What is a valid credential subject when issuing Verifiable Credentials for users?

141 Views Asked by At

On the Azure AD VCs can you only issue VCs for users that are part of the AD or is any DID a valid credential subject?

1

There are 1 best solutions below

1
On

I think your question touches on 3 different areas, so I'll try to answer all of them:

There is no direct relationship between the AAD identity store and the VC service therefore an AAD user object has no direct relationship with the VC service either. Said differently, AAD users do not have a DID attribute/claim. The DID(s) exists only in the user's Authenticator app and is not explicitly bound to any existing function or identity in the Authenticator app (MFA, password manager, broker, etc).

As part of the VC issuance process, an ID token, from any OpenID Provider that is allowed by the issuer admin, is passed with the request and some of the ID Token claims become the source of the claims in the VC.

Currently, the issuance platform is supported with the wallet inside Microsoft Authenticator and thus DIDs that are generated by Authenticator.