Integrating identity management with verifiable credentials
A system may be configured for integrating centralized identity management with decentralized identities and verified credentials. The techniques can bridge Web2 identity management with emerging Web3 decentralized credentialing to facilitate secure and interoperable access to resources with both Web2- and Web3-based authentication mechanisms. The systems and methods may streamline the registration and login processes by using a sequence of redirects and secure data exchanges to allow users to gain access to a requested resource easily with a single scan of their digital wallet application. The system can unify the user experiences for obtaining VCs and logging into a resource (whether Web2- or Web3-based) into a single flow by enabling decentralized authentication and authorization, even in cases where a user has not previously registered with the resource. The overall user experience may allow user-driven management of personal credentials while keeping registration and login time faster than password-centric equivalents.
1 . A computer-implemented method comprising:
receiving, by an identity access manager system from a client application executing on a user device based on a redirect from a first resource system, a first request to access a first application hosted by the first resource system;
receiving, from a digital wallet application, a first verifiable presentation (VP) corresponding to the first request;
verifying that the first VP demonstrates possession of a verifiable credential (VC) that corresponds to access to the first application;
in response to verifying that the first VP demonstrates possession of the VC, establishing a first session between the client application and the digital wallet application, the first session corresponding to a domain of the identity access manager system;
sending a first authentication token corresponding to the first session to the client application;
receiving, from the client application, the first authentication token and second data representing a second request for first session data corresponding to the first session; and
sending the first session data to the client application based on the first session, the first session data allowing the first application to establish a second session between the client application and the digital wallet application, the second session corresponding to a domain of the first resource system.
2 . The computer-implemented method of claim 1 , further comprising:
in response to receiving the first request, causing the client application to display a quick-response (QR) code representing a destination for the first VP, the digital wallet application generating the VP in response to scanning the QR code displayed by the client application.
3 . The computer-implemented method of claim 1 , further comprising:
after receiving the first VP, sending the VP to a verifier system for verification; and
receiving, from the verifier system, an indication that the VP demonstrates possession of the VC.
4 . The computer-implemented method of claim 1 , further comprising:
in response to the first request, causing the client application to present a sign-up page;
receiving, from the client application based on presentation of the sign-up page, an email address; and
determining that the first VP received from the digital wallet application includes a representation of the email address, wherein establishing the first session is additionally based on determining that the first VP includes a representation of the email address.
5 . The computer-implemented method of claim 1 , further comprising:
receiving, from the user device based on a redirect from a second resource system, third data representing a third request to access a second application;
receiving, from the digital wallet application, a second VP corresponding to the third request;
verifying that the second VP demonstrates possession of the VC;
in response to verifying that the second VP demonstrates possession of the VC, establishing a third session between the client application and the digital wallet application; and
sending, to the client application based on the third session, second session data allowing the second application to establish a fourth session corresponding to a domain of the second resource system.
6 . The computer-implemented method of claim 5 , wherein the first application corresponds to Web3-based authentication, and the second application corresponds to Web2-based authentication.
7 . The computer-implemented method of claim 1 , further comprising:
prior to receiving the first request, receiving, from the user device, third data representing a third request to access a second application;
causing the user device to present a sign-up page;
receiving an email address from the user device;
sending a verification link to the email address, the verification link corresponding to a request for the VC from a trusted issuer;
receiving, from the trusted issuer, an indication of successful registration of the VC;
in response to receiving the indication, establishing a third session between the client application and the digital wallet application; and
sending, to the client application based on the third session, second session data allowing the second application to establish a fourth session corresponding to a domain of the second application.
8 . A system, comprising:
one or more processors; and
at least one memory comprising instructions that, when executed by the one or more processors, cause the system to:
receive, by an identity access manager system from a client application executing on a user device based on a redirect from a first resource system, a first request to access a first application hosted by the first resource system;
receive, from a digital wallet application, a first verifiable presentation (VP) corresponding to the first request;
verify that the first VP demonstrates possession of a verifiable credential (VC) that corresponds to access to the first application;
in response to verifying that the first VP demonstrates possession of the VC, establish a first session between the client application and the digital wallet application, the first session corresponding to a domain of the identity access manager system;
send a first authentication token corresponding to the first session to the client application;
receive, from the client application, the first authentication token and second data representing a second request for first session data corresponding to the first session; and
send the first session data to the client application based on the first session, the first session data allowing the first application to establish a second session between the client application and the digital wallet application, the second session corresponding to a domain of the first resource system.
