Skip to content

Commit

Permalink
fix: Joseph review about multiple and subsequent credential issuance
Browse files Browse the repository at this point in the history
  • Loading branch information
peppelinux committed May 24, 2024
1 parent 59ea0be commit 5415559
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions openid-4-verifiable-credential-issuance-1_0.md
Original file line number Diff line number Diff line change
Expand Up @@ -630,7 +630,7 @@ The Authorization Server might decide to authorize issuance of multiple instance

In addition to the response parameters defined in [@!RFC6749], the Authorization Server MAY return the following parameters:

* `c_nonce`: OPTIONAL. String containing a nonce to be used when creating a proof of possession of the key proof (see (#credential-request)). While this parameter is optional for traditional Authorization Server implementations according to [RFC6749], it is recommended as a measure to prevent replay attacks. When received, the Wallet MUST use this nonce value for its subsequent requests until the Credential Issuer provides a fresh nonce. It is at the Credential Issuer's discretion how many copies of a Credential it is willing to issue, how often, and whether reissued Credentials automatically update if the underlying claims have changed.
* `c_nonce`: OPTIONAL. String containing a nonce to be used when creating a proof of possession of the key proof (see (#credential-request)). While this parameter is optional for traditional Authorization Server implementations according to [RFC6749], it is recommended as a measure to prevent replay attacks. When received, the Wallet MUST use this nonce value for its subsequent requests until the Credential Issuer provides a fresh nonce.
* `c_nonce_expires_in`: OPTIONAL. Number denoting the lifetime in seconds of the `c_nonce`.
* `authorization_details`: REQUIRED when `authorization_details` parameter is used to request issuance of a certain Credential type as defined in (#authorization-details). It MUST NOT be used otherwise. It is an array of objects, as defined in Section 7 of [@!RFC9396]. In addition to the parameters defined in (#authorization-details), this specification defines the following parameter to be used with the authorization details type `openid_credential` in the Token Response:
* `credential_identifiers`: OPTIONAL. Array of strings, each uniquely identifying a Credential that can be issued using the Access Token returned in this response. Each of these Credentials corresponds to the same entry in the `credential_configurations_supported` Credential Issuer metadata but can contain different claim values or a different subset of claims within the claims set identified by that Credential type. This parameter can be used to simplify the Credential Request, as defined in (#credential-request), where the `credential_identifier` parameter replaces the `format` parameter and any other Credential format-specific parameters in the Credential Request. When received, the Wallet MUST use these values together with an Access Token in subsequent Credential Requests.
Expand Down Expand Up @@ -698,7 +698,7 @@ The Credential Endpoint issues a Credential as approved by the End-User upon pre

Communication with the Credential Endpoint MUST utilize TLS.

The Client can request issuance of a Credential of a certain type multiple times, e.g., to associate the Credential with different public keys/Decentralized Identifiers (DIDs) or to refresh a certain Credential.
The Client can request issuance of a Credential of a certain type multiple times, e.g., to associate the Credential with different public keys/Decentralized Identifiers (DIDs) or to refresh a certain Credential. It is at the Credential Issuer's discretion how many copies of a Credential it is willing to issue, how often, and whether reissued Credentials automatically update if the underlying claims have changed.

If the Access Token is valid for requesting issuance of multiple Credentials, it is at the Client's discretion to decide the order in which to request issuance of multiple Credentials requested in the Authorization Request.

Expand Down

0 comments on commit 5415559

Please sign in to comment.