading data from the wallet, the reader can still decide to go to the Internet to retrieve data on the holder.
-==Example==
+==Example 1==
 From 18013-5

← Older revision		Revision as of 15:02, 9 August 2021
Line 155:		Line 155:
	[[Category: Profile]]		[[Category: Profile]]
	[[Category: Identifier]]		[[Category: Identifier]]
		+	[[Category: Mobile]]

@@ Line 124: / Line 124: @@
     "expires_in": 300,
     "token_type": "Bearer"
+}
 </pre>

@@ Line 60: / Line 60: @@
 Authorisation Request:
 <pre>
-GET /connect/authorize?client_id=ac55a761d4e74b35a9f2de06c3ea4f63&amp; scope=openid org.iso.18013.5.1:given_name org.iso.18013.5.1:family_name org.iso.18013.5.1:birthdate org.iso.18013.5.1:portrait&amp; redirect_uri=com.company.isomdlreader://login&amp; response_
+GET /connect/authorize?client_id=ac55a761d4e74b35a9f2de06c3ea4f63
-type=code&amp; login_hint=TOKEN-FROM-MDL-HOLDER HTTP/1.1
+  &amp; scope=openid org.iso.18013.5.1:given_name org.iso.18013.5.1:family_name org.iso.18013.5.1:birthdate org.iso.18013.5.1:portrait
 Host: {BASE_URL}
 Authorisation Response:

← Older revision		Revision as of 00:12, 24 May 2021
Line 54:		Line 54:
	* Even after reading data from the wallet, the reader can still decide to go to the Internet to retrieve data on the holder.		* Even after reading data from the wallet, the reader can still decide to go to the Internet to retrieve data on the holder.

