[java-idp-plugin-vci] branch main updated: Separate HAIP for DIIP examples, explain why
Codeberg
noreply at shibboleth.net
Fri Oct 9 07:11:23 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/27628923140d152754c75cef68ccd247fa4b9e1e
The following commit(s) were added to refs/heads/main by this push:
new 2762892 Separate HAIP for DIIP examples, explain why
2762892 is described below
commit 27628923140d152754c75cef68ccd247fa4b9e1e
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Fri Oct 9 10:11:04 2026 +0300
Separate HAIP for DIIP examples, explain why
---
README.md | 758 +++++++--------------
docs/example/step-5/conf/attribute-filter.xml | 16 -
docs/example/step-5/conf/global.xml | 1 -
.../example/step-5/conf/openid-vci-credentials.xml | 10 +-
docs/example/step-5/conf/relying-party.xml | 57 --
docs/example/step-5/etc/jetty-rewrite-rules.xml | 27 -
docs/example/step-5/metadata/oidc-client.json | 35 -
.../step-5/metadata/verifiable-credentials.json | 130 ----
.../step-5/static/oauth-authorization-server.json | 8 +-
.../credentials/GeantIncubatorDiploma_W3C.json | 10 -
10 files changed, 242 insertions(+), 810 deletions(-)
diff --git a/README.md b/README.md
index 6a260ca..1634c7d 100644
--- a/README.md
+++ b/README.md
@@ -26,9 +26,9 @@
- [Step 2: Add a did:web credential](#step-2-add-a-did-web-credential)
- [Step 3: Add a plain url credential](#step-3-add-a-plain-url-credential)
- [Step 4: Make the url credential an OpenID Federation credential](#step-4-make-the-url-credential-an-openid-federation-credential)
- - [Step 5: Add HAIP credentials](#step-5-add-haip-credentials)
- - [Step 6: Rolling the signing key](#step-6-rolling-the-signing-key)
- [What we have now](#what-we-have-now)
+ - [Step 5: A HAIP setup](#step-5-a-haip-setup)
+ - [Step 6: Rolling the signing key](#step-6-rolling-the-signing-key)
- [Requesting a credential by configuration or by identifier](#requesting-a-credential-by-configuration-or-by-identifier)
- [Several credentials of one configuration](#several-credentials-of-one-configuration)
- [Pre-authorized code flow](#pre-authorized-code-flow-1)
@@ -238,9 +238,10 @@ Configurations. There is no template for it. See [Credential Configurations](#cr
## First installation, by example
-This chapter builds one deployment in steps. Every step adds something to the previous one and
-tells only what is new. The examples are from a running test deployment so they fit together,
-but it is not guaranteed that they work for you as such.
+This chapter builds a DIIP deployment in Steps 1 to 4 and a HAIP deployment in Step 5. Steps 2
+to 4 each add something to the previous one and tell only what is new. Step 5 is not built on
+Steps 2 to 4, it starts again from Step 1. The examples are from a running test deployment so they
+fit together, but it is not guaranteed that they work for you as such.
Before you start, the OP needs an EC signing key, see
[Key Generation](https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP#Key-Generation)
@@ -251,18 +252,15 @@ of the OIDC OP wiki page. A normal installation of the OP plugin has one,
2. A second credential, did:web.
3. A third credential, the issuer is the plain url.
4. The third credential is made an OpenID Federation credential.
-5. A fourth and a fifth credential, for a HAIP wallet, as SD-JWT VC and as mdoc. Signing key gets
- a certificate chain.
-6. Rolling the signing key to the next one.
+ [What we have now](#what-we-have-now) sums up the DIIP setup.
+5. A HAIP setup on its own, two credentials as SD-JWT VC and as mdoc. The signing key has a
+ certificate chain.
+6. Rolling the signing key to the next one, in either setup.
The wallet of steps 1 and 2 is [Paradym](https://paradym.id). Paradym accepts only did and x5c
issuers, so the url credential of steps 3 and 4 goes to the TOPPAN wallet. The HAIP credentials of
Step 5 go to the Hopae EUDI Wallet, and they are also tested with the OpenID conformance suite.
-Steps 1 to 4 make a DIIP setup, Step 5 makes a HAIP setup. For now run one or the other. Step 5
-changes what every wallet sees, and some wallets of the earlier steps stop working, see
-[Step 5](#step-5-add-haip-credentials).
-
`https://issuer.example.org` is your IdP's OIDC issuer everywhere below.
### Step 1: did:jwk credential, both flows
@@ -2301,7 +2299,7 @@ Full file: [static/oauth-authorization-server.json](docs/example/step-3/static/o
*static/jwt-vc-issuer.json* as it comes with the plugin is fine. Its `jwks_uri` is the keyset of
the OP, served by `OIDC.Keyset` that is already in the anonymous relying party. The keyset has
-the keys of the OP, which sign the credentials until Step 5.
+the keys of the OP, which sign the credentials.
Attribute encoder and offer as in Step 2, with `GeantIncubatorDiploma_URL`.
@@ -2730,17 +2728,45 @@ A `vc+sd-jwt` credential carries the same as `termsOfUse`:
metadata. Set `openidvci.oidfed.decorateFederationEntity = false` to state them in the
metadata file of the federation module instead.
