Sending the presentation definition by reference

Issue #1340 resolved
David Chadwick created an issue

Currently the RP sends its VC requirements in a presentation definition that is embedded in the request. An alternative approach is for the RP to send its VC requirements to the (SI)OP by reference. This reference could be to a public policy server, so that multiple RPs (e.g. members of a federation) can reference the same VC requirements. Furthermore by making their requirements publicly visible, this ensures compliance with GDPR’s minimal disclosure rules, and aides inspection by the ICO.

The proposal is for the presentation definition to be referenced by a URL to its location on the policy server (or it could be by a URI and the policy could be stored on a blockchain).

Comments (9)

  1. Kristina Yasuda

    We could introduce verifiable_presentations_uri, so that the request will look like:

    {
       "id_token": {
          "acr": null,
          "verifiable_presentations_uri": "https://www.policy-server.com/examples/v1/IDCardCredential"
       }
    }
    

    or

    {
       "vp_token": {
          "acr": null,
          "verifiable_presentations_uri": "https://www.policy-server.com/examples/v1/IDCardCredential"
       }
    }
    

  2. Jeremie Miller

    This is actually already achievable using request_uri to point to the policy-agreed request parameters that include the VP.

    The way request_uri works is that it is loaded and the values it contains are merged with any additional dynamic parameters passed in on the request (but not overridden), such that it can be static and shared across many uses for just the fixed/policy values.

    I do think it would make a good addition to the spec to describe this usage of it.

  3. David Chadwick reporter

    Thanks for this Jeremie. Would you be so good as to write the PR describing this use of request_uri.

    Torsten, can we add to Section 9 a new example showing the use of request_uri to pass the presentation definition by reference.

  4. Log in to comment