Hi @IngridPuppet, thanks for the feedback.

So your contribution in this regard, whatsoever, would be greatly appreciated.

I may be able to do some contributions going forward, currently I'm trying to work out a demo structure, with https://github.com/adorsys/keycloak-ssi-deployment that is linked to from the Keycloak docs being of great help to see what currently works and what does not.

Though a bit anti-pattern to send the pre-authorized code "alongside" the transaction code, it makes sense to me to delegate the out-of-band forwarding to the issuer app as you are suggesting

What I'm thinking is that Keycloak itself will return both in the grant response. But the custom issuer application that interposes over Keycloak such as a University and that interacts with a a wallet, would for example, email the transaction code to the logged in user, and the wallet, at the credential offer UI page will request the user to add that transaction code...

I'm not sure Keycloak itself will deal with providing the transaction code out of band, the user's email or phone number is not available at the pre-authorized code grant request, perhaps only indirectly.

Is it what you are thinking about too ?

Thanks

Hi @sberyozkin.

I may be able to do some contributions going forward, currently I'm trying to work out a demo structure, with https://github.com/adorsys/keycloak-ssi-deployment that is linked to from the Keycloak docs being of great help to see what currently works and what does not.

Great! Then, you would want to know that the project now lives in the keycloak-oauth-sig repository. See https://github.com/keycloak/keycloak-oauth-sig/tree/main/oid4vci-deployment

Is it what you are thinking about too ?

Exactly what I understood from your point. The highlight that details such as the user's phone number may not be known to Keycloak constitutes a reasonable motivation for the projected implementation, in my opinion.

Hi @IngridPuppet

Great! Then, you would want to know that the project now lives in the keycloak-oauth-sig repository. See https://github.com/keycloak/keycloak-oauth-sig/tree/main/oid4vci-deployment

Thanks, neatly restructured indeed.

FYI, I'm using deployment scripts only with some demo tuning, with all of the authorization code flow script migrated to Quarkus.

OK, so I'm going to experiment with my demo issuer which is a confidential client where it would get the preauthorized code from Keycloak, such that the wallet does not interact with the Keycloak issuer endpoint itself but via this demo issuer only, to see how associating a transaction code can work... Will take a little while, I'll get back at some point to this discussion

Thanks