-### Step 5: Add HAIP credentials
+### What we have now
+
+Steps 1 to 4 make a DIIP setup:
+
+| Credential | Issuer | Key found from | Federation | Wallet |
+|---|---|---|---|---|
+| `GeantIncubatorDiploma_SDJWT`, `_W3C` | `did:jwk:…` | the identifier | no | Paradym |
+| `GeantIncubatorDiploma_DIDWEB` | `did:web:issuer.example.org` | `/.well-known/did.json` | no | Paradym |
+| `GeantIncubatorDiploma_URL` | `https://issuer.example.org` | `/.well-known/jwt-vc-issuer`, the Entity Configuration | yes | TOPPAN |
+
+All of them are signed with the EC key of the OP. The files are in
+[docs/example/step-4](docs/example/step-4).
+
+### Step 5: A HAIP setup
-Last two credentials are for a HAIP wallet. HAIP takes a credential as SD-JWT VC or as ISO mdoc,
-see [HAIP 1.0](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-final.html#vc-profiles).
-This step adds one of each.
+This step is a HAIP setup with two credentials for a HAIP wallet. HAIP takes a credential as
+SD-JWT VC or as ISO mdoc, see
+[HAIP 1.0](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0-final.html#vc-profiles).
+This step has one of each.
-Use this step for a HAIP setup, not on top of a DIIP setup with wallets in use. It changes things
-every wallet sees, whatever credential it asks for. The signing key gets a certificate chain, so
-the url credential of steps 3 and 4 is signed with the new key and carries `x5c`. The
-authorization server metadata lists `attest_jwt_client_auth` for every client, and
-some wallets switch to it, see the note after *static/oauth-authorization-server.json* below.
+It is not built on Steps 2 to 4. Start from Step 1 and keep its general parts: the
+installation, [Metadata endpoints](#metadata-endpoints),
+[Wallet authentication](#wallet-authentication) with the client `offer-caller`, the attribute
+definition and the [Status List](#status-list). Leave out its credentials, the Paradym client
+and the wallet client of the pre-authorized code flow, `offer-caller/wallet`. That client
+authenticates with `none`, and here the wallets authenticate with a Wallet Attestation. The
+diffs below are against the files of Step 1.
+
+In theory one IdP can run the DIIP setup of Steps 1 to 4 and this one at the same time. In
+practice it gets complicated, because the metadata is the same for every client and every
+credential, and wallets act on what is published, not on what is registered for them:
+
+- The authorization server metadata lists `attest_jwt_client_auth`. Some wallets switch to it as
+ soon as it is listed, also for the DIIP credentials. Such a wallet works only if it is
+ registered with `attest_jwt_client_auth` and the CA of its wallet provider is trusted.
+- The signing key with a certificate goes first in the list. A url credential is then signed with
+ it and carries `x5c` instead of `kid`, and its verifiers have to move to the chain.
+
+So run one setup or the other.
The wallet of this step is [HopaeEUDIWallet](https://apps.apple.com/app/id6759562486) on iPhone,
Hopae's build of the [EUDI Reference Wallet](https://github.com/eu-digital-identity-wallet), source
@@ -2749,7 +2775,7 @@ needs no configuration for your issuer, it takes the Credential Offer QR code as
What you configure:
-- a signing key with a certificate, used first
+- a signing key with a certificate
- a Status List signing key with a certificate of its own
- a url credential
- an mdoc credential
@@ -2770,78 +2796,69 @@ Below the Document Signer is *credentials/vci-signing.key* and *credentials/vci-
Status List signer *credentials/vci-status-list.key* and *credentials/vci-status-list.crt*. The
IACA root is not configured, the verifier has it as its trust anchor.
-In *conf/openid-vci-credentials.xml* the signing key is put **first** in the list. The did:web
-credential of Step 2 is still issued, so the new keys need a name, `p:keyNames`, for the did:web
-document:
+Step 1 signs with the key of the OP and has no *conf/openid-vci-credentials.xml*. Here the file
+gives the keys: the signing key signs the credentials and the Credential Issuer metadata, the
+Status List signer signs the Status List Tokens:
<details>
<summary>conf/openid-vci-credentials.xml</summary>
-```diff
- <?xml version="1.0" encoding="UTF-8"?>
- <beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <bean id="openidvci.OPESSigningCredential" parent="shibboleth.JWKCredential"
- p:resource="%{idp.signing.oidc.es.key}" />
-
-+ <bean id="openidvci.X509ESSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
-+ p:privateKey="%{idp.home}/credentials/vci-signing.key" p:keyNames="signingvci-x509">
-+ <property name="certificates">
-+ <list>
-+ <value>%{idp.home}/credentials/vci-signing.crt</value>
-+ </list>
-+ </property>
-+ </bean>
-+
-+ <bean id="openidvci.X509StatusListSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
-+ p:privateKey="%{idp.home}/credentials/vci-status-list.key" p:keyNames="statuslist-x509">
-+ <property name="certificates">
-+ <list>
-+ <value>%{idp.home}/credentials/vci-status-list.crt</value>
-+ </list>
-+ </property>
-+ </bean>
-+
- <util:list id="openidvci.SigningCredentials">
-+ <ref bean="openidvci.X509ESSigningCredential" />
- <ref bean="openidvci.OPESSigningCredential" />
- </util:list>
-
-+ <util:list id="openidvci.status-list.SigningCredentials">
-+ <ref bean="openidvci.X509StatusListSigningCredential" />
-+ <ref bean="openidvci.X509ESSigningCredential" />
-+ <ref bean="openidvci.OPESSigningCredential" />
-+ </util:list>
-+
-+ <util:list id="openidvci.issuerMetadata.SigningCredentials">
-+ <ref bean="openidvci.X509ESSigningCredential" />
-+ </util:list>
-+
- </beans>
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean id="openidvci.X509ESSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
+ p:privateKey="%{idp.home}/credentials/vci-signing.key">
+ <property name="certificates">
+ <list>
+ <value>%{idp.home}/credentials/vci-signing.crt</value>
+ </list>
+ </property>
+ </bean>
+
+ <bean id="openidvci.X509StatusListSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
+ p:privateKey="%{idp.home}/credentials/vci-status-list.key">
+ <property name="certificates">
+ <list>
+ <value>%{idp.home}/credentials/vci-status-list.crt</value>
+ </list>
+ </property>
+ </bean>
+
+ <util:list id="openidvci.SigningCredentials">
+ <ref bean="openidvci.X509ESSigningCredential" />
+ </util:list>
+
+ <util:list id="openidvci.status-list.SigningCredentials">
+ <ref bean="openidvci.X509StatusListSigningCredential" />
+ </util:list>
+
+ <util:list id="openidvci.issuerMetadata.SigningCredentials">
+ <ref bean="openidvci.X509ESSigningCredential" />
+ </util:list>
+
+</beans>
```
Full file: [conf/openid-vci-credentials.xml](docs/example/step-5/conf/openid-vci-credentials.xml)
</details>
-The credentials of Steps 1 to 4 were signed with the key of the OP, so it stays in both lists,
-after the new keys, see [Step 6](#step-6-rolling-the-signing-key). In the Status List list it signs
-the Status Lists of the did:jwk credential of Step 1. The new signing key is in the Status List
-list too: from now on it signs the did:jwk credentials, and the Status List of a did:jwk
-credential is signed with the key that signed the credential.
