Protocol Catalog
OAuth 2.0
Section titled “OAuth 2.0”Standards: RFC 6749, RFC 7636 (PKCE), RFC 7662 (Introspection), RFC 7009 (Revocation)
| Flow | Description |
|---|---|
| Authorization Code | Standard authorization grant with redirect |
| Authorization Code + PKCE | Authorization code with Proof Key for Code Exchange |
| Client Credentials | Machine-to-machine token issuance |
| Refresh Token | Token renewal without re-authorization |
| Token Introspection | Validate and inspect active tokens |
| Token Revocation | Invalidate access or refresh tokens |
OpenID Connect
Section titled “OpenID Connect”Standards: OIDC Core 1.0, OIDC Discovery 1.0
| Flow | Description |
|---|---|
| Authorization Code | OIDC authentication with ID token |
| Hybrid | Combined code + token response |
| Implicit | Legacy OIDC implicit flow |
| UserInfo | Claims retrieval from the UserInfo endpoint |
| Discovery | OpenID Provider metadata and JWKS resolution |
| Interaction Code | Interactive authorization with PKCE |
SAML 2.0
Section titled “SAML 2.0”Standards: SAML 2.0 Core, Bindings, Profiles, Metadata
| Flow | Description |
|---|---|
| SP-Initiated SSO | Service Provider starts the login flow |
| IdP-Initiated SSO | Identity Provider starts the login flow |
| Single Logout | Coordinated logout across participants |
| Metadata Exchange | SP/IdP metadata discovery and sharing |
Demo scenarios: Assertion Deep Dive, Metadata Exploration
SCIM 2.0
Section titled “SCIM 2.0”Standards: RFC 7642, RFC 7643, RFC 7644
| Flow | Description |
|---|---|
| User Lifecycle | Create, read, update, deactivate users |
| Group Management | Group CRUD and membership management |
| Filter Queries | Filter expressions and search queries |
| Bulk Operations | Batch create/update/delete (documented; Looking Glass does not run this flow) |
| Schema Discovery | ServiceProviderConfig, ResourceTypes, Schemas |
SPIFFE/SPIRE
Section titled “SPIFFE/SPIRE”Standards: SPIFFE, SPIRE, SPIFFE Workload API, X.509-SVID, JWT-SVID
| Flow | Description |
|---|---|
| X.509-SVID Issuance | Retrieve X.509 workload identity certificate |
| JWT-SVID Issuance | Retrieve JWT workload identity token |
| mTLS Handshake | Mutual TLS using X.509-SVIDs |
| Certificate Rotation | Automatic SVID renewal |
SPIRE admin processes (workload registration, node/workload attestation, trust-bundle federation) are documented in the plugin. They are not Looking Glass runs.
Requires: SPIFFE compose overlay (docker-compose.spiffe.yml) for full mode. Demo mode returns 503.
Shared Signals Framework (SSF)
Section titled “Shared Signals Framework (SSF)”Standards: OpenID SSF 1.0, CAEP 1.0, RISC 1.0
| Catalog row | Looking Glass role |
|---|---|
| Looking Glass session | Default durable session (/looking-glass?protocol=ssf) |
| Stream Configuration | Preset: Verify stream (discovery, GET /stream, JWKS, POST /verify). Does not change RP account state |
| Push Delivery | Preset: delivery = RFC 8935, then Fire event |
| Poll Delivery | Preset: delivery = RFC 8936, then Fire event |
| CAEP Session Revoked | Preset: event = session-revoked, then Fire event |
| CAEP Credential Change | Preset: event = credential-change, then Fire event |
| RISC Account Disabled | Preset: event = account-disabled, then Fire event |
| RISC Credential Compromise | Preset: event = credential-compromise, then Fire event |
Demo scenarios: SSF in Looking Glass, Push vs Poll Comparison
SSF stays a split service (protocolsoup-ssf). Looking Glass is the run surface: catalog rows are presets into one durable session.
OID4VCI
Section titled “OID4VCI”Standards: OpenID4VCI 1.0
| Flow | Description |
|---|---|
| Pre-Authorized Code | Credential issuance with pre-authorized grant |
| Pre-Authorized + tx_code | Issuance with transaction code challenge |
| Deferred Issuance | Credential issued asynchronously |
Default credential: Mobile Driving Licence (mso_mdoc, MobileDrivingLicenceMsoMdoc) — the default and lead configuration. UniversityDegreeCredential (SD-JWT VC) and the W3C formats remain selectable.
Credential formats: mso_mdoc (ISO/IEC 18013-5 mDL, default), dc+sd-jwt (SD-JWT VC), jwt_vc_json, jwt_vc_json-ld, ldp_vc (W3C Data Integrity with ecdsa-rdfc-2019 / eddsa-rdfc-2022 cryptosuites)
OID4VP
Section titled “OID4VP”Standards: OpenID4VP 1.0, HAIP 1.0, W3C Digital Credentials API
| Flow | Description |
|---|---|
| DCQL + direct_post | DCQL query with direct_post response mode |
| DCQL + direct_post.jwt | DCQL query with encrypted JWT response |
Default request: the canonical presentation request targets the mDL (mso_mdoc, doctype org.iso.18013.5.1.mDL). An authorization request without an explicit dcql_query or scope receives it; SD-JWT VC and the W3C formats remain selectable via an explicit query.
Response modes: direct_post, direct_post.jwt, and dc_api / dc_api.jwt (W3C Digital Credentials API, for both SD-JWT VC and mso_mdoc)
HAIP mode: opt-in profile: "haip" enforces the High Assurance Interoperability Profile (DCQL, encrypted response, x509_hash, A128GCM + A256GCM) and rejects out-of-profile choices
Client ID schemes: redirect_uri, did:web (decentralized_identifier), verifier_attestation, x509_san_dns, x509_hash