[java-idp-plugin-vci] branch dev/VCDM updated: Set did:jwk proof correctly

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/VCDM
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/ba654d58c7826f909aa2fb875c3706460193f90b

The following commit(s) were added to refs/heads/dev/VCDM by this push:
     new ba654d5  Set did:jwk proof correctly
ba654d5 is described below

commit ba654d58c7826f909aa2fb875c3706460193f90b
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Wed May 13 18:04:45 2026 +0300

    Set did:jwk proof correctly
---
 .../openidvci/profile/impl/AddCredentialShell.java | 62 ++++++++--------------
 1 file changed, 22 insertions(+), 40 deletions(-)

diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java
index c7e54ba..6351c82 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AddCredentialShell.java
@@ -162,13 +162,6 @@ public class AddCredentialShell extends AbstractProfileAction {
             return false;
         }
 
-        issuerId = issuerLookupStrategy.apply(profileRequestContext);
-        if (issuerId == null) {
-            log.error("{} Unable to determine issuer to check audience", getLogPrefix());
-            ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
-            return false;
-        }
-
         ctx = profileRequestContext.getInboundMessageContext().getSubcontext(CredentialsContext.class);
         if (ctx == null) {
             log.debug("{} No credentials context associated with this profile request", getLogPrefix());
@@ -176,6 +169,18 @@ public class AddCredentialShell extends AbstractProfileAction {
             return false;
         }
 
+        // TODO: Move issuer from CredentialDefinition if used here!
+        issuerId = ctx.getCredentialConfiguration().getCredentialDefinition() != null
+                ? ctx.getCredentialConfiguration().getCredentialDefinition().getIssuer()
+                : null;
+        issuerId = issuerId == null ? issuerLookupStrategy.apply(profileRequestContext) : issuerId;
+
+        if (issuerId == null) {
+            log.error("{} Unable to determine issuer to check audience", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+            return false;
+        }
+
         return true;
     }
 
@@ -206,65 +211,42 @@ public class AddCredentialShell extends AbstractProfileAction {
     }
 
     /**
-     * Build cnf claim for response. Content is derived either from proof jwk header or kid value.
+     * Build cnf claim for response. Content is derived either from proof jwk header
+     * or kid value.
+     * 
      * @param proof previously verified proof
      * @return cnf claim
      * @throws JsonProcessingException if something unexpected occurs.
-     * @throws ParseException if something unexpected occurs.
+     * @throws ParseException          if something unexpected occurs.
      */
     private Map<String, Object> buildCnf(SignedJWT proof) throws JsonProcessingException, ParseException {
 
-        Map<String, Object> cnf = new HashMap<>();
-        Map<String, Object> jwkMap = null;
         if (proof.getHeader().getJWK() != null) {
-            jwkMap = proof.getHeader().getJWK().toJSONObject();
-        } else if (proof.getHeader().getKeyID() != null) {
-            jwkMap = parseDidJwk(proof.getHeader().getKeyID());
+            return Map.of("jwk", proof.getHeader().getJWK().toJSONObject());
         }
-        if (jwkMap != null) {
-            cnf.put("jwk", jwkMap);
-            return cnf;
+        if (proof.getHeader().getKeyID() != null && proof.getHeader().getKeyID().startsWith("did:jwk:")
+                && proof.getHeader().getKeyID().endsWith("#0")) {
+            return Map.of("kid", proof.getHeader().getKeyID());
         }
         return null;
     }
 
-    /**
-     * Parses did:jwk from keyId and created jwk map from it.
-     * @param kid containing did:jwk
-     * @return jwk map or null.
-     * @throws ParseException if something unexpected occurs.
-     */
-    private Map<String, Object> parseDidJwk(String kid) throws ParseException {
-
-        if (!kid.startsWith("did:jwk:") || !kid.endsWith("#0")) {
-            return null;
-        }
-        String encoded = kid.substring("did:jwk:".length(), kid.indexOf('#'));
-        String json = new String(Base64.getUrlDecoder().decode(encoded), StandardCharsets.UTF_8);
-        JWK jwk = JWK.parse(json);
-        Map<String, Object> jwkMap = jwk.toJSONObject();
-        jwkMap.put("kid", kid);
-        return jwkMap;
-    }
-
     /**
      * Create the shell for credential.
+     * 
      * @return credential shell.
      */
     private ClaimsSet createShell() {
         ClaimsSet shell = new ClaimsSet();
+        shell.setIssuer(new Issuer(issuerId));
 
         ZonedDateTime now = ZonedDateTime.now();
         if ("dc+sd-jwt".equals(ctx.getCredentialConfiguration().getFormat())) {
-            shell.setIssuer(new Issuer(issuerId));
             shell.setClaim("iat", now.toEpochSecond());
             shell.setClaim("exp", now.toEpochSecond() + expiration.toSeconds());
             shell.setClaim("vct", ctx.getCredentialIdentifier());
         }
         if ("vc+sd-jwt".equals(ctx.getCredentialConfiguration().getFormat())) {
-            String issuer = ctx.getCredentialConfiguration().getCredentialDefinition().getIssuer();
-            issuer = issuer == null ? issuerId : issuer;
-            shell.setIssuer(new Issuer(issuer));
             shell.setClaim("validFrom", DateTimeFormatter.ISO_INSTANT.format(now));
             shell.setClaim("validUntil",
                     DateTimeFormatter.ISO_INSTANT.format(now.plusSeconds(expiration.getSeconds())));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.