+Import the file into *conf/global.xml*, with the trust anchors of [Attestations](#attestations):
+
+```xml
+<import resource="openid-vci-credentials.xml"/>
+```
-The chain is emitted whenever the issuer of the credential, Status List Token or metadata is an https url, there is no
-switch for it. That means the url credential of Steps 3 and 4 now carries `x5c` too, and no
-`kid`. A verifier of it moves from `/.well-known/jwt-vc-issuer` to the chain. The did:jwk and
-did:web credentials do not carry a chain, their identifier resolves the key. This is a key
-rollover, see [Step 6](#step-6-rolling-the-signing-key).
+The chain is emitted whenever the issuer of the credential, Status List Token or metadata is an
+https url, there is no switch for it.
#### The SD-JWT VC credential
@@ -2854,144 +2871,19 @@ attestation required:
```diff
{
"credential_configurations_supported": {
- "GeantIncubatorDiploma_SDJWT": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_SDJWT",
- "scope": "GeantIncubatorDiploma_SDJWT",
- "_issuance_configuration": {
- "oidfed": false
- },
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "credential_metadata": {
- "display": [
- {
- "name": "Incubator Diploma",
- "locale": "en",
- "description": "Diploma issued by the Trust and Identity Incubator"
- }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_W3C": {
- "format": "vc+sd-jwt",
- "scope": "GeantIncubatorDiploma_W3C",
- "_issuance_configuration": {
- "oidfed": false
- },
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "credential_definition": {
- "@context": [
- "https://www.w3.org/ns/credentials/v2",
- "https://issuer.example.org/credentials/GeantIncubatorDiploma_W3C"
- ],
- "type": [
- "VerifiableCredential",
- "GeantIncubatorDiploma_W3C"
- ]
- },
- "credential_metadata": {
- "display": [
- {
- "name": "Incubator Diploma, W3C",
- "locale": "en",
- "description": "Diploma issued by the Trust and Identity Incubator"
- }
- ],
- "claims": [
- { "path": ["credentialSubject","diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["credentialSubject","mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["credentialSubject","eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["credentialSubject","givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["credentialSubject","familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["credentialSubject","affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_DIDWEB": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_DIDWEB",
- "scope": "GeantIncubatorDiploma_DIDWEB",
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "_issuance_configuration": {
- "issuer": "did:web",
- "oidfed": false
- },
- "credential_metadata": {
- "display": [
- { "name": "Incubator Diploma, did:web", "locale": "en" }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_URL": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_URL",
- "scope": "GeantIncubatorDiploma_URL",
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "_issuance_configuration": {
- "issuer": "url"
- },
- "credential_metadata": {
- "display": [
- { "name": "Incubator Diploma, url", "locale": "en" }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
-+ },
+- "GeantIncubatorDiploma_SDJWT": {
+ "GeantIncubatorDiploma_HAIP": {
-+ "format": "dc+sd-jwt",
+ "format": "dc+sd-jwt",
+- "vct": "GeantIncubatorDiploma_SDJWT",
+- "scope": "GeantIncubatorDiploma_SDJWT",
+- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
+ "vct": "GeantIncubatorDiploma_HAIP",
+ "scope": "GeantIncubatorDiploma_HAIP",
+ "cryptographic_binding_methods_supported": ["jwk"],
-+ "credential_signing_alg_values_supported": ["ES256"],
-+ "proof_types_supported": {
-+ "jwt": {
+ "credential_signing_alg_values_supported": ["ES256"],
+ "proof_types_supported": {
+ "jwt": {
+- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
+ "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"],
+ "key_attestations_required": {
+ "key_storage": ["iso_18045_high"],
@@ -3004,25 +2896,73 @@ attestation required:
+ "key_storage": ["iso_18045_high"],
+ "user_authentication": ["iso_18045_high"]
+ }
-+ }
+ }
+ },
+ "_issuance_configuration": {
+ "issuer": "url",
+ "oidfed": false
-+ },
-+ "credential_metadata": {
-+ "display": [
+ },
+ "credential_metadata": {
+ "display": [
+- {
+- "name": "Incubator Diploma",
+- "locale": "en",
+- "description": "Diploma issued by the Trust and Identity Incubator"
+- }
+ { "name": "Incubator Diploma, HAIP", "locale": "en" }
-+ ],
-+ "claims": [
+ ],
+ "claims": [
+- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
+- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
+ { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
+ { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
-+ { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
+ { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
+- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
+- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
+- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
+- ]
+- }
+- },
+- "GeantIncubatorDiploma_W3C": {
+- "format": "vc+sd-jwt",
+- "scope": "GeantIncubatorDiploma_W3C",
+- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
