W3C home > Mailing lists > Public > public-credentials@w3.org > August 2021

Re: Proposal for Authorization in VC HTTP API

From: Manu Sporny <msporny@digitalbazaar.com>
Date: Sun, 22 Aug 2021 10:10:37 -0400
To: public-credentials@w3.org
Message-ID: <9a3f7682-25b1-a993-ad6e-abb04c01f04f@digitalbazaar.com>
On 8/21/21 7:26 PM, steve capell wrote:
> * I'm unclear about which VC-API interactions should require authorisation
> and which should not.

There is clarity on most, but not all, of the endpoints we have defined so far
wrt. authorization. There is a column here marked "Authorization Required?":


To be clear, we're talking exclusively about authorization (not
authentication, e.g., DIDAuth -- that's out of scope).

> * I can imagine that an issuer will certainly want to authorise a subject 
> that is requesting a VC.  "yes, that's the john smith we know, here's your 
> digital drivers license"

The term I believe you meant to use was "authenticate", because
"authorization" is subtly orthogonal. So, let's make sure we're talking about
the same thing first:


"yes, that's the john smith we know" is authentication

"and given that it's the john smith we know, he is authorized to receive a
digital driver's license" is authorization.

"here's your digital drivers license" presumes some sort of authorization took
place. Providing the digital drivers license happens AFTER authorization was

> * But I cant imagine why or how a verifier will want to authorise John
> when he presents his license as proof of age in a bottle shop because
> there's very unlikely to have been any a-priori registration of either john
> or his chosen system to the bottle shop system. Instead I'd expect an
> anonymous access "yes, that's a valid drivers license and, yes, the photo
> on it looks like you sir, here's your vodka".

Again, "yes, that's a valid drivers license and, yes, the photo on it looks
like you sir" is authentication.

"and given that you're above the age of ??, you are allowed to purchase
alcohol" is authorization.

"here's your vodka" presumes some sort of authorization took place.

You're not far off, but we do need to make sure we're very clear about what
we're talking about "authorization", and what's not necessarily the focus of
the current discussion "authentication".

> would it be possible to see a diagram of VC-API interactions with some 
> indication of which require auth and which dont?

Column G here:


The Use Cases team is working on some more detailed data flow diagrams to
elaborate upon the matter further. I expect we're several weeks of from those
being done.

Did that help, Steve?

-- manu

Manu Sporny - https://www.linkedin.com/in/manusporny/
Founder/CEO - Digital Bazaar, Inc.
News: Digital Bazaar Announces New Case Studies (2021)
Received on Sunday, 22 August 2021 14:10:57 UTC

This archive was generated by hypermail 2.4.0 : Thursday, 24 March 2022 20:25:21 UTC