[java-idp-plugin-vci] 02/02: Instruct to require DPoP for HAIP cases

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/a10eaeb12ee1f58a0edd4d5b51aa5f0721f4a693

commit a10eaeb12ee1f58a0edd4d5b51aa5f0721f4a693
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Fri Oct 2 14:09:28 2026 +0300

    Instruct to require DPoP for HAIP cases
---
 README.md                                  | 7 +++++--
 docs/example/step-5/conf/relying-party.xml | 3 ++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index beb202d..735daa8 100644
--- a/README.md
+++ b/README.md
@@ -3400,7 +3400,8 @@ and both token and PAR endpoints take the Wallet Attestation:
 +                        p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
 +                  <bean parent="OpenID.VCI.Token"
 +                        p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
-+                        p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}" />
++                        p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
++                        p:requireDpopProof="true" />
 +                  <bean parent="OpenID.VCI.Credentials" />
 +                  <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
 +                        p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
@@ -3417,7 +3418,8 @@ Full file: [conf/relying-party.xml](docs/example/step-5/conf/relying-party.xml)
 
 </details>
 
-DPoP settings are left to their defaults, so a DPoP nonce is required.
+`requireDpopProof` makes DPoP mandatory at the token endpoint, as HAIP requires sender-constrained
+access tokens. The other DPoP settings are left to their defaults, so a DPoP nonce is required.
 
 `openidvci.PushedAuthorizationDPoPJktManipulationStrategy` on **OAUTH2.PAR** is recommended with
 DPoP, see [RFC 9449 10.1](https://www.rfc-editor.org/rfc/rfc9449#section-10.1).
@@ -3785,6 +3787,7 @@ Endpoint `/idp/profile/openid/vci/token`, profile ID `http://geant.org/ns/profil
 | `accessTokenClaimsSetManipulationStrategy` | Function | | Of the OP plugin. Must be **openidvci.TokenManipulationStrategy**. |
 | `tokenEndpointAuthMethods` | Collection<String> | | Of the OP plugin. `none` for public wallets, `attest_jwt_client_auth` for Wallet Attestation. |
 | `dpopProofNonceGenerator` | Function | | Of the OP plugin. `#{null}` for no DPoP nonce. |
+| `requireDpopProof` | Boolean | `false` | Of the OP plugin. Refuses a token request without a DPoP proof. |
 | `inboundInterceptorFlows` | List<String> | | Interceptor flows run after the request is decoded, before authentication. |
 | `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
 | `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the inbound message before authentication and on the outbound one before encoding. |
diff --git a/docs/example/step-5/conf/relying-party.xml b/docs/example/step-5/conf/relying-party.xml
index 9391e3f..59ab352 100644
--- a/docs/example/step-5/conf/relying-party.xml
+++ b/docs/example/step-5/conf/relying-party.xml
@@ -99,7 +99,8 @@
                         p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
                   <bean parent="OpenID.VCI.Token"
                         p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
-                        p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}" />
+                        p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
+                        p:requireDpopProof="true" />
                   <bean parent="OpenID.VCI.Credentials" />
                   <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
                         p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.