Readme updates - #80
Conversation
Signed-off-by: Mart Aarma <mart.aarma@nortal.com>
| JsonSerializer.Serialize(signingCertificate.SupportedSignatureAlgorithms))); | ||
| } | ||
|
|
||
| var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme); |
There was a problem hiding this comment.
Could we show an explicit application-specific authorization check stub before SignInAsync? Successful token validation establishes the user’s identity, but not their permission to access the service, this check is required before creating the authenticated session.
|
|
||
| The authentication protocol, validation requirements, authentication token format and nonce usage are described in more detail in the [Web eID system architecture document](https://github.com/web-eid/web-eid-system-architecture-doc#authentication-1). | ||
|
|
||
| # Authentication token format |
There was a problem hiding this comment.
Could we keep the token schema in the canonical Web eID specification and limit this README to the formats supported by this library? Reproducing the field definitions here creates another normative-looking copy and already omits the 1.1 intermediate certificate fields. Illustrative examples could remain with a link to the canonical definition.
|
|
||
| The Web eID authentication protocol defines two token formats currently supported by this library: | ||
|
|
||
| - **Format v1.0** – Used in desktop Web eID authentication flows with traditional smart card readers. |
There was a problem hiding this comment.
web-eid:1.0 is not desktop-only, the mobile flow also uses it when signing certificate information is not requested. Could we describe it as the base authentication token format without signing certificate information?
2 participants
Signed-off-by: Mart Aarma mart.aarma@nortal.com