[java-idp-plugin-vci] branch dev/PROOF updated: Proof nonce decoupled from dpop proof nonce configuration. Verify nonce and audience of proof
Codeberg
noreply at shibboleth.net
Thu Apr 9 11:57:31 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/PROOF
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/a69687eb0b316dc3bb0e88dfcbb8940891981dfa
The following commit(s) were added to refs/heads/dev/PROOF by this push:
new a69687e Proof nonce decoupled from dpop proof nonce configuration. Verify nonce and audience of proof
a69687e is described below
commit a69687eb0b316dc3bb0e88dfcbb8940891981dfa
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Apr 9 14:57:16 2026 +0300
Proof nonce decoupled from dpop proof nonce configuration. Verify nonce and audience of proof
---
.../openidvci/config/OpenIDVCIConfiguration.java | 25 ++++++-
.../impl/AbstractOpenIDVCIConfiguration.java | 78 ++++++++++++++++++++--
.../impl/FormOutboundNonceResponseMessage.java | 6 +-
.../plugin/openidvci/profile/impl/ParseProof.java | 32 +++++----
.../openid/vci/credentials/credentials-flow.xml | 2 +-
.../idp/service/relying-party/postconfig.xml | 49 ++++++++------
6 files changed, 152 insertions(+), 40 deletions(-)
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java
index e028dd6..745f057 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/OpenIDVCIConfiguration.java
@@ -17,12 +17,14 @@
package org.geant.shibboleth.plugin.openidvci.config;
import java.time.Duration;
+import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.profile.config.ConditionalProfileConfiguration;
import net.shibboleth.shared.annotation.ConfigurationSetting;
@@ -30,7 +32,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
/**
- * Profile configuration shared by all OpenID VCI endpointsß.
+ * Profile configuration shared by all OpenID VCI endpoints.
*/
public interface OpenIDVCIConfiguration extends ConditionalProfileConfiguration {
@@ -123,5 +125,26 @@ public interface OpenIDVCIConfiguration extends ConditionalProfileConfiguration
@ConfigurationSetting(name="proofSignatureValidationConfiguration")
@Nullable SignatureValidationConfiguration getProofSignatureValidationConfiguration(
@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to Proof JWTs being validated by this profile.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ */
+ @ConfigurationSetting(name="proofClaimsValidator")
+ @Nullable ClaimsValidator getProofClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the {@link Function} to create nonces to be used with Proof JWTs.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the nonce generator to use
+ */
+ @ConfigurationSetting(name="proofNonceGenerator")
+ @Nullable Function<ProfileRequestContext, String> getProofNonceGenerator(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
index 7d5d482..9f61f7e 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/config/impl/AbstractOpenIDVCIConfiguration.java
@@ -18,6 +18,7 @@ package org.geant.shibboleth.plugin.openidvci.config.impl;
import java.time.Duration;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -26,11 +27,13 @@ import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.config.impl.stolen.AbstractOIDCSSOConfiguration;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConfiguration
implements OpenIDVCIConfiguration {
@@ -46,11 +49,19 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
/** Lookup function to supply credential lifetime. */
@Nonnull
private Function<ProfileRequestContext, Duration> credentialLifetimeLookupStrategy;
-
+
/** Validation of JWT signature of proofs. */
@Nonnull
private Function<ProfileRequestContext, SignatureValidationConfiguration> proofSignatureValidationConfigurationLookupStrategy;
+ /** Validation of JWT claims for proofs. */
+ @Nonnull
+ private Function<ProfileRequestContext, ClaimsValidator> proofClaimsValidatorLookupStrategy;
+
+ /** Lookup function to retrieve nonce generator for proofs. */
+ @Nonnull
+ private Function<ProfileRequestContext, Function<ProfileRequestContext, String>> proofNonceGeneratorLookupStrategy;
+
/**
* Constructor.
