Learn how to build an application that can verify an mDoc from another app on the same device

Overview

In this tutorial you will use the mDocs Mobile Verifier SDKs to build an application that can verify an mDoc presented from a different application on the same device via OID4VP , as defined in ISO 18013-7  Annex B.

1. A relying party uses the Mobile Verifier SDK to embed a remote verification workflow into a mobile application.
2. When a user interacts with the mobile application, a matching wallet application installed on their mobile device is invoked to request an mDoc for verification.
3. The user consents to sharing the requested information.
4. The user’s wallet application shares the matching mDoc with the MATTR VII tenant configured by the Mobile Verifier SDK to perform the verification workflow.
5. The MATTR VII tenant performs the required checks and returns the verification results via the Mobile Verifier SDK to the verifier application.
6. The user journey continues based on the verification results.

The result will look something like this:

To achieve this, you will build the following capabilities into your verifier application:

• Initialize the SDK, so that your application can use its functions and classes.
• Request an mDoc for verification from a compliant wallet application.
• Handle the redirect from the wallet application.
• Display the verification results.

Prerequisites

Before you get started, let’s make sure you have everything you need.

Prior knowledge

• The remote verification workflow described in this tutorial is based on the OID4VP  specification and the ISO 18013-7  standard. If you are unfamiliar with these, refer to the following resources for more information:

  • What are mDocs?
  • What is remote verification?
  • Breakdown of the remote mobile app verification workflow.

• We assume you have experience developing applications in the relevant programming languages and frameworks (Swift for iOS and Kotlin for Android).

Assets

Development environment

Testing device

You will need to have a mobile device to test the workflow.

Got everything? Let’s get going!

Overview

The following diagram depicts the workflow you will build in this tutorial:

1. The user triggers the workflow by interacting with the verifier application.
2. The verifier application uses the embedded Mobile Verifier SDK capabilities to start a presentation-based verification session with the configured MATTR VII tenant.
3. The MATTR VII tenant responds with a link to invoke a matching wallet application.
4. The verifier application uses the link to invoke a matching wallet application using a redirect.
5. The wallet application makes a request to the MATTR VII tenant to retrieve a request object, defining what information is requested for verification.
6. The MATTR VII tenant returns the request object to the wallet application.
7. The wallet application (upon user consent) returns an authorization response to the MATTR VII tenant, which includes the information required for verification.
8. The MATTR VII tenant returns the verification results to the verifier application.
9. The verifier application surfaces the verification results to the user and the interaction continues.

You will build this workflow in two parts:

1. Part 1: Setup the MATTR VII Verifier tenant.
2. Part 2: Build a mobile application with mDocs verification capabilities.

Part 1: Setup the MATTR VII Verifier tenant

The MATTR VII tenant will be used to interact with your mobile application (generating a verification request) and the wallet application (presenting an mDoc for verification) as per OID4VP and ISO/IEC 18013-7 Annex B. To enable this, you must:

1. Create a verifier application configuration: Define what applications can create verification sessions with the MATTR VII tenant, and how to handle these requests.
2. Create a trusted wallet provider configuration: Define how to invoke specific wallet applications as part of a remote verification workflow.
3. Configure a trusted issuer: The MATTR VII verifier tenant will only accept mDocs issued by these trusted issuers.

POST /v2/presentations/applications

{
    "name": "My Mobile Verifier Application",
    "type": "ios",
    "teamId": "A2B3C4D5E6",
    "bundleId": "io.mattrlabs.dev.sampleApp.MdocSampleApp",
    "openid4vpConfiguration": {
        "redirectUri": "io.mattrlabs.dev.sampleApp.MdocSampleApp://my/path"
    },
    "resultAvailableInFrontChannel": true
}

{
    "id": "0eaa8074-8cc4-41ec-9e42-072d36e2acb0",
    "name": "My Mobile Verifier Application"
    //... rest of application configuration
}

POST /v2/presentations/wallet-providers

{
    "name": "My Trusted Wallet Provider",
    "openid4vpConfiguration": {
        "authorizationEndpoint": "mdoc-openid4vp://"
    }
}

{
    "id": "99890c34-e4b7-4a23-84d6-e5de57114c00",
    "name": "My Trusted Wallet Provider",
    "openid4vpConfiguration": {
        "authorizationEndpoint": "mdoc-openid4vp://"
    }
}

