bcgov / vc-authn-oidc

Apache License 2.0
143 stars 74 forks source link

Improvements to subject identifier generation #538

Open esune opened 4 months ago

esune commented 4 months ago

In order to support scenarios where multiple pres_req_conf_id could yield the same value for the subject identifier (i.e.: a field with the same value is chosen as sub, the generated sub based on the credential payload is the same because of the content of the credential).

In order to further "namespace" authentication requests, the subject identifier should be built with @pres_req_conf_id as a suffix, so that each proof-configuration will return a different value for sub regardless of whether the credential contents are the same.

Gavinok commented 1 week ago

Don't forget to add tests for the different way subject identifiers are generated while you are at it

Gavinok commented 1 week ago

For reference we are appending @<pres_req_conf_id>

esune commented 1 week ago

For reference we are appending @<pres_req_conf_id>

Yes, sorry for the confusion. The suffix will be the value of the pres_req_conf_id used in that request.