[java-idp-plugin-vci] branch main updated: Warning about HAIP conf breaking earlier setup

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/0f93e3eb206695e0e46c198897bc1fc51316db07

The following commit(s) were added to refs/heads/main by this push:
     new 0f93e3e  Warning about HAIP conf breaking earlier setup
0f93e3e is described below

commit 0f93e3eb206695e0e46c198897bc1fc51316db07
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Oct 8 09:03:37 2026 +0300

    Warning about HAIP conf breaking earlier setup
---
 README.md | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index efb6a84..42169a2 100644
--- a/README.md
+++ b/README.md
@@ -258,8 +258,10 @@ of the OIDC OP wiki page. A normal installation of the OP plugin has one,
 The wallet of steps 1 and 2 is [Paradym](https://paradym.id). Paradym accepts only did and x5c
 issuers, so the url credential of steps 3 and 4 goes to the TOPPAN wallet. The HAIP credentials of
 Step 5 go to the Hopae EUDI Wallet, and they are also tested with the OpenID conformance suite.
-At the end the installation
-releases did:jwk, did:web, plain url, OpenID Federation and HAIP credentials.
+
+Steps 1 to 4 make a DIIP setup, Step 5 makes a HAIP setup. For now run one or the other. Step 5
+changes what every wallet sees, and some wallets of the earlier steps stop working, see
+[Step 5](#step-5-add-haip-credentials).
 
 `https://issuer.example.org` is your IdP's OIDC issuer everywhere below.
 
@@ -2734,6 +2736,12 @@ Last two credentials are for a HAIP wallet. HAIP takes a credential as SD-JWT VC
 see [HAIP 1.0](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-final.html#vc-profiles).
 This step adds one of each.
 
+Use this step for a HAIP setup, not on top of a DIIP setup with wallets in use. It changes things
+every wallet sees, whatever credential it asks for. The signing key gets a certificate chain, so
+the url credential of steps 3 and 4 carries `x5c` under a CA the wallets of those steps do not
+trust. The authorization server metadata lists `attest_jwt_client_auth` for every client, and
+some wallets switch to it, see the note after *static/oauth-authorization-server.json* below.
+
 The wallet of this step is [HopaeEUDIWallet](https://apps.apple.com/app/id6759562486) on iPhone,
 Hopae's build of the [EUDI Reference Wallet](https://github.com/eu-digital-identity-wallet), source
 in [hopae-eudi-ref-wallet](https://github.com/hopae-official/hopae-eudi-ref-wallet). The wallet
@@ -3720,6 +3728,12 @@ Full file: [static/oauth-authorization-server.json](docs/example/step-5/static/o
 
 </details>
 
+This breaks wallets of the earlier steps that change their behaviour on this. The metadata is the
+same for every client and every credential, and some wallets start to authenticate with a Wallet
+Attestation as soon as `attest_jwt_client_auth` is listed, also for the url credential. Such a
+wallet works only if it is registered with `attest_jwt_client_auth` and the CA of its wallet
+provider is in **openidvci.ClientAttestationTrustAnchors**.
+
 ### Step 6: Rolling the signing key
 
 Step 5 changed the signing key. What a key change means depends on the issuer
@@ -3759,8 +3773,12 @@ them in that list too.
 | `GeantIncubatorDiploma_SDJWT`, `_W3C` | `did:jwk:…` | the identifier | no | Paradym |
 | `GeantIncubatorDiploma_DIDWEB` | `did:web:issuer.example.org` | `/.well-known/did.json` | no | Paradym |
 | `GeantIncubatorDiploma_URL` | `https://issuer.example.org` | `x5c`, earlier `/.well-known/jwt-vc-issuer` | yes | TOPPAN |
-| `GeantIncubatorDiploma_HAIP` | `https://issuer.example.org` | `x5c` | no | HAIP wallet |
-| `GeantIncubatorDiploma_MDOC` | none | `x5chain` | no | HAIP wallet |
+| `GeantIncubatorDiploma_HAIP` | `https://issuer.example.org` | `x5c` | no | Hopae EUDI Wallet |
+| `GeantIncubatorDiploma_MDOC` | none | `x5chain` | no | Hopae EUDI Wallet |
+
+The table lists every credential of the story. Run them as a DIIP setup, the first three rows
+with the files of [docs/example/step-4](docs/example/step-4), or as a HAIP setup with the files of
+step 5.
 
 The files at the end of the story are in [docs/example/step-5](docs/example/step-5).
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.