		+	==Example==
		+	From 18013-5
		+
		+	Step 3 Authorisation
		+	Authorisation Request:
		+	<pre>
		+	GET /connect/authorize?client_id=ac55a761d4e74b35a9f2de06c3ea4f63& scope=openid org.iso.18013.5.1:given_name org.iso.18013.5.1:family_name org.iso.18013.5.1:birthdate org.iso.18013.5.1:portrait& redirect_uri=com.company.isomdlreader://login& response_
		+	type=code& login_hint=TOKEN-FROM-MDL-HOLDER HTTP/1.1
		+	Host: {BASE_URL}
		+	Authorisation Response:
		+	{
		+	"Query": {
		+	"code": [
		+	"1ad358e1fbc55e7cce0e515966f7b72699b9d47ce7fd6a1a63423820c9ed8f42"
		+	],
		+	"scope": [
		+	"openid org.iso.18013.5.1:given_name org.iso.18013.5.1:family_name org.iso.18013.5.1:birthdate org.iso.18013.5.1:portrait"
		+	]
		+	},
		+	"Headers": {
		+	"Cache-Control": [
		+	"no-cache"
		+	],
		+	"Connection": [
		+	"Keep-Alive"
		+	],
		+	"Accept": [
		+	"/"
		+	],
		+	"Accept-Encoding": [
		+	"gzip, deflate"
		+	],
		+	"Cookie": [
		+	"idsrv=……………………………………………….."
		+	],
		+	"Host": [
		+	"{BASE_URL}"
		+	],
		+	"Referer": [
		+	"https://{BASE_URL}/connect/authorize/callback?client_id= ac55a761d4e74b35a9f2de06c3ea4f63&scope=openid%20org.iso.18013.5.1:given_name%20org.iso.18013.5.1:family_name%20org.iso.18013.5.1:birthdate%20org.iso.18013.5.1:portrait&redirect_uri=com.company.isomdlreader://login&response_type=code&login_hint=VIENNAS-TOKEN"
		+	],
		+	"X-Original-Proto": [
		+	"http"
		+	],
		+	"X-Original-For": [
		+	"127.0.0.1:58873"
		+	]
		+	}
		+	}
		+	Step 4 Get ID Token
		+	Token Request:
		+	POST /connect/token HTTP/1.1
		+	Content-Type:application/x-www-form-url
		+	encodedHost: {BASE_URL}
		+	redirect_uri:com.company.isomdlreader://login
		+	grant_type:authorization_code
		+	code:385b19cf37ddb9bd35a29e6db85d2d52a178c96009fd7a14d43ccc4b324f6322
		+	client_id: ac55a761d4e74b35a9f2de06c3ea4f63
		+	client_secret: OoZlNbaKSPQKWSLSc6AHTUFmpPOssio1
		+	Token Response
		+	{
		+	"id_token":
		+	"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE1NzEzMjMzMDYsImV4cCI6MTU3MTMyMzYwNiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMSIsImF1ZCI6IjdiMGQyZGU0OTVmOTQ5ZWY5YmIxMzRlMDA1NWMxYjZjIiwiaWF0IjoxNTcxMzIzMDM1LCJhdF9oYXNoIjoiSWluQTE2X3oxUVFXd2k1aE1LbFdCZyIsInN1YiI6IjE0Njg3ODUyMiIsImF1dGhfdGltZSI6MTU3MTMyMjkzNiwiaWRwIjoibG9jYWwiLCJkb2NUeXBlIjoib3JnLmlzby4xODAxMy41LjEubURMIiwib3JnLmlzby4xODAxMy41LjE6cG9ydHJhaXQiOiJfOWpfNEFBUVNrWkpSZ0FCQVFFQThBRHdBQURfNFFDS1JYaHBaZ0FBVFUwQUtnQUFBQWdBQndFYUFBVUFBQUFCQUFBQVlnRWJBQVVBQUFBQkFBQUFhZ0VvQUFNQUFBQUJBQUlBQUFFeEFBSUFBQUFRQUFBQWNsRVFBQUVBQUFBQkFRQUFBRkVSQUFRQUFBQUJBQUFBQUZFU0FBUUFBQUFCQUFBQUFBQUFBQUFBQUFEd0FBQUFBUUFBQVBBQUFBQUJjR0ZwYm5RdWJtVjBJRFF1TVM0MkFQX2JBRU1BS2gwZ0pTQWFLaVVpSlM4dEtqSV9hVVFfT2pvX2dWeGhUR21aaHFDZWxvYVRrYWk5OHMyb3MtVzFrWlBTXzlYbC12X19fXy1qeV9fX19fX184dl9fX19fYkFFTUJMUzh2UHpjX2ZFUkVmUC11azY3X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19BQUJFSUFDZ0FLQU1CSWdBQ0VRRURFUUhfeEFBZkFBQUJCUUVCQVFFQkFRQUFBQUFBQUFBQUFRSURCQVVHQndnSkNndl94QUMxRUFBQ0FRTURBZ1FEQlFVRUJBQUFBWDBCQWdNQUJCRUZFaUV4UVFZVFVXRUhJbkVVTW9HUm9RZ2pRckhCRlZMUjhDUXpZbktDQ1FvV0Z4Z1pHaVVtSnlncEtqUTFOamM0T1RwRFJFVkdSMGhKU2xOVVZWWlhXRmxhWTJSbFptZG9hV3B6ZEhWMmQzaDVlb09FaFlhSGlJbUtrcE9VbFphWG1KbWFvcU9rcGFhbnFLbXFzck8wdGJhM3VMbTZ3c1BFeGNiSHlNbkswdFBVMWRiWDJObmE0ZUxqNU9YbTUtanA2dkh5OF9UMTl2ZjQtZnJfeEFBZkFRQURBUUVCQVFFQkFRRUJBQUFBQUFBQUFRSURCQVVHQndnSkNndl94QUMxRVFBQ0FRSUVCQU1FQndVRUJBQUJBbmNBQVFJREVRUUZJVEVHRWtGUkIyRnhFeUl5Z1FnVVFwR2hzY0VKSXpOUzhCVmljdEVLRmlRMDRTWHhGeGdaR2lZbktDa3FOVFkzT0RrNlEwUkZSa2RJU1VwVFZGVldWMWhaV21Oa1pXWm5hR2xxYzNSMWRuZDRlWHFDZzRTRmhvZUlpWXFTazVTVmxwZVltWnFpbzZTbHBxZW9xYXF5czdTMXRyZTR1YnJDdzhURnhzZkl5Y3JTMDlUVjF0ZlkyZHJpNC1UbDV1Zm82ZXJ5OF9UMTl2ZjQtZnJfMmdBTUF3RUFBaEVERVFBX0FOU2lpb3BUeUJRQV9ldnJUcXJWSkVlU0tBSktLUTBVQU9wa2k1NUZQcUZuSlBIQW9BWlVpTGprMHplM3JRSElQUElvQWxORk56UlFBOV91R29LS0tBRXBwb29vQWxYN29vb29vQV9fMlEiLCJvcmcuaXNvLjE4MDEzLjUuMTpnaXZlbl9uYW1lIjoiSk9ITiIsIm9yZy5pc28uMTgwMTMuNS4xOmZhbWlseV9uYW1lIjoiRE9FIiwib3JnLmlzby4xODAxMy41LjE6YmlydGhkYXRlIjoiMTk4NS0wMy0zMCIsImFtciI6WyJwd2QiXX0.LpgOQfGycgEXRGFV-vLUEup9oxKfTzDyU179mtTFTodXBwx0aWaZAvslWH2rt-ET1RQG2Pa3ccNE4anfqPHT9Q",
		+	"access_token":
		+	"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE1NzEzMjMwMzUsImV4cCI6MTU3MTMyMzMzNSwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMSIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0OjUwMDEvcmVzb3VyY2VzIiwiY2xpZW50X2lkIjoiN2IwZDJkZTQ5NWY5NDllZjliYjEzNGUwMDU1YzFiNmMiLCJzdWIiOiIxNDY4Nzg1MjIiLCJhdXRoX3RpbWUiOjE1NzEzMjI5MzYsImlkcCI6ImxvY2FsIiwic2NvcGUiOlsib3JnLmlzby4xODAxMy41LjE6cG9ydHJhaXQiLCJvcmcuaXNvLjE4MDEzLjUuMTpnaXZlbl9uYW1lIiwib3JnLmlzby4xODAxMy41LjE6ZmFtaWx5X25hbWUiLCJvcmcuaXNvLjE4MDEzLjUuMTpiaXJ0aGRhdGUiLCJvcGVuaWQiXSwiYW1yIjpbInB3ZCJdfQ.NjjUPRIgZ2opFeEJdJTV2_Hy2JSH_15ntoQho54SKSn1ZAtqXw6q-Yiulmo3L8ZAUa6_ARAA8VdNr219upULmA",
		+	"expires_in": 300,
		+	"token_type": "Bearer"
		+	}
		+	</pre>