+- "credential_signing_alg_values_supported": ["ES256"],
+- "proof_types_supported": {
+- "jwt": {
+- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
+- }
+- },
+- "credential_definition": {
+- "@context": [
+- "https://www.w3.org/ns/credentials/v2",
+- "https://issuer.example.org/credentials/GeantIncubatorDiploma_W3C"
+- ],
+- "type": [
+- "VerifiableCredential",
+- "GeantIncubatorDiploma_W3C"
+- ]
+- },
+- "credential_metadata": {
+- "display": [
+- {
+- "name": "Incubator Diploma, W3C",
+- "locale": "en",
+- "description": "Diploma issued by the Trust and Identity Incubator"
+- }
+- ],
+- "claims": [
+- { "path": ["credentialSubject","diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
+- { "path": ["credentialSubject","mail"], "display": [{ "name": "Email", "locale": "en" }] },
+- { "path": ["credentialSubject","eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
+- { "path": ["credentialSubject","givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
+- { "path": ["credentialSubject","familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
+- { "path": ["credentialSubject","affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
+ { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
+ { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
+ { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
-+ ]
-+ }
+ ]
+ }
}
}
}
@@ -3045,9 +2985,9 @@ type `attestation` the attestation is the proof, and each of its `attested_keys`
Advertise both. The OpenID conformance suite uses `jwt`, the Hopae EUDI Wallet only
`attestation`.
-Add `<AttributeEncoder xsi:type="oidc:OIDCString" name="GeantIncubatorDiploma_HAIP" />` to the
-attribute definition of Step 1 and release the attribute also to the HAIP wallet in
-*conf/attribute-filter.xml*.
+The attribute definition of Step 1 gives the content. Replace its encoders with
+`<AttributeEncoder xsi:type="oidc:OIDCString" name="GeantIncubatorDiploma_HAIP" />`. The attribute
+is released to the HAIP wallet in *conf/attribute-filter.xml*, see the mdoc credential below.
#### The mdoc credential
@@ -3062,136 +3002,6 @@ Issuer identifier is not used.
```diff
{
"credential_configurations_supported": {
- "GeantIncubatorDiploma_SDJWT": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_SDJWT",
- "scope": "GeantIncubatorDiploma_SDJWT",
- "_issuance_configuration": {
- "oidfed": false
- },
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "credential_metadata": {
- "display": [
- {
- "name": "Incubator Diploma",
- "locale": "en",
- "description": "Diploma issued by the Trust and Identity Incubator"
- }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_W3C": {
- "format": "vc+sd-jwt",
- "scope": "GeantIncubatorDiploma_W3C",
- "_issuance_configuration": {
- "oidfed": false
- },
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "credential_definition": {
- "@context": [
- "https://www.w3.org/ns/credentials/v2",
- "https://issuer.example.org/credentials/GeantIncubatorDiploma_W3C"
- ],
- "type": [
- "VerifiableCredential",
- "GeantIncubatorDiploma_W3C"
- ]
- },
- "credential_metadata": {
- "display": [
- {
- "name": "Incubator Diploma, W3C",
- "locale": "en",
- "description": "Diploma issued by the Trust and Identity Incubator"
- }
- ],
- "claims": [
- { "path": ["credentialSubject","diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["credentialSubject","mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["credentialSubject","eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["credentialSubject","givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["credentialSubject","familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["credentialSubject","affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_DIDWEB": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_DIDWEB",
- "scope": "GeantIncubatorDiploma_DIDWEB",
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "_issuance_configuration": {
- "issuer": "did:web",
- "oidfed": false
- },
- "credential_metadata": {
- "display": [
- { "name": "Incubator Diploma, did:web", "locale": "en" }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_URL": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_URL",
- "scope": "GeantIncubatorDiploma_URL",
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "_issuance_configuration": {
- "issuer": "url"
- },
- "credential_metadata": {
- "display": [
- { "name": "Incubator Diploma, url", "locale": "en" }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
"GeantIncubatorDiploma_HAIP": {
"format": "dc+sd-jwt",
"vct": "GeantIncubatorDiploma_HAIP",
@@ -3334,8 +3144,9 @@ The paths differ from the SD-JWT VC credentials, so the content is an attribute
</details>
-Add `GeantIncubatorDiplomaMdoc` to `idp.oidc.encodedAttributes` in *conf/oidc.properties* and
-release it to the HAIP wallet in *conf/attribute-filter.xml*.
+Add `GeantIncubatorDiplomaMdoc` to `idp.oidc.encodedAttributes` in *conf/oidc.properties*. In
+*conf/attribute-filter.xml* both attributes are released to the HAIP wallet, in place of the
+Paradym policy of Step 1.
<details>
<summary>conf/attribute-filter.xml</summary>
@@ -3347,33 +3158,19 @@ release it to the HAIP wallet in *conf/attribute-filter.xml*.
