search

digitalcredentials / learner-credential-wallet

Learner Credential Wallet is a cross-platform iOS and Android mobile application for storing and sharing digital learner credentials.
https://lcw.app
MIT License
53 stars 26 forks source link

auth_type `code` no longer works for claiming a credential #605

Closed stuartf closed 4 months ago

stuartf commented 4 months ago

Describe the bug When using a claim URI that sets auth_type=code (or doesn't set auth type as this is the default) the wallet shows an error Unsupported auth_type value: "code".

To Reproduce Steps to reproduce the behavior: Try to claim a credential with an auth_type=code URI

Expected behavior The credential should be successfully claimed.

Smartphone (please complete the following information):

stuartf commented 4 months ago

It looks like this was done intentionally in 7f5c5b67f6d11bb65ab7cab2cd3a16578575002c

@dmitrizagidulin is OIDC no longer supported for claiming?

dmitrizagidulin commented 4 months ago

@stuartf ahh yeah, sorry bout that. I think the recommendation now is to do authentication first (out of band), and then do a deep link with auth_type=bearer. We were seeing that pretty much all the pilots were following that pattern -- authenticating the student first, in their LMS or whatever CMS, and then giving them a direct "pick up your credential here" using bearer).

Will the dropping of support present a major stumbling block for you?

sembrat commented 4 months ago

I believe @stuartf resolved this on the cred-admin side with https://github.com/digitalcredentials/cred-admin/commit/6fbee5ac5144256976b64cbba4ab364c82e1440f , matching your recommendation to use auth_type=bearer.

I'll let him speak further to whether it's a stumbling block for us in the future, but I believe this remediated the issue for us and allowed for claiming via LCW via cred-admin and within our LMS.

stuartf commented 4 months ago

Yep, that's what I fell back to doing. It has the disadvantage that someone could shoulder surf and claim a credential, but I guess that's pretty unlikely. For now I'm OK with having cred-admin work this way until I can move us to using DCC issuer code at which point I'd expect we'd be less likely to have these kind of out-of-sync issues as we'd be contributing to the same code-base.