Skip to content

Onboarding Updates #261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TelegramSam wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Onboarding Updates #261

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
02a8a9d
Onboarding Updates
TelegramSam May 25, 2021
0b2b182
Updates per discussion
TelegramSam May 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 27 additions & 21 deletions sequence-diagrams/User-onboarding-to-first-issuer.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
title User onboarding to first Issuer
title User onboarding to Issuers

Participant User
Participant DAA
Expand All @@ -8,40 +8,46 @@ Participant DAS
Participant ARD


User -> +Issuer: I want a Digital Address\n(Authentication + accept T&C)\n Issuer has ID-proofed user before
User -> +Issuer: I want to Connect\n(Authentication + accept T&C)\n Issuer has ID-proofed user before
Issuer -> Issuer: Lookup ID-Attribs for that user in Issuer DB
Issuer -> Issuer: ADIA-FN-001: Compute HIDA = hash (ID-Attribs)
Issuer ->> +DAS: ADIA-DR-001: Securely send HIDA, ISSUER_ID \nand request Digital Address
Issuer ->> +DAS: ADIA-DR-001: Lookup or Provision [ HIDA, ISSUER_ID] \nand request DID
DAS ->> +ARD: ADIA-DR-001: Lookup TA_USER_ISSUER for HIDA, ISSUER_ID
ARD -> ARD: Lookup TA for HIDA

alt TA not found
alt TA found
ARD -->> DAS: ADIA-DR-001:Compute and Return\nTA_USER_ISSUER found and HomeDAS_ID

ARD ->> Cloud Agent: Get DID for Distribution
Cloud Agent -->> ARD: DID for Distribution
ARD ->> Cloud Agent: Distribution Disclosure
DAS ->> Issuer: DID of User

else TA not found
ARD -> ARD: Generate TA = random
ARD -->> -DAS: ADIA-DR-001:No conflict with TA.\n Return TA_USER_ISSUER = hash (TA, ISSUER_ID), HomeDAS=DAS_ID
else TA found
note over DAS,ARD
Enroll a User with existing Digital Address
end note
end

DAS->>DAS: ADIA-DA-005:Provision a Cloud Agent for User with HIDA
DAS->>Cloud Agent: ADIA-DA-001:Request to Create DAS_USER_ID for HIDA
DAS->>Cloud Agent: ADIA-DA-001:Request to Create DID for Issuer
Copy link
Collaborator

@rlin1 rlin1 May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is about onboarding a user. The DID will have the user as subject, hence the Issuer will create a DID for the User - not for the issuer.

Copy link
Contributor Author

@TelegramSam TelegramSam May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the DID for the User to give to the Issuer. Each Issuer should get a unique DID for the user.

Copy link
Contributor Author

@TelegramSam TelegramSam May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for use by Issuer

Copy link
Contributor Author

@TelegramSam TelegramSam May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DAS_USER_ID = DID described elsewhere

Copy link
Contributor Author

@TelegramSam TelegramSam May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

include note in DAS_USER_ID definition to include one DID per Issuer / Service Provider. _pk, _sk also in terminology.

Copy link
Contributor Author

@TelegramSam TelegramSam May 28, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reverted DID to DAS_USER_ID, terminology update pending.

Cloud Agent ->Cloud Agent: Create DAS_USER_ID & DAS_USER_ID_PK/SK\n Create DIDDoc
Cloud Agent-->>DAS: ADIA-DA-001:Send [DAS_USER_ID, DAS_USER_ID_PK] to DAS
DAS->DAS: Store User DIDDoc
DAS-->>Cloud Agent: ADIA-DA-001: DID Doc save success
DAS->>Cloud Agent: ADIA-DA-001:Create DA [DAS_USER_ID]
Cloud Agent-->>DAS: ADIA-DA-001:DA Created
Cloud Agent-->>DAS: ADIA-DA-001:Send [DAS_USER_ID, DAS_USER_ID_PK] to DAS for Issuer
DAS ->> Issuer: User is new, select and approve Digital Address, retrieve enrollment credential
Issuer ->> Cloud Agent: Directory enrollment HIDA Credential
Issuer ->> Cloud Agent: User Selected Digital Address
Cloud Agent ->> DAS: ADIA-DA-001:Create DA [DAS_USER_ID]
DAS -> DAS: Store [DA, TA_USER_ISSUER, DAS_USER_ID, DAS_USER_ID_PK]
DAS ->> +ARD: ADIA-DR-002: Enroll [DAS_USER_ID, HIDA, HomeDAS_ID] to notify about DA
DAS -->> Cloud Agent: ADIA-DA-001:DA Created
Cloud Agent ->> ARD: Present HIDA Enrollment Credential
Copy link
Collaborator

@rlin1 rlin1 May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where do we define what a HIDA Enrollment Credential is? Is this new?

Copy link
Collaborator

@rlin1 rlin1 May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this a Verifiable Credential or an authentication credential?

Copy link
Contributor Author

@TelegramSam TelegramSam May 26, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIDA Credential needed in terminology section. - VC issued to the user containing HIDA. HIDA Cred is Directory Credential of a specific type.

ARD -> ARD: Store [HIDA, TA]\n [TA, DAS_USER_ID, HomeDAS_ID=DAS_ID]
ARD -->> -DAS: ADIA-DR-002:Enroll Success
ARD -->> -Cloud Agent: ADIA-DR-002:Enroll Success
DAS -->> -Issuer: ADIA-DR-002:Return DAS_USER_ID
Issuer -> Issuer: Remember DAS_USER_ID for user in Issuer DB
Issuer -> Issuer: Create QR code (DAS_USER_ID, IssuerConnectionURL)
Issuer ->> -User: Present QR (Ex: Console) or send QR (Ex: Email)
DAA-->User: Digital Address enrolled and ready for use
end


opt User scans the QR code
Issuer -> Issuer: Create QR code (DAS_USER_ID, IssuerConnectionURL)
Issuer ->> -User: Present QR (Ex: Console) or send QR (Ex: Email)
User -> DAA: Scan and Extract [DAS_USER_ID, IssuerConnectionURL]
DAA -> DAA: Start ID proofing on the device \nand extract the User info
DAA-> +DAS: Send Verified User Attributes +\n DAS_USER_ID to IssuerConnectionURL
Expand All @@ -53,5 +59,5 @@ DAA -> DAA: If successful: Remember DAS_USER_ID, DA
DAA <-> +DAS: Register FIDO Authenticator for new device\n [DAS_USER_ID, USER_FIDO_PK]
DAS-> DAS: Remember (USER_FIDO_PK, DAS_USER_ID)
DAS --> -DAA: Acknowledge successful FIDO registration
DAA-->User: Digital Address enrolled and ready for use

end