9 . The system of claim 8 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
in response to receiving the first request, cause the client application to display a quick-response (QR) code representing a destination for the first VP, the digital wallet application generating the VP in response to scanning the QR code displayed by the client application.
10 . The system of claim 8 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
after receiving the first VP, send the VP to the verifier system for verification; and
receive, from the verifier system, an indication that the VP demonstrates possession of the VC.
11 . The system of claim 8 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
in response to the first request, causing the client application to present a sign-up page;
receiving, from the client application based on presentation of the sign-up page, an email address; and
determine that the first VP received from the digital wallet application includes a representation of the email address, wherein establishing the first session is additionally based on determining that the first VP includes a representation of the email address.
12 . The system of claim 8 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
receive, from the user device based on a redirect from a second resource system, third data representing a third request to access a second application;
receive, from the digital wallet application, a second VP corresponding to the third request;
verify that the second VP demonstrates possession of the VC;
in response to verifying that the second VP demonstrates possession of the VC, establish a third session between the client application and the digital wallet application; and
sending, to the client application based on the third session, second session data allowing the second application to establish a fourth session corresponding to a domain of the second resource system.
13 . The system of claim 12 , wherein the first application corresponds to Web3-based authentication, and the second application corresponds to Web2-based authentication.
14 . The system of claim 8 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
prior to receiving the first request, receive, from the user device, third data representing a third request to access a second application;
cause the user device to present a sign-up page;
receive an email address from the user device;
send a verification link to the email address, the verification link corresponding to a request for the VC from a trusted issuer;
receive, from the trusted issuer, an indication of successful registration of the VC;
in response to receiving the indication, establishing a third session between the client application and the digital wallet application; and
send, to the client application based on the third session, second session data allowing the second application to establish a fourth session corresponding to a domain of the second application.
15 . A computer-implemented method comprising:
receiving, by an identity access manager system from a client application executing on a user device based on a redirect from a first resource system, a first request to access a first application hosted by the first resource system;
causing the client application to present a sign-up page;
receiving a first email address from the client application;
sending a verification link to the first email address, the verification link corresponding to a request for a verified credential (VC) from a trusted issuer;
receiving, from the trusted issuer, first data representing an indication of successful registration of the VC and a decentralized identifier (DID) corresponding to a digital wallet application used to obtain the VC;
in response to receiving the indication, establishing a first session between the client application and the digital wallet application, the first session corresponding to a domain of the identity access manager system;
sending a first authentication token corresponding to the first session to the client application;
receiving, from the client application, the first authentication token and second data representing a second request for first session data corresponding to the first session; and
sending the first session data to the client application based on the first session, the first session data allowing the first application to establish a second session between the client application and the digital wallet application, the second session corresponding to a domain of the first resource system.
16 . The computer-implemented method of claim 15 , wherein selecting the verification link causes the client application to display a quick-response (QR) code, the digital wallet application scanning the QR code to obtain the VC.
17 . The computer-implemented method of claim 15 , further comprising:
receiving, from the client application based on a redirect from a second resource system, third data representing a third request to access a second application;
receiving, from the digital wallet application, a verifiable presentation (VP) corresponding to the third request;
verifying that the VP demonstrates possession of the VC;
in response to verifying that the VP demonstrates possession of the VC, establishing a third session between the client application and the digital wallet application; and
sending, to the client application based on the third session, second session data allowing the second application to establish a fourth session corresponding to a domain of the second application.
18 . The computer-implemented method of claim 17 , further comprising:
in response to receiving the third request, causing the client application to display a quick-response (QR) code representing a destination for the VP, the digital wallet application generating the VP in response to scanning the QR code displayed by the client application.
19 . The computer-implemented method of claim 17 , further comprising:
in response to the second request, causing the client application to present a sign-up page;
receiving, from the client application based on presentation of the sign-up page, the email address; and
determining that the VP received from the digital wallet application includes a representation of the email address, wherein establishing the second session is additionally based on determining that the VP includes the email address.
20 . The computer-implemented method of claim 17 , wherein the first application corresponds to Web3-based authentication, and the second application corresponds to Web2-based authentication.