	==References==		==References==

@@ Line 41: / Line 41: @@
 ==Problems==
-* If the Reader might use the internet for some transactions, but not all, then the type of access can lead information from the reader to an attacker.
+* If the Reader might use the internet for some transactions, but not all, then the type of access can leak information from the reader to an attacker.
 * Activation of the mDL is not defined in the standard and there are two access methods: NFC and QR. Other access methods available to the wallet MUST not be used for activation.
 ** Oddly the issuing authority is responsible to avoid unauthorized access by an mDL reader when mDL activation is triggered by NFC or QR.

@@ Line 14: / Line 14: @@
 * CBOR data is used from the mDL in CDDL tstr per RFC 8610 which is converted to json according the RFC 7049 section 4.1.
 * All data element names are prefixed with “org.iso.18013.5.1:”. No provision for a header namespace declaration is defined.
-The following are the data retrieval steps from 8.3.3.2.2 using code flow, which seems utterly pointless for cases where the client is already certified.
+The following are the data retrieval steps from 8.3.3.2.2 using code flow, which seems utterly pointless for cases where the client is already certified. In which case only step 3 wold be needed.
 # It appears that configuration discovery using OpenID Connect Discovery is required to get the authz endpoint. This seems inefficient and probably unneccessary.
 # The reader requires a clientid which can be obtained from a client registration process (but that seems to conflict with the idea that all readers are registered.)
 # Reader (client) sends authorization endpoint the clientid and token from mdoc as login_hint.