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
- <AttributeFilterPolicy id="GeantIncubatorDiplomaToWallets">
- <PolicyRequirementRule xsi:type="Requester"
- value="id.animo.paradym" />
- <AttributeRule attributeID="GeantIncubatorDiploma">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
- </AttributeFilterPolicy>
-
- <AttributeFilterPolicy id="GeantIncubatorDiplomaToToppan">
+- <AttributeFilterPolicy id="GeantIncubatorDiplomaToWallets">
++ <AttributeFilterPolicy id="GeantIncubatorDiplomaToHAIPWallets">
<PolicyRequirementRule xsi:type="Requester"
- value="wallet-dev" />
+- value="id.animo.paradym" />
++ value="eudiw-abca" />
<AttributeRule attributeID="GeantIncubatorDiploma">
++ <PermitValueRule xsi:type="ANY" />
++ </AttributeRule>
++ <AttributeRule attributeID="GeantIncubatorDiplomaMdoc">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
</AttributeFilterPolicy>
-+ <AttributeFilterPolicy id="GeantIncubatorDiplomaToHAIPWallets">
-+ <PolicyRequirementRule xsi:type="Requester"
-+ value="eudiw-abca" />
-+ <AttributeRule attributeID="GeantIncubatorDiploma">
-+ <PermitValueRule xsi:type="ANY" />
-+ </AttributeRule>
-+ <AttributeRule attributeID="GeantIncubatorDiplomaMdoc">
-+ <PermitValueRule xsi:type="ANY" />
-+ </AttributeRule>
-+ </AttributeFilterPolicy>
-+
</AttributeFilterPolicyGroup>
```
@@ -3484,48 +3281,32 @@ the Hopae EUDI Wallet `eudiw-abca`. In *metadata/oidc-client.json*:
"client_secret": "CHANGE-ME"
},
{
- "client_id": "offer-caller/wallet",
- "client_name": "Wallets redeeming a pre-authorized code minted by offer-caller",
- "token_endpoint_auth_method": "none",
- "grant_types": ["urn:ietf:params:oauth:grant-type:pre-authorized_code"]
- },
- {
- "client_id": "id.animo.paradym",
- "client_name": "Paradym Wallet",
- "redirect_uris": ["https://paradym.id/invitation/redirect"],
- "scope": "openid GeantIncubatorDiploma_SDJWT GeantIncubatorDiploma_W3C GeantIncubatorDiploma_DIDWEB GeantIncubatorDiploma_URL",
- "audience": [
- "credentials",
- "urn:shibboleth.oidc.op.resource:https://issuer.example.org"
- ],
- "token_endpoint_auth_method": "none",
- "response_types": ["code"],
- "grant_types": [
- "authorization_code",
- "urn:ietf:params:oauth:grant-type:pre-authorized_code"
- ]
- },
- {
- "client_id": "wallet-dev",
- "client_name": "TOPPAN Wallet",
- "redirect_uris": ["walletapp-goid-openid4vci-callback://authorization"],
- "scope": "openid GeantIncubatorDiploma_URL",
- "audience": [
- "credentials",
- "urn:shibboleth.oidc.op.resource:https://issuer.example.org"
- ],
- "token_endpoint_auth_method": "none",
- "response_types": ["code"],
- "grant_types": ["authorization_code"]
-+ },
-+ {
+- "client_id": "offer-caller/wallet",
+- "client_name": "Wallets redeeming a pre-authorized code minted by offer-caller",
+- "token_endpoint_auth_method": "none",
+- "grant_types": ["urn:ietf:params:oauth:grant-type:pre-authorized_code"]
+- },
+- {
+- "client_id": "id.animo.paradym",
+- "client_name": "Paradym Wallet",
+- "redirect_uris": ["https://paradym.id/invitation/redirect"],
+- "scope": "openid GeantIncubatorDiploma_SDJWT GeantIncubatorDiploma_W3C",
+- "audience": [
+- "credentials",
+- "urn:shibboleth.oidc.op.resource:https://issuer.example.org"
+- ],
+- "token_endpoint_auth_method": "none",
+ "client_id": "eudiw-abca",
+ "client_name": "Hopae EUDI Wallet",
+ "redirect_uris": ["eu.europa.ec.euidi://authorization"],
+ "scope": "openid GeantIncubatorDiploma_HAIP GeantIncubatorDiploma_MDOC",
+ "audience": "credentials",
+ "token_endpoint_auth_method": "attest_jwt_client_auth",
-+ "response_types": ["code"],
+ "response_types": ["code"],
+- "grant_types": [
+- "authorization_code",
+- "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+- ]
+ "grant_types": ["authorization_code"]
}
]
@@ -3574,12 +3355,6 @@ and both token and PAR endpoints take the Wallet Attestation:
<ref bean="OIDC.Configuration" />
<!-- Of the OP plugin. Needed for the audience values of the wallet -->
<ref bean="OAUTH2.TokenAudience" />
- <!-- A verifier resolves the did:web identifier from this -->
- <ref bean="DID.Document" />
- <!-- A verifier finds the key of a url issuer through this -->
- <ref bean="OAuth.JWTVCIssuer" />
- <!-- Of the federation plugin. Serves the Entity Configuration -->
- <ref bean="OIDFED.Configuration" />
</list>
</property>
</bean>
@@ -3606,78 +3381,44 @@ and both token and PAR endpoints take the Wallet Attestation:
</property>
</bean>
- <bean parent="RelyingPartyByName" c:relyingPartyIds="offer-caller/wallet">
- <property name="profileConfigurations">
- <list>
- <bean parent="OpenID.VCI.Token"
- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
- p:tokenEndpointAuthMethods="#{{'none'}}" />
- <bean parent="OpenID.VCI.Credentials" />
- </list>
- </property>
- </bean>
-
- <bean parent="RelyingPartyByName"
- c:relyingPartyIds="#{{'id.animo.paradym'}}">
- <property name="profileConfigurations">
- <list>
- <bean parent="OIDC.SSO"
- p:requireAuthenticationRequest="false"
- p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
- p:forcePKCE="true"
- p:requirePushedAuthorizationRequest="true" />
- <bean parent="OpenID.VCI.Token"
