Example configuration and more clarification on the values required in WebApp config

[jotheman0303]

Feature request:

Hi, in the example script for the WebApp configuration the explanation comments are a bit short:

I am struggling with what to provide in what, a bit of help with that would be appreciated. I am not usually this far "into" this type of thing. Can you explain further, and perhaps add more info in comments on:

• AzureAd__ClientId: I assume this would be the Client ID of the WebApp connecting out to the keyvault?
• AzureAD__Domain: I assume this would be the "regular" domain, not the onmicrosoft one?
• VerifiedEmployeeId__Authority: Is the location where the DID-file is hosted? So for example "did.domain.com"?
• VerifiedEmployeeId__manifest: And this would be the whole URL of the DID-file? Such as "https://did.domain.com/.well-known/did.json"?

An example screenshot would help!
Thanks in advance for your help with his!

[mtakemoto]

Hey @jotheman0303 ,

I've set this up for my workplace and can help out here:

1. Yep, that's the Client ID of the app registration in your Azure AD. That's step 5 on the guide here: https://github.com/Azure-Samples/VerifiedEmployeeIssuance/blob/main/ReadmeFiles/Deployment.md#5-create-application-registration

2. For the domain I think either would work. We're using our custom domain (whoiam.ai) instead of the onmicrosoft one and it works.

3. The authority comes from the value in Verified ID --> Organization settings --> Decentralized identifier in the Entra portal. e.g. did:web:yourcompany.com. If you chose to use blockchain, it would start with did:ion, but it should definitely start with did:

4. The manifest is the address of a specific credential, like the Verified employee one you're making for this one. To find that, go to Verified ID --> Credentials and click on your credential. The manifest URL should be a link near the bottom. Fun fact: it's a JWT, so you can plug the value into https://jwt.ms and decode a bunch of interesting information about your credential.

I believe those two uploaded JSON files you mentioned are used mostly for domain verification - I haven't had to deal with them much after I got our tenant set up.

Good luck!

[jotheman0303]

Much appreciate the feedback @mtakemoto, this helps me greatly in the configuration!
And a question I have on item 4 that you mention: Since you need to know the address of a specific credential, that would mean you would have to go through the whole configuration of Verified ID (hosting the did-records etc) and create a/the credential (in our case the LinkedIn credential we want to retrieve) and get the manifest from it/there?

Again, the article is good with enough detail, but the "guidance" around creating this configuration-file I would say can use for more depth. Thanks for all the help!

[mtakemoto]

@jotheman0303 For sure!

It looks like this documentation is focused on the app deployment but there's a guide here for how to set the credential up (and gives a good overview of the whole system). It's step #2 in the link below:

https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/linkedin-employment-verification