Decouple Identity Document from Auth and Discovery

[ChakshuGautam]

Specific Priority Use Cases

Laxmi wants to transfer from govt school in Varanasi to a govt school in Lucknow

Scenario 1: Laxmi accesses her wallet and shares her School Leaving Certificate (SLC) credential with the govt school in Lucknow. Now the principal of the govt school in Lucknow needs to digitally verify using Laxmi's preferred source (Aadhaar or wallet linked phone # based OTP) whether Laxmi is who she claims to be.

Scenario 2: Laxmi cannot access her digital wallet as her parents only have a feature phone. So she takes a printed copy of her SLC from her school in Varanasi and shares it with the principal of the govt school in Lucknow. The principal will need to digitally verify using Laxmi's Aadhaar OTP whether Laxmi is who she claims to be.

Scenario 3: Laxmi loses her printer SLC. So then she shares her school ID with the principal of the govt school in Lucknow. The principal digitally verifies Laxmi using her Aadhaar OTP and gets her consent to access her digital SLC.

Also, a private school may want to use a separate auth mechanism like a Microsoft Teams account as a login mechanism.

In all the scenarios mentioned above the ability to digitally verify the user from multiple sources based on the preference of the user is what this functionality will enable. This needs to be piloted on the ground starting March / April.

Suggested Solution

1. Identity Document as a separate construct from authentication.
2. Authentication extensions to existing auth providers as part of the public document.
3. UP has use cases where there are multiple auth providers for Entities and they can pick and choose what they want to be authenticated with.
4. Every ID should also have a unique signature and public/private key pair attached to it to ensure they (and the data they sign) can be verified.
5. Recognize identities created by other sources as valid IDs. (say DIDs from other systems to be able to manage their own credentials here)

How this benefits

• What this allows for is a verifiable Identity.
• The discovery of a Identity is a separate layer (allows for offline verifiability as well)
• and similarly, authentication services over an Identity are separately defined as well.

This allows for a pick-and-choose kind of implementation for an ID and is not based on a centralized authority that governs how every identity is authenticated or issued.

[csamprajan]

Please review this proposal:

https://github.com/orgs/Sunbird-RC/discussions/322#discussioncomment-5538477

@ChakshuGautam