[java-idp-plugin-vci] branch main updated: Relying party conf to allow oauth2 authz requests
Codeberg
noreply at shibboleth.net
Tue Oct 6 13:45:46 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/59a966d70d76b7cd313ff0e664eb73f1236dfabd
The following commit(s) were added to refs/heads/main by this push:
new 59a966d Relying party conf to allow oauth2 authz requests
59a966d is described below
commit 59a966d70d76b7cd313ff0e664eb73f1236dfabd
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Tue Oct 6 16:45:33 2026 +0300
Relying party conf to allow oauth2 authz requests
---
README.md | 23 +++++++++++++++++++++++
docs/example/step-1/conf/relying-party.xml | 2 ++
2 files changed, 25 insertions(+)
diff --git a/README.md b/README.md
index 3af5321..26d9204 100644
--- a/README.md
+++ b/README.md
@@ -1017,6 +1017,7 @@ authorization request:
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO"
++ p:requireAuthenticationRequest="false"
+ p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+ p:forcePKCE="true"
+ p:requirePushedAuthorizationRequest="true" />
@@ -1025,6 +1026,7 @@ authorization request:
+ p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
+ <bean parent="OpenID.VCI.Credentials" />
+ <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
++ p:requireAuthenticationRequest="false"
+ p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
+ </list>
+ </property>
@@ -1039,6 +1041,11 @@ Full file: [conf/relying-party.xml](docs/example/step-1/conf/relying-party.xml)
</details>
+Wallets usually leave `openid` out of `scope`, so their authorization request is a plain OAuth 2.0
+request. `requireAuthenticationRequest="false"` on `OIDC.SSO` and `OAUTH2.PAR` lets the wallet
+send one. Without it the PAR fails and the log says *The request did not match with the
+configured authorization request type requirements*.
+
The *value* of the attribute is the claims as an array of `{"path": [...], "value": ...}`, the
same array the Credential Offer API takes. You define it as a `ScriptedAttribute` so that it may
read the real attributes of the user:
@@ -1509,6 +1516,7 @@ and state it per credential.
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -1517,6 +1525,7 @@ and state it per credential.
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
@@ -2028,6 +2037,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-3/metadata/v
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -2036,6 +2046,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-3/metadata/v
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
@@ -2046,6 +2057,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-3/metadata/v
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO"
++ p:requireAuthenticationRequest="false"
+ p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+ p:forcePKCE="true"
+ p:requirePushedAuthorizationRequest="true" />
@@ -2054,6 +2066,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-3/metadata/v
+ p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
+ <bean parent="OpenID.VCI.Credentials" />
+ <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
++ p:requireAuthenticationRequest="false"
+ p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
+ </list>
+ </property>
@@ -2559,6 +2572,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-4/metadata/v
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -2567,6 +2581,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-4/metadata/v
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
@@ -2577,6 +2592,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-4/metadata/v
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -2585,6 +2601,7 @@ Full file: [metadata/verifiable-credentials.json](docs/example/step-4/metadata/v
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
@@ -3521,6 +3538,7 @@ and both token and PAR endpoints take the Wallet Attestation:
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -3529,6 +3547,7 @@ and both token and PAR endpoints take the Wallet Attestation:
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
@@ -3539,6 +3558,7 @@ and both token and PAR endpoints take the Wallet Attestation:
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -3547,6 +3567,7 @@ and both token and PAR endpoints take the Wallet Attestation:
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
@@ -3557,6 +3578,7 @@ and both token and PAR endpoints take the Wallet Attestation:
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO"
++ p:requireAuthenticationRequest="false"
+ p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+ p:forcePKCE="true" p:requirePushedAuthorizationRequest="true"
+ p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
@@ -3566,6 +3588,7 @@ and both token and PAR endpoints take the Wallet Attestation:
+ p:requireDpopProof="true" />
+ <bean parent="OpenID.VCI.Credentials" />
+ <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
++ p:requireAuthenticationRequest="false"
+ p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
+ </list>
+ </property>
diff --git a/docs/example/step-1/conf/relying-party.xml b/docs/example/step-1/conf/relying-party.xml
index 017cf48..7b46c1d 100644
--- a/docs/example/step-1/conf/relying-party.xml
+++ b/docs/example/step-1/conf/relying-party.xml
@@ -70,6 +70,7 @@
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
+ p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
p:forcePKCE="true"
p:requirePushedAuthorizationRequest="true" />
@@ -78,6 +79,7 @@
p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
<bean parent="OpenID.VCI.Credentials" />
<bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+ p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list