[java-idp-plugin-vci] 03/04: Clearer description of published metdata that needs to match OP

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/35ee1d010745491da3ea19821eb7b4a69d3568df

commit 35ee1d010745491da3ea19821eb7b4a69d3568df
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Nov 5 16:29:04 2026 +0200

    Clearer description of published metdata that needs to match OP
---
 README.md | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index dcb336d..b7c832a 100644
--- a/README.md
+++ b/README.md
@@ -5052,11 +5052,16 @@ conditions apply:
 - `implicit` is listed.
 - An endpoint or `jwks_uri` is not an HTTPS URL with a host.
 
-`token_endpoint` is the token endpoint of this plugin. The OP's
-`/.well-known/openid-configuration` has the OP's own token endpoint.
-`dpop_signing_alg_values_supported` should match `idp.oauth2.dpop.proofAlgorithms` in
-*conf/oidc.properties*. The OP controls `require_pushed_authorization_requests` and
-`code_challenge_methods_supported`; these are set on **OIDC.SSO**.
+The plugin publishes *static/oauth-authorization-server.json* as you have written it. Some of its values
+have to match how you have configured the OP. Keep them the same, or wallets do what the metadata says
+and the IdP rejects it:
+
+| In the template | Must match |
+|---|---|
+| `token_endpoint` | the token endpoint of this plugin, `$baseUrl/idp/profile/openid/vci/token`. Not the OP's token endpoint from `/.well-known/openid-configuration`, it cannot issue credentials. |
+| `dpop_signing_alg_values_supported` | `idp.oauth2.dpop.proofAlgorithms` in *conf/oidc.properties* |
+| `require_pushed_authorization_requests` | `requirePushedAuthorizationRequest` on **OIDC.SSO** |
+| `code_challenge_methods_supported` | `forcePKCE` and `allowPKCEPlain` on **OIDC.SSO** |
 
 <details>
 <summary>Contents of static/openid-credential-issuer.json, example</summary>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.