[java-idp-plugin-vci] 01/01: Replace a hard coded certificate chain used for passing tests with a strategy
Codeberg
noreply at shibboleth.net
Thu Nov 20 06:07:41 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/STRFORCERTCHAIN
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/9517615fb44c8dbd716e67d0d4ad5a8ff0bf96e3
commit 9517615fb44c8dbd716e67d0d4ad5a8ff0bf96e3
Author: jlauros <janne.lauros at csc.fi>
AuthorDate: Thu Nov 20 08:07:19 2025 +0200
Replace a hard coded certificate chain used for passing tests with a strategy
---
.../FormOutboundCredentialsResponseMessage.java | 68 ++++++++++------------
1 file changed, 32 insertions(+), 36 deletions(-)
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
index 7a2f893..92825cc 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundCredentialsResponseMessage.java
@@ -47,6 +47,7 @@ import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -85,12 +86,17 @@ public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponse
@Nullable
private SignatureSigningParameters signatureSigningParameters;
+ /** Strategy used to obtain the certificate chain for signing key. */
+ @Nonnull
+ private Function<SignatureSigningParameters, List<Base64>> certificateChainLookupStrategy;
+
public FormOutboundCredentialsResponseMessage() {
final Function<ProfileRequestContext, SecurityParametersContext> splcs = new ChildContextLookup<>(
SecurityParametersContext.class).compose(new OutboundMessageContextLookup());
assert splcs != null;
securityParametersLookupStrategy = splcs;
issuerLookupStrategy = (Function<ProfileRequestContext, String>) new IssuerLookupFunction();
+ certificateChainLookupStrategy = FunctionSupport.constant(null);
}
/**
@@ -116,6 +122,18 @@ public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponse
issuerLookupStrategy = Constraint.isNotNull(strategy, "IssuerLookupStrategy lookup strategy cannot be null");
}
+ /**
+ * Set the strategy used to locate the issuer value to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setCertificateChainLookupStrategy(
+ @Nonnull Function<SignatureSigningParameters, List<Base64>> strategy) {
+ checkSetterPreconditions();
+ certificateChainLookupStrategy = Constraint.isNotNull(strategy,
+ "CertificateChainLookupStrategy lookup strategy cannot be null");
+ }
+
/**
* Get the signing parameters to apply.
*
@@ -187,35 +205,25 @@ public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponse
ctx.getProofs().forEach(proof -> {
Map<String, Object> cnfKid = new HashMap<>();
try {
- cnfKid.put("jwk", new ObjectMapper().readValue(proof.getHeader().getJWK().toJSONString(), Object.class));
+ cnfKid.put("jwk",
+ new ObjectMapper().readValue(proof.getHeader().getJWK().toJSONString(), Object.class));
} catch (JsonProcessingException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
- // TODO: vct is the credential configuration id in SD JWT. Here we use however "instance" specific
- // identifier that happes to be in our case derived from it. We need to get the real configuration id here.
+ // TODO: vct is the credential configuration id in SD JWT. Here we use however
+ // "instance" specific
+ // identifier that happes to be in our case derived from it. We need to get the
+ // real configuration id here.
Builder build = new JWTClaimsSet.Builder().claim("vct", ctx.getCredentialIdentifier().split("_")[0])
.claim("iss", issuerLookupStrategy.apply(profileRequestContext))
// Just to pass happy path test.
- .claim("exp", Instant.now().getEpochSecond()+3600)
- .claim("_sd", sdClaims.get_sd()).claim("_sd_alg", sdClaims.get_alg()).claim("cnf", cnfKid)
- .issueTime(new Date());
+ .claim("exp", Instant.now().getEpochSecond() + 3600).claim("_sd", sdClaims.get_sd())
+ .claim("_sd_alg", sdClaims.get_alg()).claim("cnf", cnfKid).issueTime(new Date());
JWTClaimsSet claimsSet = build.build();
- //Now we pretend setting a certificate chain here.
