search

oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
56 stars 29 forks source link

Disclosing claims from different credentials #322

Closed alenhorvat closed 1 year ago

alenhorvat commented 1 year ago

Does the specification support disclosing claims from different credentials?

The text doesn't seem to cover the scenario (maybe I missed it);

I guess option is:

danielfett commented 1 year ago

The option to handle multiple credentials was considered (there are a couple of closed issues on this, e.g., https://github.com/oauth-wg/oauth-selective-disclosure-jwt/issues/114), but ultimately considered out of scope for the reasons discussed there. Presenting multiple credentials is left to the transport protocol.

alenhorvat commented 1 year ago

Can the text in section 7 be improved? For such use cases, the SD-JWT SHOULD be transported as a single string

If sd-jwt is signed using JSON serialised JWS sd-jwt won't be a string but a JSON object.

Should this also be mentioned in the holder binding section? E.g., when claims from multiple credentials are shared each of them need holder binding, etc. and the rest is left to the protocol?

Holder binding, currently, already assumes something about the protocol (nonce).