Auth: replace DID with subject in internal API endpoints

[reinkrul]

TODO:

• SubjectManager.List() returns the DIDs in unspecified order, making it a guess which DID is actually used. So it should return them in preferred order (did:web first): VDR: SubjectManager returns DIDs in preferred order #3291

Requires:

• VCR: Prepare wallet to perform on multiple DIDs #3320
• IAM: Introduce new 'supported_client_id_did_methods' OAuth2 AS metadata property #3319

[woutslakhorst]

the random ordering might also impact the test results (random failures)

[woutslakhorst]

Shouldn't you pass down the subject to the RFC021 request? The PD should be held against all wallets.

[reinkrul]

Shouldn't you pass down the subject to the RFC021 request? The PD should be held against all wallets.

Can you describe how that works? What if the Authorization Server doesn't support did:nuts (because of configured didmethods or Presentation Definition). Does the client still try to present a credential issued to did:nuts?

[woutslakhorst]

Shouldn't you pass down the subject to the RFC021 request? The PD should be held against all wallets.

Can you describe how that works? What if the Authorization Server doesn't support did:nuts (because of configured didmethods or Presentation Definition). Does the client still try to present a credential issued to did:nuts?

metadata doesn't support it (yet) so it's a governance thing. Before requesting a VC issued to a certain did method in PEX, all members should have updated.

[reinkrul]

Shouldn't you pass down the subject to the RFC021 request? The PD should be held against all wallets.

Yes, but the PEX implementation (Submission Builder) and VP verification are all fixed to 1 DID now. Changing it to support multiple DIDs is going to take a lot of work, so best to do that later, and do the API changes first.

Nothing breaks now, worst case credentials aren't found if the "didmethods" config order is off, but there aren't actual use cases that support those at this moment (e.g. KIK-v, eOverdracht or ANW starting to use did:web)

[gerardsn]

I think PD fulfillment needs to happen at a lower level. If we put it here now I think it will be a lot harder to fix later on

[woutslakhorst]

@reinkrul ping me when other PRs have been merged.

[reinkrul]

@woutslakhorst ready for review

stale