Skip to content

Commit

Permalink
fix: WIA~POP removed from token endpoint
Browse files Browse the repository at this point in the history
  • Loading branch information
peppelinux committed Dec 12, 2023
1 parent 692c6a8 commit 9e00eb9
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions docs/en/pid-eaa-issuance.rst
Original file line number Diff line number Diff line change
Expand Up @@ -258,8 +258,7 @@ The PID/(Q)EAA Provider returns the issued ``request_uri`` to the Wallet Instanc
**Steps 12-13 (DPoP Proof for Token Endpoint)**: The Wallet Instance MUST create a new key pair for the DPoP and a fresh DPoP Proof JWT following the instruction provided in Section 4 of (:rfc:`9449`) for the token request to the PID/(Q)EAA Provider. The DPoP Proof JWT is signed using the private key for DPoP created by Wallet Instance for this scope. DPoP binds the Access Token to a certain sender (Wallet Instance) (:rfc:`9449`) and mitigates the misuse of leaked or stolen Access Tokens at the Credential Endpoint of PID/(Q)EAA Issuer.

**Step 14 (Token Request):** The Wallet Instance sends a token request to the PID/(Q)EAA Provider Token Endpoint using the authorization ``code``, ``code_verifier``, *DPoP Proof JWT* and OAuth 2.0 Attestation based Client Authentication parameters (``client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation`` and ``client_assertion=WIA~WIA-PoP``).
The ``client_assertion`` is signed using the private key which the public key is referenced in the Wallet Instance Attestation (``cnf.jwk`` claim). The PID/(Q)EAA Provider performs the following checks:
**Step 14 (Token Request):** The Wallet Instance sends a token request to the PID/(Q)EAA Provider Token Endpoint using the authorization ``code``, ``code_verifier`` and *DPoP Proof JWT*. The PID/(Q)EAA Provider performs the following checks:

1. It authenticates the Wallet Instance using OAuth 2.0 Attestation based Client Authentication method `oauth-attestation-draft <https://vcstuff.github.io/draft-ietf-oauth-attestation-based-client-auth/draft-ietf-oauth-attestation-based-client-auth.html>`_.
2. It MUST ensure that the Authorization ``code`` is issued to the authenticated Wallet Instance (:rfc:`6749`) and was not replied.
Expand Down

0 comments on commit 9e00eb9

Please sign in to comment.