SSI OAuth

Install Extension

Open

To use the SSI OAuth in your interaction, you need to install the "OAuth" extension to your service.

Make sure you have the JWT key pair ready before installing this extension.

Go to the “Extensions“ tab and click “Install Extension.“

On the next page, select "Public Extensions," and then click "Install" on the "OAuth" extension’s field.

Add JWT key

In the pop-up window, select the key type and enter the private and public keys in the appropriate fields. These keys will be used to sign the JWT token that will be passed to the end user.

After that, Click “Submit.“

After completing the installation process, you can now navigate to the "Interactions" tab and add this extension to the desired interaction.

Add “Oauth” extension to the interaction

On the “Interactions“ tab, click “Edit“ button for the chosen interaction.

in the “Edit Interaction“ page, click “Select“ on the “Extension Setup“ section.

In the Extension Settings pop-up window, click “Add” next to the OAuth extension.

Add details to your extension

In the "Extension Settings" pop-up, enter the "Client Secret" (required) and any additional configuration settings you need.

clientId

The “clientId“ field is “Read only.” The client ID will be generated automatically after you click “Submit.“

clientSecret

Add the “clientSecret.“ This is the only required field in this configuration.

redirectUris

If you wish to restrict redirect URIs where the end-user will be redirected in case of the successful authorisation, add redirect URIs here.

If you leave this field empty, the end-user will be redirected to any URI received in the authorisation request.

scopes

Specify the user scopes with different access levels in this section.

jwtFields

By default, JWT token will contain two fields - “subscriberConnectDID and “publicServiceDID.“

In this field, you can configure additional fields that will be included in the JWT Token.

To do this, assign a name to each additional field and select the source of data for that field, which can be either the input request or a specific credential.

If you choose to use a credential as the data source, provide the credential ID and the corresponding field name of this credential from which you wish to retrieve the data.

scopeFields

In this section, you can set up access to the restricted resource, based on specific user credential data for different scopes of users, which are specified in the "scopes" field .

Enter the name of chosen scope.

Enter credential ID, field name of this credential and set rules for the chosen access level in the “fieldOperator“ (<,>,=,<=,>=) and “fieldValue“ fields.

For example, if you want to grant editing rights to users that has an “Access Level” greater than “4” in the "Scope" credential, you can configure it as follows:

• scope: Editing rights;

• credentialId: 2RjEBo9zXkJByXm14xQHtg:3:CL:1300:tag (example);

• fieldValue: 4;

• fieldOperator: >;

• Field Name: Access Level;

Then, after saving these configurations, add the “Scope“ credential to the “Required Credential Definitions” section of the authorization interaction.

With this configuration, in order to grant the user editing rights to the restricted resource, the authorization interaction will require the user to share the value of the "Access Level" attribute from their ID wallet's "Scope" credential.

This value will have to be greater than 4 for the user to be granted the editing rights.

ExpirationTime

To set the expiration time of the tokens and QR code used in this authorization, enter the desired length of time (in seconds) in the appropriate fields.

Please note that if you add the “OAuth” extension to the interaction, you will not be able to set the dynamic QR code as the initiation media for this interaction. The OAuth extension and dynamic QR code initiation media cannot be used together in the same interaction.

After adding all the settings, click "Submit."

The “SSI Authentication 1.0” credential definition (credential, issued by the ProofSpace ID service) will be automatically added to the "Credentials required by extension" section of this interaction.

Save changes

After completing these steps, click "Done" to save all additional changes made to this interaction.