POST /v2/credentials/mobile/trusted-issuers

{
    "certificatePem": "-----BEGIN CERTIFICATE-----\nMIICYzCCAgmgAwIBAgIKXhjLoCkLWBxREDAKBggqhkjOPQQDAjA4MQswCQYDVQQG\nEwJBVTEpMCcGA1UEAwwgbW9udGNsaWZmLWRtdi5tYXR0cmxhYnMuY29tIElBQ0Ew\nHhcNMjQwMTE4MjMxNDE4WhcNMzQwMTE1MjMxNDE4WjA4MQswCQYDVQQGEwJBVTEp\nMCcGA1UEAwwgbW9udGNsaWZmLWRtdi5tYXR0cmxhYnMuY29tIElBQ0EwWTATBgcq\nhkjOPQIBBggqhkjOPQMBBwNCAASBnqobOh8baMW7mpSZaQMawj6wgM5e5nPd6HXp\ndB8eUVPlCMKribQ7XiiLU96rib/yQLH2k1CUeZmEjxoEi42xo4H6MIH3MBIGA1Ud\nEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRFZwEOI9yq\n232NG+OzNQzFKa/LxDAuBgNVHRIEJzAlhiNodHRwczovL21vbnRjbGlmZi1kbXYu\nbWF0dHJsYWJzLmNvbTCBgQYDVR0fBHoweDB2oHSgcoZwaHR0cHM6Ly9tb250Y2xp\nZmYtZG12LnZpaS5hdTAxLm1hdHRyLmdsb2JhbC92Mi9jcmVkZW50aWFscy9tb2Jp\nbGUvaWFjYXMvMjk0YmExYmMtOTFhMS00MjJmLThhMTctY2IwODU0NWY0ODYwL2Ny\nbDAKBggqhkjOPQQDAgNIADBFAiAlZYQP95lGzVJfCykhcpCzpQ2LWE/AbjTGkcGI\nSNsu7gIhAJfP54a2hXz4YiQN4qJERlORjyL1Ru9M0/dtQppohFm6\n-----END CERTIFICATE-----"
}

Part 2: Build a mobile application with mDocs verification capabilities

Now that the MATTR VII verifier tenant is properly configured, you can proceed with the steps required to embed verification capabilities into your mobile verifier application:

1. Setup your environment: Setup the required infrastructure for your mobile application.
2. Initialize the SDK: So that the SDK functions are available in your mobile application.
3. Request a credential from wallet application: Build the capability to request an mDoc for verification from a wallet application.
4. Display verification results:

Step 1: Environment setup

Step 2: Initialize the SDK

Step 3: Request a credential from wallet application

Once the SDK is initialized, you can start building the capabilities to request an mDoc for verification from a wallet application. This is done by:

1. Creating a request object that defines what information is required for verification.
2. Sending this request to the wallet application installed on the device.
3. Redirecting the user to the wallet application to present the requested mDoc.

Step 4: Display verification results

Once the user provides their consent to share the requested information, the wallet application will send the response back to the MATTR VII tenant, which will then return the verification results to your verifier application and redirect the user back to the configured redirect URI. In this part of the tutorial you will build the capability to handle this redirect and display the verification results in your application.

Test the end-to-end workflow

1. Run the app.
2. Select the Request credentials button.
   You should be redirected to a compliant wallet application, where you will see the verification request details and choose what mDoc to present for verification.
3. Use the wallet application to present the requested mDoc.
   You will be redirected back to the verifier application where you will see the verification results.

You should see a result similar to the following:

1. The verifier app starts a presentation session and gets redirected.
2. The user is redirected to a compliant wallet application.
3. The user provides their consent to share the requested information.
4. The wallet application sends the response back to the MATTR VII tenant.
5. The MATTR VII tenant redirects the user back to the verifier app with the verification results.
6. The verifier app fetches the result and presents the result to user.

Congratulations! Your verifier application can now verify mDocs presented from a compliant wallet installed on the same mobile device.

Summary

You have just used the mDocs Mobile Verifier SDKs to build an application that can verify an mDoc presented from a compliant wallet on the same device using a remote presentation workflow as per OID4VP and ISO/IEC 18013-7 Annex B.

This was achieved by building the following capabilities into the application:

• Initialize the SDK, so that your application can use its functions and classes.
• Request an mDoc for verification from a compliant wallet application.
• Display verification results in your verifier application.

What’s next?

• You can check out the SDKs reference documentation to learn more about available functions and classes:
  • iOS