*/
@@ -60,6 +71,8 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
preauthorizedCodeLengthLookupStrategy = FunctionSupport.constant(Integer.valueOf(0));
credentialLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofDays(180));
proofSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(null);
+ proofClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
+ proofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -134,7 +147,7 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
credentialLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
}
-
+
/** {@inheritDoc} */
@Override
@Nullable
@@ -144,8 +157,8 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
}
/**
- * Set the {@link SignatureValidationConfiguration} to validate the Proof
- * JWT signatures.
+ * Set the {@link SignatureValidationConfiguration} to validate the Proof JWT
+ * signatures.
*
* @param configuration configuration to use
*
@@ -168,4 +181,61 @@ public abstract class AbstractOpenIDVCIConfiguration extends AbstractOIDCSSOConf
"Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public ClaimsValidator getProofClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
+ return proofClaimsValidatorLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the {@link ClaimsValidator} to apply to Proof JWT.
+ *
+ * @param validator validator to use
+ *
+ */
+ public void setProofClaimsValidator(@Nullable final ClaimsValidator validator) {
+ proofClaimsValidatorLookupStrategy = FunctionSupport.constant(validator);
+ }
+
+ /**
+ * Set a lookup strategy for the {@link ClaimsValidator} to apply to proof JWT.
+ *
+ * @param strategy lookup strategy
+ *
+ */
+ public void seProofClaimsValidatorLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, ClaimsValidator> strategy) {
+ proofClaimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public Function<ProfileRequestContext, String> getProofNonceGenerator(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return proofNonceGeneratorLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the {@link Function} to create nonces to be used with Proof JWTs.
+ *
+ * @param function generator function to use
+ *
+ */
+ public void setProofNonceGenerator(@Nullable final Function<ProfileRequestContext, String> function) {
+ proofNonceGeneratorLookupStrategy = FunctionSupport.constant(function);
+ }
+
+ /**
+ * Set a lookup strategy for the {@link Function} to create nonces to be used
+ * with DPoP Proof JWTs.
+ *
+ * @param strategy lookup strategy
+ *
+ */
+ public void setProofNonceGeneratorLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, Function<ProfileRequestContext, String>> strategy) {
+ proofNonceGeneratorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java
index 5d17c06..059e33a 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/FormOutboundNonceResponseMessage.java
@@ -20,6 +20,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
+import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.NonceSuccessResponse;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -28,7 +29,6 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
@@ -85,8 +85,8 @@ public class FormOutboundNonceResponseMessage extends AbstractProfileAction {
return false;
}
final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc instanceof OAuth2DPoPProofValidatingProfileConfiguration configuration) {
- generator = configuration.getDpopProofNonceGenerator(profileRequestContext);
+ if (pc instanceof OpenIDVCIConfiguration configuration) {
+ generator = configuration.getProofNonceGenerator(profileRequestContext);
} else {
log.error("{} No OpenID VCI profile configuration associated with this profile request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java
index 048f4ed..4eba047 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ParseProof.java
@@ -16,6 +16,7 @@
package org.geant.shibboleth.plugin.openidvci.profile.impl;
+import java.text.ParseException;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
@@ -24,6 +25,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.geant.shibboleth.plugin.openidvci.config.OpenIDVCIConfiguration;
