Support for OAuth 2.0 Attestation-Based Client Authentication #40413
Replies: 6 comments 7 replies
-
|
It's also useful in the OAuth 2.0 First-Party Apps context. |
Beta Was this translation helpful? Give feedback.
-
|
Dear @thomasdarimont That would be really awesome. May I add a use case that could become major: Specification of Wallet Unit Attestations (WUA) used in issuance of PID and Attestations To this text the term I hope that if this feature is implemented it would be independent of KC's VC profile (I don't remember the exact name) |
Beta Was this translation helpful? Give feedback.
-
|
The published OpenId4VCI v1 explicitly requires use of draft 7 of Attestation-based client authentication. To this draft 7, there is a notable change related to the introduction of the Some thoughts with regards to a potential implementation
|
Beta Was this translation helpful? Give feedback.
-
|
@thomasdarimont @babisRoutis Could we please create a GitHub issue for this? |
Beta Was this translation helpful? Give feedback.
-
|
One of the questions regarding the implementation of ABCA is how to provision the keys, which Keycloak should trust for verifying the client attestation JWT. The related feature Can the attestation based client authentication also use identity providers in similar way like |
Beta Was this translation helpful? Give feedback.
-
|
I completely agree with Marek here! It definitely looks similar since we're outsourcing/federating the client auth trust to an external entity. Quick question on that note: I was looking over the ' @babisRoutis @mposolda @thomasdarimont @embesozzi @tdiesler I'd really love and appreciate any thoughts or ideas you all might have on this! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
The OAuth 2.0 Attestation-Based Client Authentication defines an extension to the OAuth 2 which enables a Client Instance to include a key-bound attestation in interactions with an Authorization Server or a Resource Server. This new method enables Client Instances involved in a client deployment that is traditionally viewed as a public client, to be able to utilize this key-bound attestation to authenticate.
Having support for this in Keycloak would benefit use-cases involving Walltet attestation the upcoming OpenID4VCI standard,
see:
4.3.1. Wallet Attestation
Beta Was this translation helpful? Give feedback.
All reactions