[Txauth] Interact Section

[Francis Pouatcha <[e-mail]>]

The interact section of the <<draft-richer-transactional-authz-08>> sort of
defines the choreographie of the authorization process (flow). I am missing
something like:

- A redirect flow
here the AS instructs the RC to redirect to RO to the given interaction
URL.  Upon completing the RO interaction, the RO will be redirected back to
the callback.uri specified by the RC. SO there is no callback here.

- A decoupled flow
is actually not visible. This is, I assume upon receiving the
<<transaction authorization request>>, the AS initiated an interaction with
the RO (-device). Upon completion of the interaction with the RO, the AS
invokes the provided callback.uri to deliver the token (authorization) used
by the RC to proceed with  the transaction request>>.

- An embedded flow
seems hidden behind the didcom section. With the evolding number smart
devices, the embedded flow shall open room for different types of
synchronous transaction authorization requests in which the RO gives a
verifiable assertion (proof of possession) to the RC for use at the
<<transaction authorization endpoint>> in exchange for the seeked access
token. This assertion can range from a simple password to a
cryptographically signed claim.

"interact": {
  "embedded":[{
      "mode":"encrypted password"
    },
    {
      "mode":"didcom"
    }],
   "redirect":[{
      "callback": {
        "uri": "https://example.com/rc-front-channel/123456",
        "nonce": "VJLO6A4CAYLBXHTR0KRO"
      }
    }],
    "decoupled": [{
      "callback": {
        "uri": "https://example.com/rc-back-channel/123456",
        "nonce": "VJLO6A4CAYLBXHTR0KRO"
      }
    }]
}

Still no idea on how to express the RC flow preferences to the AS. Maybe
the order of entries in the interact sesion
-- 
Francis Pouatcha
Co-Founder and Technical Lead at adorys
https://adorsys-platform.de/solutions/