Protocol Catalog
OAuth 2.0
Section titled “OAuth 2.0”Standards: RFC 6749, RFC 7636 (PKCE), RFC 7662 (Introspection), RFC 7009 (Revocation), RFC 8628 (Device Code)
| Flow | Description |
|---|---|
| Authorization Code | Standard authorization grant with redirect |
| Authorization Code + PKCE | Authorization code with Proof Key for Code Exchange |
| Client Credentials | Machine-to-machine token issuance |
| Refresh Token | Token renewal without re-authorization |
| Token Introspection | Validate and inspect active tokens |
| Token Revocation | Invalidate access or refresh tokens |
| Device Code | Authorization for input-constrained devices |
| Implicit | Legacy browser-based flow (deprecated) |
| Resource Owner Password | Legacy direct credential exchange (deprecated) |
OpenID Connect
Section titled “OpenID Connect”Standards: OIDC Core 1.0, OIDC Discovery 1.0
| Flow | Description |
|---|---|
| Authorization Code | OIDC authentication with ID token |
| Hybrid | Combined code + token response |
| Implicit | Legacy OIDC implicit flow |
| UserInfo | Claims retrieval from the UserInfo endpoint |
| Discovery | OpenID Provider metadata and JWKS resolution |
| Interaction Code | Interactive authorization with PKCE |
SAML 2.0
Section titled “SAML 2.0”Standards: SAML 2.0 Core, Bindings, Profiles, Metadata
| Flow | Description |
|---|---|
| SP-Initiated SSO | Service Provider starts the login flow |
| IdP-Initiated SSO | Identity Provider starts the login flow |
| Single Logout | Coordinated logout across participants |
| Metadata Exchange | SP/IdP metadata discovery and sharing |
Demo scenarios: Assertion Deep Dive, Metadata Exploration
SCIM 2.0
Section titled “SCIM 2.0”Standards: RFC 7642, RFC 7643, RFC 7644
| Flow | Description |
|---|---|
| User Lifecycle | Create, read, update, deactivate users |
| Group Membership | Group CRUD and membership management |
| User Discovery | Filter expressions and search queries |
| Bulk Operations | Batch create/update/delete |
| Schema Discovery | ServiceProviderConfig, ResourceTypes, Schemas |
| Outbound Provisioning | Client-initiated provisioning sync |
SPIFFE/SPIRE
Section titled “SPIFFE/SPIRE”Standards: SPIFFE, SPIRE, SPIFFE Workload API, X.509-SVID, JWT-SVID
| Flow | Description |
|---|---|
| X.509-SVID Issuance | Retrieve X.509 workload identity certificate |
| JWT-SVID Issuance | Retrieve JWT workload identity token |
| mTLS Handshake | Mutual TLS using X.509-SVIDs |
| Certificate Rotation | Automatic SVID renewal |
| Workload Registration | Register workload entries in SPIRE |
| Node Attestation | Node identity verification |
| Workload Attestation | Workload identity verification |
| Trust Bundle Federation | Cross-trust-domain bundle exchange |
Requires: SPIFFE compose overlay (docker-compose.spiffe.yml) for full mode. Demo mode returns 503.
Shared Signals Framework (SSF)
Section titled “Shared Signals Framework (SSF)”Standards: OpenID SSF 1.0, CAEP 1.0, RISC 1.0
| Flow | Description |
|---|---|
| Stream Configuration | Create and configure event streams |
| Push Delivery | Transmitter pushes SETs to receiver |
| Poll Delivery | Receiver polls transmitter for SETs |
| CAEP Session Revoked | Session revocation event and response |
| CAEP Credential Change | Credential change event and response |
| RISC Account Disabled | Account disabled event and response |
| RISC Credential Compromise | Credential compromise event and response |
Demo scenarios: SSF Interactive Sandbox, Push vs Poll Comparison
OID4VCI
Section titled “OID4VCI”Standards: OpenID4VCI 1.0
| Flow | Description |
|---|---|
| Pre-Authorized Code | Credential issuance with pre-authorized grant |
| Pre-Authorized + tx_code | Issuance with transaction code challenge |
| Deferred Issuance | Credential issued asynchronously |
Default credential: Mobile Driving Licence (mso_mdoc, MobileDrivingLicenceMsoMdoc) — the default and lead configuration. UniversityDegreeCredential (SD-JWT VC) and the W3C formats remain selectable.
Credential formats: mso_mdoc (ISO/IEC 18013-5 mDL, default), dc+sd-jwt (SD-JWT VC), jwt_vc_json, jwt_vc_json-ld, ldp_vc (W3C Data Integrity with ecdsa-rdfc-2019 / eddsa-rdfc-2022 cryptosuites)
OID4VP
Section titled “OID4VP”Standards: OpenID4VP 1.0, HAIP 1.0, W3C Digital Credentials API
| Flow | Description |
|---|---|
| DCQL + direct_post | DCQL query with direct_post response mode |
| DCQL + direct_post.jwt | DCQL query with encrypted JWT response |
Default request: the canonical presentation request targets the mDL (mso_mdoc, doctype org.iso.18013.5.1.mDL). An authorization request without an explicit dcql_query or scope receives it; SD-JWT VC and the W3C formats remain selectable via an explicit query.
Response modes: direct_post, direct_post.jwt, and dc_api / dc_api.jwt (W3C Digital Credentials API, for both SD-JWT VC and mso_mdoc)
HAIP mode: opt-in profile: "haip" enforces the High Assurance Interoperability Profile (DCQL, encrypted response, x509_hash, A128GCM + A256GCM) and rejects out-of-profile choices
Client ID schemes: redirect_uri, did:web (decentralized_identifier), verifier_attestation, x509_san_dns, x509_hash