[java-idp-plugin-vci] 02/02: DPoP validiation flow for token endpoint

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch DPOP
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/7fc34a3cf1a78066c9eb4756d6e9d1db6f8ee184

commit 7fc34a3cf1a78066c9eb4756d6e9d1db6f8ee184
Author: jlauros <janne.lauros at csc.fi>
AuthorDate: Mon Dec 1 16:39:27 2025 +0200

    DPoP validiation flow for token endpoint
---
 .../idp/flows/openid/vci/abstract-api/abstract-api-flow.xml           | 4 ++--
 .../net/shibboleth/idp/flows/openid/vci/token/token-beans.xml         | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
index f4ba602..061dcb0 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
@@ -2,7 +2,7 @@
 <flow xmlns="http://www.springframework.org/schema/webflow" 
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
       xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd" 
-      parent="openid/vci/abstract, oidc/metadata-lookup" 
+      parent="openid/vci/abstract, oidc/metadata-lookup, oauth2/dpop-proof-validation" 
       abstract="true">
 
   <action-state id="DecodeMessage">
@@ -31,7 +31,7 @@
   <action-state id="AuthenticationSetup">
     <evaluate expression="InitializeAuthenticationContext" />
     <evaluate expression="'proceed'" />
-    <transition on="proceed" to="DoAuthenticationSubflow" />
+    <transition on="proceed" to="DoDPoPProofValidation" />
   </action-state>
 
   <subflow-state id="DoAuthenticationSubflow" subflow="authn">
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml
index 6210619..fc184d3 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml
@@ -56,6 +56,9 @@
     </property>
     <property name="mappedErrors">
       <map value-type="com.nimbusds.oauth2.sdk.ErrorObject">
+        <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_DPOP_PROOF}" value="#{T(com.nimbusds.oauth2.sdk.token.DPoPTokenError).INVALID_DPOP_PROOF}" />
+        <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).MISSING_DPOP_PROOF}" value="#{T(com.nimbusds.oauth2.sdk.token.DPoPTokenError).INVALID_DPOP_PROOF}" />
+        <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_DPOP_NONCE}" value="#{T(com.nimbusds.oauth2.sdk.token.DPoPTokenError).USE_DPOP_NONCE}" />
         <entry key="#{T(org.opensaml.profile.action.EventIds).ACCESS_DENIED}" value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).INVALID_CLIENT}" />
         <entry key="#{T(org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds).NO_CREDENTIAL_OFFER}" value="#{T(org.geant.shibboleth.plugin.openidvci.messaging.error.OpenIDVCIError).NO_CREDENTIAL_OFFER}" />
       </map>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.