- List<Base64> chain= new ArrayList<>();
- chain.add(new Base64("MIIB4DCCAYWgAwIBAgIUaVbPKGSv6mVnyNbTOo1E9AWr+r4wCgYIKoZIzj0EAwIw\n"
- + "RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu\n"
- + "dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNTA1MDkwOTI4MTVaFw0zNTA1MDcw\n"
- + "OTI4MTVaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD\n"
- + "VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjO\n"
- + "PQMBBwNCAASpD0RJ4itDfomKNYz7zF1yNfBjjpFben1gO0/QxVouceclWUasKdbX\n"
- + "XvwpyguutsFvlxUIRDqxgD4tC0xuDqSPo1MwUTAdBgNVHQ4EFgQUTC/h0/AgKp/3\n"
- + "FVZJBJoJBcX/hQMwHwYDVR0jBBgwFoAUTC/h0/AgKp/3FVZJBJoJBcX/hQMwDwYD\n"
- + "VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNJADBGAiEA87tC4qr0HJIMZylNO3Xv\n"
- + "FhSb/DHZt3Pp/WVTCRpby7YCIQCbvW/6IEk1hNxpX49zLyoQpSF8DW1a/cTMr2Te\n"
- + "Aa1KHw=="));
SignedJWT signedJWT = new SignedJWT(
- new JWSHeader.Builder(new JWSAlgorithm(signatureSigningParameters.getSignatureAlgorithm())).x509CertChain(chain)
+ new JWSHeader.Builder(new JWSAlgorithm(signatureSigningParameters.getSignatureAlgorithm()))
+ .x509CertChain(certificateChainLookupStrategy.apply(signatureSigningParameters))
.type(new JOSEObjectType("dc+sd-jwt")).keyID("signing").build(),
claimsSet);
try {
@@ -232,26 +240,14 @@ public class FormOutboundCredentialsResponseMessage extends AbstractOIDCResponse
});
} else {
Builder build = new JWTClaimsSet.Builder().claim("vct", ctx.getCredentialIdentifier())
- // Just to pass happy path test.
- .claim("exp", Instant.now().getEpochSecond()+3600)
+ // Just to pass happy path test.
+ .claim("exp", Instant.now().getEpochSecond() + 3600)
.claim("iss", issuerLookupStrategy.apply(profileRequestContext)).claim("_sd", sdClaims.get_sd())
.claim("_sd_alg", sdClaims.get_alg()).issueTime(new Date());
JWTClaimsSet claimsSet = build.build();
- //Now we pretend setting a certificate chain here.
- List<Base64> chain= new ArrayList<>();
- chain.add(new Base64("MIIB4DCCAYWgAwIBAgIUaVbPKGSv6mVnyNbTOo1E9AWr+r4wCgYIKoZIzj0EAwIw\n"
- + "RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu\n"
- + "dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNTA1MDkwOTI4MTVaFw0zNTA1MDcw\n"
- + "OTI4MTVaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD\n"
- + "VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjO\n"
- + "PQMBBwNCAASpD0RJ4itDfomKNYz7zF1yNfBjjpFben1gO0/QxVouceclWUasKdbX\n"
- + "XvwpyguutsFvlxUIRDqxgD4tC0xuDqSPo1MwUTAdBgNVHQ4EFgQUTC/h0/AgKp/3\n"
- + "FVZJBJoJBcX/hQMwHwYDVR0jBBgwFoAUTC/h0/AgKp/3FVZJBJoJBcX/hQMwDwYD\n"
- + "VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNJADBGAiEA87tC4qr0HJIMZylNO3Xv\n"
- + "FhSb/DHZt3Pp/WVTCRpby7YCIQCbvW/6IEk1hNxpX49zLyoQpSF8DW1a/cTMr2Te\n"
- + "Aa1KHw=="));
SignedJWT signedJWT = new SignedJWT(
- new JWSHeader.Builder(new JWSAlgorithm(signatureSigningParameters.getSignatureAlgorithm())).x509CertChain(chain)
+ new JWSHeader.Builder(new JWSAlgorithm(signatureSigningParameters.getSignatureAlgorithm()))
+ .x509CertChain(certificateChainLookupStrategy.apply(signatureSigningParameters))
.type(new JOSEObjectType("dc+sd-jwt")).keyID("signing").build(),
claimsSet);
try {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list