import org.geant.shibboleth.plugin.openidvci.messaging.context.CredentialsContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCICredentialsRequest;
import org.geant.shibboleth.plugin.openidvci.profile.OpenIDVCIEventIds;
@@ -41,7 +43,7 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration;
+import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
@@ -99,9 +101,8 @@ public class ParseProof extends AbstractProfileAction {
return false;
}
rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx != null
- && rpCtx.getProfileConfig() instanceof OAuth2DPoPProofValidatingProfileConfiguration configuration) {
- validator = configuration.getDpopProofClaimsValidator(profileRequestContext);
+ if (rpCtx != null && rpCtx.getProfileConfig() instanceof OpenIDVCIConfiguration configuration) {
+ validator = configuration.getProofClaimsValidator(profileRequestContext);
}
if (profileRequestContext.getInboundMessageContext() == null || !(profileRequestContext
.getInboundMessageContext().getMessage() instanceof OpenIDVCICredentialsRequest)) {
@@ -156,22 +157,29 @@ public class ParseProof extends AbstractProfileAction {
* https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-jwt-proof-type
*
* @param proof proof to validate
- * @throws Exception thrown if validation fails
+ * @throws ParseException
+ * @throws JWTValidationException
+ * @throws Exception thrown if validation fails
*/
private void validateJWTProof(@Nonnull JWSObject proof, @Nonnull final ProfileRequestContext profileRequestContext)
- throws Exception {
+ throws IllegalArgumentException, JWTValidationException, ParseException {
assert proof != null;
if (JWSAlgorithm.Family.HMAC_SHA.contains(proof.getHeader().getAlgorithm())) {
- throw new Exception("HMAC algorithm used: " + proof.getHeader().getAlgorithm().getName());
+ throw new IllegalArgumentException("HMAC algorithm used: " + proof.getHeader().getAlgorithm().getName());
}
if (!proof.getHeader().getType().equals(new JOSEObjectType("openid4vci-proof+jwt"))) {
- throw new Exception("typ should be openid4vci-proof+jwt: " + proof.getHeader().getType());
+ throw new IllegalArgumentException("typ should be openid4vci-proof+jwt: " + proof.getHeader().getType());
}
- // TBD validate header parameters kid, jwk, x5c, key_attestation and trust_chain
- // Further processing will then verify the signature. TBD add support also for
- // other than jwk case.
+ int fields = (proof.getHeader().getJWK() != null ? 1 : 0)
+ + (proof.getHeader().getX509CertChain() != null ? 1 : 0)
+ + (proof.getHeader().getKeyID() != null ? 1 : 0);
+
+ if (fields != 1) {
+ throw new IllegalArgumentException("Exactly one of jwk, x5c, or kid must be present");
+ }
+ // Validate nonce, audience and iat.
+ // TODO: iat is not verified per spec.
if (validator != null) {
- // TBD validate body parameters iss, aud, iat and nonce
validator.validate(JWTClaimsSet.parse(proof.getPayload().toJSONObject()), profileRequestContext);
}
}
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml
index 2198133..384c97e 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml
@@ -20,7 +20,6 @@
<action-state id="PostDecodeMessage">
<evaluate expression="ParseAccessToken" />
<evaluate expression="ValidateRequestedCredential" />
- <evaluate expression="ParseProof" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="DoMetadataLookup">
@@ -29,6 +28,7 @@
</action-state>
<action-state id="ResumeAfterDoDPoPProofValidation">
+ <evaluate expression="ParseProof" />
<evaluate expression="PopulateProofSignatureValidationParameters" />
<evaluate expression="ValidateProofSignature" />
<evaluate expression="PopulateCredentialsSignatureSigningParameters" />
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 19e7443..053013b 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -31,8 +31,9 @@
p:dpopProofClaimsValidator="#{getObject('DefaultDPoPProofClaimsValidator')}"
p:dpopProofSignatureValidationConfiguration="#{getObject('DPoPSignatureValidationConfiguration')}"
