CAMARA Guidelines: Phone number identification with 3Legs

[FabrizioMoggio]

Problem description
CAMARA Guidelines define to get the phone number from the access token:
https://github.com/camaraproject/Commonalities/blob/main/documentation/API-design-guidelines.md#appendix-a-infodescription-template-for-device-identification-from-access-token

and if anyway provided in the API invocation a check must be done.

Expected behavior
get MSISDN from the access token

Alternative solution
still use PhoneNumber as input parameter and return error 403 (INVALID_TOKEN_CONTEXT) if it is not equal with the value from the access token

Additional context
camaraproject/Commonalities#233
camaraproject/SimSwap#117

[FabrizioMoggio]

I propose to go for the "Alternative solution":

"still use PhoneNumber as input parameter and return error 403 (INVALID_TOKEN_CONTEXT) if it is not equal with the value from the access token"

It is easier for the Developer to understand the flow in my opinion.

[FabrizioMoggio]

With a reference to: https://github.com/camaraproject/IdentityAndConsentManagement/blob/main/documentation/CAMARA-Security-Interoperability.md#oidc-authorization-code-flow

In my understanding, for the CFS API, we use CIBA and the API Consumer should use: "tel" in the "login_hint".

This is not documented in our API. I propose to add this topic in the in the info.description along with description of the whole process as defined here: https://github.com/camaraproject/Commonalities/blob/main/documentation/API-design-guidelines.md#appendix-a-infodescription-template-for-device-identification-from-access-token

[FabrizioMoggio]

In the current PR for the test cases I have considered phone number in the access token as optional but I have a doubt on this interpretation of mine, so I opened this discussion in Commonalities:

camaraproject/Commonalities#248

[FabrizioMoggio]

According to camaraproject/Commonalities#248

phone number is always in the access token: the test cases must be updated consequently

[FabrizioMoggio]

Implemented with in rel 0.2.0 wip: #48

[FabrizioMoggio]

login_hint mandatory - fixed with PR: #54