Credential Offer pointing to a specific `credentials_supported` metadata entry.

[Sakurann]

Opening this issue based on the discussion in issue #77.

The question is, as @pmhsfelix put it, If a Credential Offer requires information from a credentials_supported metadata entry in order to be usable, then how does the wallet finds out which entry to use.

We have changed string entry in the credentials array in the Credential Offer to be scopes from identifier, but I think we are learning that identifiers was better suited for this purpose, so suggestion would be to revert this change to identifiers. a) because not all implementations use scopes; and b) there are cases where two credentials of the same type, requested using the same scopes value have a different display property and the issuer needs to differentiate those in the Offer so that the Wallet can display the correct one to the user.

Discussion on how wallet can discover part of the issuer metadata using identifier has a separate issue #42.

Open questions (I think) are:

• relationship between this co_identifier in the Credential Offer and the credential instance c_identifier introduced in PR add identifiers for issuing credential of the same type, different content #65. I think in general they are separate, but I can think of instances where it is beneficial for the wallet to communicate co_identifier in the credential request when the AS does not support c_identifiers.
• relationship between identifiers, scope, and type values. I think in general 1:1:1 mapping between them cannot be assumed and it is also up to the Issuer to decide the mapping between scope and identifier/type.

[Sakurann]

agreed at pre-IIW DCP WG:

• no inline metadata
• identifier in the offer is an identifier - it is the used to reference either an entry in the issuer metadata, or a separate private file if pre-agreed btw the wallet and the issuer (because there is no obligation in OAuth/OIDC to publish all the credentials supported in the metadata, can be in a private namespace)
• Credential type identifier vs credential instance identifier are different things
• no credential instance identifier in the credential offer; because wallet does not need information on instance identifiers for user consent at that stage of the protocol
• current PR 65 is sufficient for credential instance identifiers - returning it from the token endpoint.

https://docs.google.com/document/d/1q_vcI7PGJLtM3j0jvpLfmiBsj69jCilTzDQCjKRT2xY/edit

[Sakurann]

PR merged