Which Self-issued OP gets invoked
Issue #1199
resolved
If there are several SIOP wallets on my mobile device (or in a web browser), which one gets invoked when SIOP request is received?
currently, SIOP wallets would register custom schema openid://. However, there are certain dependencies on the OS: 1/ Android allows only one wallet of user’s choice to be invoked, and 2/ iOS invokes a wallet that was the first to register a custom schema.
One idea was to have a “capability broker“, where a list of SIOP wallets and the identifier methods they support (jwk thumb or did methods) are registered and either user chooses which wallet to invoke or wallet appropriate to RP req automatically gets invoked. (similar to Samsung phones allowing users to use both Samsung pay and Android pay)
Is there a way to make this work without OS support (ideal), or should the conversation with OS vendors be initiated (hard)?
related to issue #1198 on RP starting a req to SIOP.
Comments (10)
-
-
- changed title to Which wallet gets invoked in SIOP
-
assigned issue to
Kristina Yasuda
This was discussed during the 14-Jan-21 working group call. I hoped that people would have either zero or one wallets to avoid complexity. Others said that that may not be realistic, as different wallets may have different capabilities. In that case, might the RP know how to ask for a wallet meeting its needs?
-
reporter
From several discussions, the best idea at this stage looks like:
- Acknowledge the fact that different wallets may use different custom URI schemes or HTTPS domains (e.g., "samplewallet://" or "https://samplewallet.com/app/" -- this would lead to having the NASCAR interface, which should be made as painless as it can be, by standardizing all the parameters even if prefixes vary
- Recommend that mobile wallet apps can register
openid://in addition to any other schemes or App Claimed Link prefixes, but warn that the UX may be broken when more than one wallet has been installed on a device
-
reporter
Related to issue
#1198Registration in SIOP https://bitbucket.org/openid/connect/issues/1198/registration-in-siop -
reporter
on 02-09-2021 call, Tim encouraged the group to keep looking for the solutions - mainly reaching out to OS vendors - to solve this issue, and not settle with the current mechanisms. It was also mentioned that Apple may not be supporting custom schemas in the future
-
reporter
- changed status to open
-
reporter
- changed title to Which Self-issued OP gets invoked
-
WG is still looking at how can it be done. No solutions yet.
-
Assumptions:
- User has 1 or more wallets
- RP may support only specific DID methods/etc
- RP may require that the user uses a certified wallet
- User may choose which wallet he/she wants to use
In the ideal case, where RP supports all wallets and all DID methods, user can choose whatever wallet he/she wants. The only info that is passed to the user is: use wallet to authenticate.
In all the other cases, additional communication between the RP/Wallet/Capability broker is required.
At the moment I see 2 options (none of which is ideal):
- capability broker
- RP lists the supported wallets (User selects → authenticate with SSI → select the wallet you have installed)
Another multi-wallet issue (out of this context): What is RP supports only wallet A and I have the credentials requested by the RP in my wallet B).
-
reporter
- changed status to resolved
addressed in PR #25 that has been merged.
- Log in to comment
I don’t like the broker idea at all, this should just be in the metadata as we don’t want to get into OS dependencies at all. Also wallet invocation is optional at best.