Create profiles of the OIDC4IDA spec

[Mark Haine]

There are discussions involving implementers in Japan, Australia and the UK about how to document profiles of the OIDC4IDA spec.

[Mark Haine]

Suggest starting to write profiles for the three and see if we can find a consistent format for documenting them ad share those profiles on the wiki section?

Australian profile is quite lightweight at present as far as I understand

UK profile is rich around the assurance details

JP profile includes use of scopes and pre-defined sets of attributes

Should we also consider the possibility of “Pending Verification” being addressed through a profile?

[Takahiko Kawasaki]

IMHO, considering the historical context in which RAR was developed, the approach being discussed in the OIDF-J KYC WG (mapping pre-defined sets to scopes) is not so good. I recommend that OIDF-J KYC WG members attend eKYC-IDA WG calls and discuss their needs directly with experts.

Transaction Authorization or why we need to re-think OAuth scopes (by Torsten Lodderstedt on April 21, 2019)
https://medium.com/oauth-2/transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-2326e2038948

[Mark Haine]

Thinking about profiles I would like to suggest several classes of profile that can be referenced in implementer’s documentation.

Evidence specifics - precisely how each type of evidence should be represented examples might include:

• Passport
• International Driving Licence
• UK Driving License
• Experian Credit reference

Assurance process representration specifics

• GPG45
• eIDAS
• NIST

‌

‌

[Mark Haine]

Question of managing profiles needs to be discussed

[Mark Haine]

need to think about how to represent a VC as an electronic record that was used in establishing a level of assurance

[Mark Haine]

guidance from MikeJ is that an IANA registry is appropriate for lists of things (we are thinking standards schemas for representing evidence types and assurance types) and the the next step to achieve that is to write an RFC