- p:tokenEndpointAuthMethods="#{{'none'}}"
- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
- <bean parent="OpenID.VCI.Credentials" />
- <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
- p:requireAuthenticationRequest="false"
- p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
- </list>
- </property>
- </bean>
-
+- <bean parent="RelyingPartyByName" c:relyingPartyIds="offer-caller/wallet">
+- <property name="profileConfigurations">
+- <list>
+- <bean parent="OpenID.VCI.Token"
+- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+- p:tokenEndpointAuthMethods="#{{'none'}}" />
+- <bean parent="OpenID.VCI.Credentials" />
+- </list>
+- </property>
+- </bean>
+-
<bean parent="RelyingPartyByName"
- c:relyingPartyIds="#{{'wallet-dev'}}">
+- c:relyingPartyIds="#{{'id.animo.paradym'}}">
++ c:relyingPartyIds="#{{'eudiw-abca'}}">
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO"
p:requireAuthenticationRequest="false"
p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
- p:forcePKCE="true"
- p:requirePushedAuthorizationRequest="true" />
+- p:forcePKCE="true"
+- p:requirePushedAuthorizationRequest="true" />
++ p:forcePKCE="true" p:requirePushedAuthorizationRequest="true"
++ p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
<bean parent="OpenID.VCI.Token"
- p:tokenEndpointAuthMethods="#{{'none'}}"
- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
+- p:tokenEndpointAuthMethods="#{{'none'}}"
+- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
++ p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
++ p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
++ p:requireDpopProof="true" />
<bean parent="OpenID.VCI.Credentials" />
- <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
+- <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
++ <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
p:requireAuthenticationRequest="false"
p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
</list>
</property>
</bean>
-+ <bean parent="RelyingPartyByName"
-+ c:relyingPartyIds="#{{'eudiw-abca'}}">
-+ <property name="profileConfigurations">
-+ <list>
-+ <bean parent="OIDC.SSO"
-+ p:requireAuthenticationRequest="false"
-+ p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
-+ p:forcePKCE="true" p:requirePushedAuthorizationRequest="true"
-+ p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
-+ <bean parent="OpenID.VCI.Token"
-+ p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
-+ p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
-+ p:requireDpopProof="true" />
-+ <bean parent="OpenID.VCI.Credentials" />
-+ <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}"
-+ p:requireAuthenticationRequest="false"
-+ p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
-+ </list>
-+ </property>
-+ </bean>
-+
</util:list>
</beans>
@@ -3694,8 +3435,9 @@ access tokens. The other DPoP settings are left to their defaults, so a DPoP non
DPoP, see [RFC 9449 10.1](https://www.rfc-editor.org/rfc/rfc9449#section-10.1).
`token_endpoint_auth_methods_supported` of *static/oauth-authorization-server.json* lists the
-methods your `tokenEndpointAuthMethods` allow on the token and PAR endpoints, here `none` for
-Paradym and `attest_jwt_client_auth` for the Hopae EUDI Wallet:
+methods your `tokenEndpointAuthMethods` allow on the token and PAR endpoints, here
+`attest_jwt_client_auth` for the Hopae EUDI Wallet. `grant_types_supported` no longer lists the
+pre-authorized code:
<details>
<summary>static/oauth-authorization-server.json</summary>
@@ -3710,7 +3452,6 @@ Paradym and `attest_jwt_client_auth` for the Hopae EUDI Wallet:
"jwks_uri":"$baseUrl/idp/profile/oidc/keyset",
"token_endpoint_auth_methods_supported":[
- "none"
-+ "none",
+ "attest_jwt_client_auth"
],
+ "client_attestation_signing_alg_values_supported":[
@@ -3724,8 +3465,9 @@ Paradym and `attest_jwt_client_auth` for the Hopae EUDI Wallet:
"code"
],
"grant_types_supported":[
- "authorization_code",
- "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+- "authorization_code",
+- "urn:ietf:params:oauth:grant-type:pre-authorized_code"
++ "authorization_code"
],
"code_challenge_methods_supported":[
"S256"
@@ -3740,11 +3482,8 @@ Paradym and `attest_jwt_client_auth` for the Hopae EUDI Wallet:
],
"scopes_supported":[
"openid",
- "GeantIncubatorDiploma_SDJWT",
- "GeantIncubatorDiploma_W3C",
- "GeantIncubatorDiploma_DIDWEB",
-- "GeantIncubatorDiploma_URL"
-+ "GeantIncubatorDiploma_URL",
+- "GeantIncubatorDiploma_SDJWT",
+- "GeantIncubatorDiploma_W3C"
+ "GeantIncubatorDiploma_HAIP",
+ "GeantIncubatorDiploma_MDOC"
],
@@ -3758,16 +3497,11 @@ Full file: [static/oauth-authorization-server.json](docs/example/step-5/static/o
</details>
-This breaks wallets of the earlier steps that change their behaviour on this. The metadata is the
-same for every client and every credential, and some wallets start to authenticate with a Wallet
-Attestation as soon as `attest_jwt_client_auth` is listed, also for the url credential. Such a
-wallet works only if it is registered with `attest_jwt_client_auth` and the CA of its wallet
-provider is in **openidvci.ClientAttestationTrustAnchors**.
