Skip to content

Commit 4067349

Browse files
cljungcljung
committed
Multiple attestations how-to
1 parent c2ece51 commit 4067349

File tree

6 files changed

+156
-3
lines changed

6 files changed

+156
-3
lines changed

‎articles/active-directory/verifiable-credentials/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@
4646
href: how-to-use-quickstart-presentation.md
4747
- name: Self issued attestation
4848
href: how-to-use-quickstart-selfissued.md
49+
- name: Multiple attestation
50+
href: how-to-use-quickstart-multiple.md
4951
- name: Use the Verified ID Network
5052
href: how-use-vcnetwork.md
5153
- name: Using the Request Service REST API

‎articles/active-directory/verifiable-credentials/how-to-use-quickstart-multiple.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
title: Create verifiable credentials with multiple attestations
3+
description: Learn how to use a quickstart to create custom credentials with multiple attestations
4+
documentationCenter: ''
5+
author: barclayn
6+
manager: amycolannino
7+
ms.service: decentralized-identity
8+
ms.topic: how-to
9+
ms.subservice: verifiable-credentials
10+
ms.date: 07/06/2022
11+
ms.author: barclayn
12+
13+
#Customer intent: As a verifiable credentials administrator, I want to create a verifiable credential with multiple attestations.
14+
---
15+
16+
# Create verifiable credentials with multiple attestations
17+
18+
[!INCLUDE [Verifiable Credentials announcement](../../../includes/verifiable-credentials-brand.md)]
19+
20+
21+
A [rules definition](rules-and-display-definitions-model.md#rulesmodel-type) that uses multiple attestations types produces an issuance flow where claims comes from more than one source. For instance you may be required to present an existing credential and also manually enter values for claims in Microsoft Authenticator.
22+
23+
In this how-to guide, we will extend the [Id token hint attestation](how-to-use-quickstart-idtoken.md) example by adding a self attested claim that the user have to enter in the Authenticator during issuance. The issuance request to Verified ID will contain an id token hint with the claim values for `given_name` and `family_name` and a self issued attestation type for claim `displayName` that the user enters themselves.
24+
25+
## Create a custom credential multiple attestation types
26+
27+
In the Azure portal, when you select **Add credential**, you get the option to launch two quickstarts. Select **custom credential**, and then select **Next**.
28+
29+
![Screenshot of the "Issue credentials" quickstart for creating a custom credential.](media/how-to-use-quickstart/quickstart-startscreen.png)
30+
31+
On the **Create a new credential** page, enter the JSON code for the display and the rules definitions. In the **Credential name** box, give the credential a type name. To create the credential, select **Create**.
32+
33+
![Screenshot of the "Create a new credential" page, displaying JSON samples for the display and rules files.](media/how-to-use-quickstart/quickstart-create-new.png)
34+
35+
## Sample JSON display definitions
36+
37+
The JSON display definition has one extra claim named **displayName** compared to the [Id token hint display definition](how-to-use-quickstart-idtoken.md#sample-json-display-definitions).
38+
39+
```json
40+
{
41+
"locale": "en-US",
42+
"card": {
43+
"title": "Verified Credential Expert",
44+
"issuedBy": "Microsoft",
45+
"backgroundColor": "#507090",
46+
"textColor": "#ffffff",
47+
"logo": {
48+
"uri": "https://didcustomerplayground.blob.core.windows.net/public/VerifiedCredentialExpert_icon.png",
49+
"description": "Verified Credential Expert Logo"
50+
},
51+
"description": "Use your verified credential to prove to anyone that you know all about verifiable credentials."
52+
},
53+
"consent": {
54+
"title": "Do you want to get your Verified Credential?",
55+
"instructions": "Sign in with your account to get your card."
56+
},
57+
"claims": [
58+
{
59+
"claim": "vc.credentialSubject.displayName",
60+
"label": "Name",
61+
"type": "String"
62+
},
63+
{
64+
"claim": "vc.credentialSubject.firstName",
65+
"label": "First name",
66+
"type": "String"
67+
},
68+
{
69+
"claim": "vc.credentialSubject.lastName",
70+
"label": "Last name",
71+
"type": "String"
72+
}
73+
]
74+
}
75+
```
76+
77+
## Sample JSON rules definitions
78+
79+
The JSON rules definition contains two different attestations that instructs the Authenticator to get claim values from two different sources. The issuance request to the Request Service API provides the values for the claims **given_name** and **family_name** to satisfy the **idTokenHints** attestation. The user will be requested to enter the claim value for **displayName** in the Authenticator during issuance.
80+
81+
```json
82+
{
83+
"attestations": {
84+
"idTokenHints": [
85+
{
86+
"mapping": [
87+
{
88+
"outputClaim": "firstName",
89+
"required": true,
90+
"inputClaim": "$.given_name",
91+
"indexed": false
92+
},
93+
{
94+
"outputClaim": "lastName",
95+
"required": true,
96+
"inputClaim": "$.family_name",
97+
"indexed": false
98+
}
99+
],
100+
"required": false
101+
}
102+
],
103+
"selfIssued": {
104+
"mapping": [
105+
{
106+
"outputClaim": "displayName",
107+
"required": true,
108+
"inputClaim": "displayName",
109+
"indexed": false
110+
}
111+
],
112+
"required": false
113+
}
114+
},
115+
"validityInterval": 2592000,
116+
"vc": {
117+
"type": [
118+
"VerifiedCredentialExpert"
119+
]
120+
}
121+
}
122+
```
123+
124+
## Claims input during issuance
125+
126+
During issuance, Authenticator prompts the user to enter values for the specified claims. User input isn't validated.
127+
128+
![Screenshot of selfIssued claims input.](media/how-to-use-quickstart-multiple/multiple-attestations-issuance.png)
129+
130+
## Claims in issued credential
131+
132+
The issued credential will have three claims in total, where the `First` and `Last name` came from the **id token hint** attestation and the `Name` came from the **self issued** attestation.
133+
134+
![Screenshot of claims in issued credential.](media/how-to-use-quickstart-multiple/multiple-attestations-vc.png)
135+
136+
137+
## Configure the samples to issue and verify your custom credential
138+
139+
To configure your sample code to issue and verify your custom credential, you need:
140+
141+
- Your tenant's issuer decentralized identifier (DID)
142+
- The credential type
143+
- The manifest URL to your credential
144+
145+
The easiest way to find this information for a custom credential is to go to your credential in the Azure portal. Select **Issue credential**. Then you have access to a text box with a JSON payload for the Request Service API. Replace the placeholder values with your environment's information. The issuer’s DID is the authority value.
146+
147+
![Screenshot of the quickstart custom credential issue.](media/how-to-use-quickstart/quickstart-config-sample-2.png)
148+
149+
## Next steps
150+
151+
See the [Rules and display definitions reference](rules-and-display-definitions-model.md).

