eu-digital-identity-wallet / eudi-srv-pid-issuer

A micro-service acting like PID/mDL Issuer according to OpenID4VCI
Apache License 2.0
16 stars 8 forks source link

Check the SD-JWT-VC model for PID #246

Closed babisRoutis closed 2 days ago

babisRoutis commented 1 week ago

Make sure that the PID in SD-JWT-VC follows the ARF PR

Attribute identifier Claim Name Note Reference
family_name family_name OpenID Connect Core 1.0, Section 5.1
given_name given_name OpenID Connect Core 1.0, Section 5.1
birth_date birthdate OpenID Connect Core 1.0, Section 5.1
age_over_18 age_equal_or_over.18 The 18 property name is a string. PID rulebook
age_over_NN age_equal_or_over.NN The NN property name is a string. PID rulebook
age_in_years age_in_years PID rulebook
age_birth_year age_birth_year PID rulebook
family_name_birth birth_family_name OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
given_name_birth birth_given_name OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
birth_place place_of_birth.locality OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
birth_country place_of_birth.country OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
birth_state place_of_birth.region OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
birth_city place_of_birth.locality OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_address address.formatted OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_country address.country OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_state address.region OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_city address.locality OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_postal_code address.postal_code OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_street address.street_address OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
resident_house_number address.house_number OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
gender gender Data type mismatch - JWT claims use male, female and custom text values.* OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
nationality nationalities Defined as an array, here containing only one entry. OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4
issuance_date iat RFC7519
expiry_date exp RFC7519
issuing_authority issuing_authority PID rulebook
document_number document_number PID rulebook
administrative_number administrative_number PID rulebook
issuing_country issuing_country PID rulebook
issuing_jurisdiction issuing_jurisdiction PID rulebook
babisRoutis commented 5 days ago

Issues:

A possible mapping for would be 0 = not known; 1 = male; 2 = female; 9 = not applicable.

A different approach would be to add to the PID model a string gender and let the caller define the value

babisRoutis commented 5 days ago

Another minor issue is https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework/pull/160#discussion_r1853638874

dzarras commented 5 days ago

@babisRoutis Concerning vct:

The mso_mdoc doctype uses the notation eu.europa.ec.eudi.pid.1, while the sd-jwt-vc vct uses the notation urn:eu.europa.ec.eudi:pid:1. It's not just the urn: prefix that is missing. The former uses . for separation, while the later uses : for separation.

dzarras commented 5 days ago

@babisRoutis I think I spotted another issue.

nationality in mso_mdoc is defined as Alpha-2 country code as specified in ISO 3166-1, representing the nationality of the PID User., while the sd-jwt-vc iana claim nationalities is defined as End-user's nationalities using ICAO 3-letter codes [[ICAO-Doc9303](https://openid.net/specs/openid-connect-4-ida-claims-1_0.html#ICAO-Doc9303)], 2-letter ICAO codes may be used in some circumstances for compatibility reasons.

What I haven't checked is whether 2-letter ICAO codes are compatible with ISO 3166-1 Alpha-2 country codes.

babisRoutis commented 5 days ago

@babisRoutis I think I spotted another issue.

nationality in mso_mdoc is defined as Alpha-2 country code as specified in ISO 3166-1, representing the nationality of the PID User., while the sd-jwt-vc iana claim nationalities is defined as End-user's nationalities using ICAO 3-letter codes [[ICAO-Doc9303](https://openid.net/specs/openid-connect-4-ida-claims-1_0.html#ICAO-Doc9303)], 2-letter ICAO codes may be used in some circumstances for compatibility reasons.

What I haven't checked is whether 2-letter ICAO codes are compatible with ISO 3166-1 Alpha-2 country codes.

Thanks for this @dzarras I am aware of it. Let's proceed with rest of the alignments.