Remove any terminating / from the Credential Issuer Identifier when forming the Credential Issuer Metadata URL

[paulbastian]

Closes #744

My observations while building this PR:

• the actual cleanest approach to this would be to forbid trailing slashes for the Credential Issuer Identifier in the first place
  • however, this is more of a breaking change and not aligned with RFC8414, which likely must have overseen this more elegant solution, as it prevents this edge case at the AS/RS side, instead of at client parsing
  • we still could add this as a recommendation, if there is appetite
• RFC8414 is also missing an example for the trailing slash, which in my opinion is important to highlight, so I added another example into the text that actually showcases the rule that is re-added in this PR

[Sakurann]

WG discussion:

• seems reasonable to add a text that recommends (SHOULD) to the issuers not to use this trailing /

[c2bo]

I believe we should apply the same rules the sub of the signed metadata?

That is currently described as

sub: REQUIRED. String matching the Credential Issuer Identifier

With this PR we are relaxing the matching rules for metadata retrieval, but are not doing the same for sub -> will likely cause mismatches in the validation.

[paulbastian]

I believe must apply the same rules the sub of the signed metadata?

That is currently described as

sub: REQUIRED. String matching the Credential Issuer Identifier

With this PR we are relaxing the matching rules for metadata retrieval, but are not doing the same for sub -> will likely cause mismatches in the validation.

This PR does not relax matching rules for, but fixes them by adding additional constraint.
As I see the sub value of signed metadata, it is a simple-string comparison with the Credential Issuer Identifier, which is not changed in this PR, so I don't see any issues.

[paulbastian]

As discussed in the WG call, I added a recommendation that Credential Issuer Identifier SHOULD NOT terminate with /, I only added this for 1.1, as I wasn't sure this is justified for errata.

[c2bo]

This PR does not relax matching rules for, but fixes them by adding additional constraint.
As I see the sub value of signed metadata, it is a simple-string comparison with the Credential Issuer Identifier, which is not changed in this PR, so I don't see any issues.

The metadata is fetched for a Credential Issuer Identifier. With this PR, a provided Credential Issuer Identifier https://issuer.example.com/ would be correctly retrieved from https://tenant.issuer.example.com/.well-known/openid-credential-issuer, but the sub in that signed metadata would likely be https://issuer.example.com, failing the matching rules of sub = Credential Issuer Identifier:

sub: REQUIRED. String matching the Credential Issuer Identifier

We are basically just moving the problem 1 layer further down for signed metadata - the fix would be to mandate that Credential Issuer Identifier not having a trailing slash I guess, but I guess that would be a breaking change?

[paulbastian]

I believe must apply the same rules the sub of the signed metadata?

That is currently described as

sub: REQUIRED. String matching the Credential Issuer Identifier

With this PR we are relaxing the matching rules for metadata retrieval, but are not doing the same for sub -> will likely cause mismatches in the validation.

If the Credential Issuer Identifier is https://issuer.example.com/ , why wouldn't the sub value as well be https://issuer.example.com/ ?

I'm also in favor of fixing the Credential Issuer Identifier in the first place, but I don't understand the problem for the proposed text.

[c2bo]

If the Credential Issuer Identifier is https://issuer.example.com/ , why wouldn't the sub value as well be https://issuer.example.com/ ?

We get Credential Issuer Identifier from whatever source (e.,g., a credential catalogue) and use it to resolve the issuer metadata to start an issuance process. With this PR we basically fix the metadata resolution to always work regardless of trailing slash, but for signed metadata it's imho somewhat likely that the sub == identifier match would still fail (for a trailing slash) --> I'd slightly modify that to not require strict string matching, but also allow removal of trailing slash for the matching.

Not a super critical thing imho, but this whole PR is basically trying to make the metadata fetching logic a bit more robust and adding the same for the sub = identifier matching logic is probably a good idea so we don't fail on the next step after fetching.