p:dpopProofNonceGenerator="#{getObject('DefaultOAuth2DPoPNonceGenerator')}"
- p:proofSignatureValidationConfiguration="#{getObject('ProofSignatureValidationConfiguration')}" />
-
+ p:proofSignatureValidationConfiguration="#{getObject('openidvci.ProofSignatureValidationConfiguration')}"
+ p:proofNonceGenerator="#{getObject('openidvci.DefaultOpenIDVCINonceGenerator')}"
+ p:proofClaimsValidator="#{getObject('openidvci.DefaultProofBodyClaimsValidator')}" />
<bean id="OpenID.VCI.CredentialOffer" parent="AbstractVCIProfile" lazy-init="true"
class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCICredentialOfferConfiguration" />
@@ -41,17 +42,13 @@
class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCITokenConfiguration" />
<bean id="OpenID.VCI.Nonce" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCINonceConfiguration"
- p:dpopProofNonceGenerator="#{getObject('DefaultOpenIDVCINonceGenerator')}" />
+ class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCINonceConfiguration" />
<bean id="OpenID.VCI.Credentials" parent="AbstractVCIProfile" lazy-init="true"
- class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCICredentialsConfiguration"
- p:dpopProofClaimsValidator="#{getObject('DefaultProofBodyClaimsValidator')}" />
-
+ class="org.geant.shibboleth.plugin.openidvci.config.impl.DefaultOpenIDVCICredentialsConfiguration" />
- <!-- We use special DPoP Nonce generator for Nonce endpoint. -->
<!-- The generator does not tie client id to nonce to accomodate unprotected Nonce endpoint. -->
- <bean id="DefaultOpenIDVCINonceGenerator" parent="DefaultOAuth2DPoPNonceGenerator" lazy-init="true"
+ <bean id="openidvci.DefaultOpenIDVCINonceGenerator" parent="DefaultOAuth2DPoPNonceGenerator" lazy-init="true"
p:relyingPartyIdLookupStrategy-ref="openidvci.RelyingPartyForNonce">
</bean>
@@ -61,25 +58,39 @@
<bean class="java.lang.String" c:_0="mockRelyingParty" />
</constructor-arg>
</bean>
-
- <bean id="DefaultProofBodyClaimsValidator"
+
+ <bean id="openidvci.DefaultProofBodyClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
- p:claimValidators-ref="ProofBodyClaimsValidator" />
-
- <util:list id="ProofBodyClaimsValidator" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean id="DPoPProofNonceFixedRPClaimsValidator"
+ p:claimValidators-ref="openidvci.ProofBodyClaimsValidator" />
+
+ <bean id="openidvci.ProofNonceGeneratorLookupFunction"
+ class="org.geant.shibboleth.plugin.openidvci.config.navigate.ProofNonceGeneratorLookupFunction" />
+
+ <util:list id="openidvci.ProofBodyClaimsValidator" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
+ <bean id="openidvci.ProofNonceValidator"
class="net.shibboleth.idp.plugin.oidc.op.security.jwt.claims.impl.DPoPProofNonceClaimsValidator"
p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper"
c:sealer-ref="DefaultDPoPNonceSealer"
+ p:dpopProofNonceGeneratorLookupStrategy-ref="openidvci.ProofNonceGeneratorLookupFunction"
p:relyingPartyIdLookupStrategy-ref="openidvci.RelyingPartyForNonce">
</bean>
+ <ref bean="openidvci.ProofAudienceClaimsValidator" />
</util:list>
-
- <bean id="ProofSignatureValidationConfiguration"
+
+ <bean id="openidvci.ProofAudienceClaimsValidator"
+ class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator">
+ <property name="audienceLookupStrategy">
+ <bean parent="shibboleth.BiFunctions.Expression"
+ c:expression="#custom.apply(#input1)"
+ p:customObject-ref="shibboleth.ResponderIdLookup.Simple" />
+ </property>
+ </bean>
+
+ <bean id="openidvci.ProofSignatureValidationConfiguration"
parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="TokenAsymmetricKeyTrustEngineForProofJWT"/>
+ p:signatureTrustEngine-ref="openidvci.TokenKeyTrustEngineForProofJWT"/>
- <bean id="TokenAsymmetricKeyTrustEngineForProofJWT"
+ <bean id="openidvci.TokenKeyTrustEngineForProofJWT"
class="org.geant.shibboleth.plugin.openidvci.security.TokenKeyTrustEngine">
<constructor-arg>
<bean class="org.geant.shibboleth.plugin.openidvci.security.credential.impl.ExtendedJOSEObjectCredentialResolver"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list