-
### Step 6: Rolling the signing key
-Step 5 changed the signing key. What a key change means depends on the issuer
-identifier of the credential. The configuration is the same for all:
+This applies to both setups, the DIIP setup of Steps 1 to 4 and the HAIP setup of Step 5. What a
+key change means depends on the issuer identifier of the credential. The configuration is the
+same for all:
1. The new key goes **first** in **openidvci.SigningCredentials**. The first key that fits the
algorithm signs everything new.
@@ -3796,22 +3530,6 @@ Status List Tokens may be signed with a key of their own, **openidvci.status-lis
as in [Step 5](#certificate-chain). While any credential is did:jwk, keep the keys that signed
them in that list too.
-### What we have now
-
-| Credential | Issuer | Key found from | Federation | Wallet |
-|---|---|---|---|---|
-| `GeantIncubatorDiploma_SDJWT`, `_W3C` | `did:jwk:…` | the identifier | no | Paradym |
-| `GeantIncubatorDiploma_DIDWEB` | `did:web:issuer.example.org` | `/.well-known/did.json` | no | Paradym |
-| `GeantIncubatorDiploma_URL` | `https://issuer.example.org` | `x5c`, earlier `/.well-known/jwt-vc-issuer` | yes | TOPPAN |
-| `GeantIncubatorDiploma_HAIP` | `https://issuer.example.org` | `x5c` | no | Hopae EUDI Wallet |
-| `GeantIncubatorDiploma_MDOC` | none | `x5chain` | no | Hopae EUDI Wallet |
-
-The table lists every credential of the story. Run them as a DIIP setup, the first three rows
-with the files of [docs/example/step-4](docs/example/step-4), or as a HAIP setup with the files of
-step 5.
-
-The files at the end of the story are in [docs/example/step-5](docs/example/step-5).
-
## Requesting a credential by configuration or by identifier
**File(s):** *metadata/verifiable-credentials.json*, *metadata/oidc-client.json*, *conf/relying-party.xml*
@@ -4462,12 +4180,14 @@ Add the credential configuration ids to `scopes_supported`. For Wallet Attestati
</details>
-The whole *etc/jetty-rewrite-rules.xml* at the end of the story: [etc/jetty-rewrite-rules.xml](docs/example/step-5/etc/jetty-rewrite-rules.xml).
+The whole *etc/jetty-rewrite-rules.xml* of the DIIP setup: [etc/jetty-rewrite-rules.xml](docs/example/step-4/etc/jetty-rewrite-rules.xml).
+The HAIP setup of Step 5 has only the rules of Step 1: [etc/jetty-rewrite-rules.xml](docs/example/step-5/etc/jetty-rewrite-rules.xml).
### Relying party configuration
**File(s):** *conf/relying-party.xml*
**Format:** Native Spring
-The file as it is at the end of [First installation, by example](#first-installation-by-example):
+The file of the DIIP setup of [First installation, by example](#first-installation-by-example):
+[conf/relying-party.xml](docs/example/step-4/conf/relying-party.xml), and of the HAIP setup:
[conf/relying-party.xml](docs/example/step-5/conf/relying-party.xml).
diff --git a/docs/example/step-5/conf/attribute-filter.xml b/docs/example/step-5/conf/attribute-filter.xml
index d3bb945..1d86ead 100644
--- a/docs/example/step-5/conf/attribute-filter.xml
+++ b/docs/example/step-5/conf/attribute-filter.xml
@@ -4,22 +4,6 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
- <AttributeFilterPolicy id="GeantIncubatorDiplomaToWallets">
- <PolicyRequirementRule xsi:type="Requester"
- value="id.animo.paradym" />
- <AttributeRule attributeID="GeantIncubatorDiploma">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
- </AttributeFilterPolicy>
-
- <AttributeFilterPolicy id="GeantIncubatorDiplomaToToppan">
- <PolicyRequirementRule xsi:type="Requester"
- value="wallet-dev" />
- <AttributeRule attributeID="GeantIncubatorDiploma">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
- </AttributeFilterPolicy>
-
<AttributeFilterPolicy id="GeantIncubatorDiplomaToHAIPWallets">
<PolicyRequirementRule xsi:type="Requester"
value="eudiw-abca" />
diff --git a/docs/example/step-5/conf/global.xml b/docs/example/step-5/conf/global.xml
index 931367d..4e041b9 100644
--- a/docs/example/step-5/conf/global.xml
+++ b/docs/example/step-5/conf/global.xml
@@ -12,7 +12,6 @@
default-destroy-method="destroy">
<import resource="openid-vci-credentials.xml"/>
- <import resource="openid-vci-oidfed.xml"/>
<util:list id="openidvci.KeyAttestationTrustAnchors">
<bean parent="shibboleth.BasicX509CredentialFactoryBean"
diff --git a/docs/example/step-5/conf/openid-vci-credentials.xml b/docs/example/step-5/conf/openid-vci-credentials.xml
index 270c59e..8e4f237 100644
--- a/docs/example/step-5/conf/openid-vci-credentials.xml
+++ b/docs/example/step-5/conf/openid-vci-credentials.xml
@@ -8,11 +8,8 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <bean id="openidvci.OPESSigningCredential" parent="shibboleth.JWKCredential"
- p:resource="%{idp.signing.oidc.es.key}" />
-
<bean id="openidvci.X509ESSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKey="%{idp.home}/credentials/vci-signing.key" p:keyNames="signingvci-x509">