‎articles/active-directory/verifiable-credentials/media/how-to-use-quickstart-multiple/multiple-attestations-issuance.png

132 KB
Loading

‎articles/active-directory/verifiable-credentials/media/how-to-use-quickstart-multiple/multiple-attestations-vc.png

151 KB
Loading

‎articles/active-directory/verifiable-credentials/presentation-request-api.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ Authorization: Bearer <token>
5252
{
5353
    "includeQRCode": true,
5454
"callback": {
55-
    "url": "https://www.contoso.com/api/verifier/presentationCallbac",
56-
    "state": "11111111-2222-2222-2222-333333333333",
55+
      "url": "https://www.contoso.com/api/verifier/presentationCallbac",
56+
      "state": "11111111-2222-2222-2222-333333333333",
5757
      "headers": {
5858
        "api-key": "an-api-key-can-go-here"
5959
      }

‎articles/active-directory/verifiable-credentials/verifiable-credentials-configure-verifier.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ Now you are ready to present and verify your first verified credential expert ca
128128

129129
```bash
130130
cd active-directory-verifiable-credentials-dotnet/1-asp-net-core-api-idtokenhint
131-
dotnet build "asp-net-core-api-idtokenhint.csproj" -c Debug -o .\bin\Debug\netcoreapp3.1
131+
dotnet build "AspNetCoreVerifiableCredentials.csproj" -c Debug -o .\bin\Debug\netcoreapp3.1
132132
dotnet run
133133
```
134134

0 commit comments

Comments
 (0)