[OID4VCI] Limit the audience of the access token to credential issuance
Description
There are serious concerns of possible impersonation as a user with the role credential-offer-create could obtain pre-authorized codes, and subsequently access tokens, for any other user (See https://github.com/keycloak/keycloak/issues/44745). As regular Keycloak access tokens, they could be used for endpoints other than the OpenID4VCI Credential Endpoint. This ticket aims to limit the use of tokens obtained in exchange of pre-authorized codes.
Value Proposition
Address a critical security vulnerability.
Goals
Limit the audience of the access token to credential issuance only
Non-Goals
Revisiting the flow of actions is out of scope.
Discussion
No response
Notes
Will other endpoints abide by the audience restriction in the access token?
For reference, pre-authorized codes are returned at the Credential Offer Endpoint in a completely opaque form.
"pre-authorized_code": "urn:oid4vci:code:TP8sa3h3c0WDdxCaGmhpiCqjpq3OCyBSEYXm5zkgkDowjuTrgVlR8261d2jNdKwb"We should consider the alternative solution of producing pre-authorized codes as JWT as part of this ticket, which will be useful for restricting audiences.
eyJraWQiOiI1ZGNiZWU4NjNiNWQ3Y2MzMGM5YmExZjczOTNkYWNjNmMxNjYxMDc4MmU0YjZhMTkxZjk0YTdlOGIxZTE1MTBmIiwidHlwIjoiSldUIiwiYWxnIjoiRVMyNTYifQ.eyJhdWQiOiJodHRwczovL3Rva2VuLmFjY291bnQuZ292LnVrIiwiY2xpZW50SWQiOiJURVNUX0NMSUVOVF9JRCIsImlzcyI6Imh0dHBzOi8vZXhhbXBsZS1jcmVkZW50aWFsLWlzc3Vlci5nb3YudWsiLCJjcmVkZW50aWFsX2lkZW50aWZpZXJzIjpbIjE2NTAwNWYwLTI4YjktNGFhMS05NTM4LTNmZThlZTc0N2Q0YiJdLCJleHAiOjE3Mzk0NTc3ODAsImlhdCI6MTczOTQ1NzQ4MH0.ImEbm6m4IoxW9UD-sPNi4ez26F7qiv5t-g7RFzEtbPegp5jNqulYvlPmRKj-QNBIifgXtrYID9-dHNWOQTybjQ{
"kid": "5dcbee863b5d7cc30c9ba1f7393dacc6c16610782e4b6a191f94a7e8b1e1510f",
"typ": "JWT",
"alg": "ES256"
}
.
{
"aud": "https://token.account.gov.uk/",
"clientId": "TEST_CLIENT_ID",
"iss": "https://example-credential-issuer.gov.uk/",
"credential_identifiers": [
"165005f0-28b9-4aa1-9538-3fe8ee747d4b"
],
"exp": 1739457780,
"iat": 1739457480
}Source: keycloak/keycloak