+ p:privateKey="%{idp.home}/credentials/vci-signing.key">
<property name="certificates">
<list>
<value>%{idp.home}/credentials/vci-signing.crt</value>
@@ -21,7 +18,7 @@
</bean>
<bean id="openidvci.X509StatusListSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKey="%{idp.home}/credentials/vci-status-list.key" p:keyNames="statuslist-x509">
+ p:privateKey="%{idp.home}/credentials/vci-status-list.key">
<property name="certificates">
<list>
<value>%{idp.home}/credentials/vci-status-list.crt</value>
@@ -31,13 +28,10 @@
<util:list id="openidvci.SigningCredentials">
<ref bean="openidvci.X509ESSigningCredential" />
- <ref bean="openidvci.OPESSigningCredential" />
</util:list>
<util:list id="openidvci.status-list.SigningCredentials">
<ref bean="openidvci.X509StatusListSigningCredential" />
- <ref bean="openidvci.X509ESSigningCredential" />
- <ref bean="openidvci.OPESSigningCredential" />
</util:list>
<util:list id="openidvci.issuerMetadata.SigningCredentials">
diff --git a/docs/example/step-5/conf/relying-party.xml b/docs/example/step-5/conf/relying-party.xml
index afd991c..a2af800 100644
--- a/docs/example/step-5/conf/relying-party.xml
+++ b/docs/example/step-5/conf/relying-party.xml
@@ -28,12 +28,6 @@
<ref bean="OIDC.Configuration" />
<!-- Of the OP plugin. Needed for the audience values of the wallet -->
<ref bean="OAUTH2.TokenAudience" />
- <!-- A verifier resolves the did:web identifier from this -->
- <ref bean="DID.Document" />
- <!-- A verifier finds the key of a url issuer through this -->
- <ref bean="OAuth.JWTVCIssuer" />
- <!-- Of the federation plugin. Serves the Entity Configuration -->
- <ref bean="OIDFED.Configuration" />
</list>
</property>
</bean>
@@ -60,57 +54,6 @@
</property>
</bean>
- <bean parent="RelyingPartyByName" c:relyingPartyIds="offer-caller/wallet">
- <property name="profileConfigurations">
- <list>
- <bean parent="OpenID.VCI.Token"
- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
- p:tokenEndpointAuthMethods="#{{'none'}}" />
- <bean parent="OpenID.VCI.Credentials" />
- </list>
- </property>
- </bean>
-
- <bean parent="RelyingPartyByName"
- c:relyingPartyIds="#{{'id.animo.paradym'}}">
- <property name="profileConfigurations">
- <list>
- <bean parent="OIDC.SSO"
- p:requireAuthenticationRequest="false"
- p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
- p:forcePKCE="true"
- p:requirePushedAuthorizationRequest="true" />
- <bean parent="OpenID.VCI.Token"
- p:tokenEndpointAuthMethods="#{{'none'}}"
- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
- <bean parent="OpenID.VCI.Credentials" />
- <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
- p:requireAuthenticationRequest="false"
- p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
- </list>
- </property>
- </bean>
-
- <bean parent="RelyingPartyByName"
- c:relyingPartyIds="#{{'wallet-dev'}}">
- <property name="profileConfigurations">
- <list>
- <bean parent="OIDC.SSO"
- p:requireAuthenticationRequest="false"
- p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
- p:forcePKCE="true"
- p:requirePushedAuthorizationRequest="true" />
- <bean parent="OpenID.VCI.Token"
- p:tokenEndpointAuthMethods="#{{'none'}}"
- p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
- <bean parent="OpenID.VCI.Credentials" />
- <bean parent="OAUTH2.PAR" p:tokenEndpointAuthMethods="#{{'none'}}"
- p:requireAuthenticationRequest="false"
- p:requestUriClaimsSetManipulationStrategy-ref="openidvci.PushedAuthorizationDPoPJktManipulationStrategy" />
- </list>
- </property>
- </bean>
-
<bean parent="RelyingPartyByName"
c:relyingPartyIds="#{{'eudiw-abca'}}">
<property name="profileConfigurations">
diff --git a/docs/example/step-5/etc/jetty-rewrite-rules.xml b/docs/example/step-5/etc/jetty-rewrite-rules.xml
index 9b8ed66..d7017ac 100644
--- a/docs/example/step-5/etc/jetty-rewrite-rules.xml
+++ b/docs/example/step-5/etc/jetty-rewrite-rules.xml
@@ -37,33 +37,6 @@
</New>
</Arg>
</Call>
- <!-- The did:web document -->
- <Call name="addRule">
- <Arg>
- <New class="org.eclipse.jetty.rewrite.handler.RewritePatternRule">
- <Set name="pattern">/.well-known/did.json</Set>
- <Set name="replacement">/idp/profile/did/document</Set>
- </New>
- </Arg>
- </Call>
- <!-- JWT VC issuer metadata -->
- <Call name="addRule">
- <Arg>
- <New class="org.eclipse.jetty.rewrite.handler.RewritePatternRule">
- <Set name="pattern">/.well-known/jwt-vc-issuer</Set>
- <Set name="replacement">/idp/profile/oauth/jwt-vc-issuer</Set>
- </New>
- </Arg>
- </Call>
- <!-- Entity Configuration, of the federation plugin -->
- <Call name="addRule">
- <Arg>
- <New class="org.eclipse.jetty.rewrite.handler.RewritePatternRule">
- <Set name="pattern">/.well-known/openid-federation</Set>
- <Set name="replacement">/idp/profile/oidfed/entity-configuration</Set>
- </New>
- </Arg>
- </Call>
<!-- Wallets running in a browser need this -->
<Call name="addRule">
<Arg>
diff --git a/docs/example/step-5/metadata/oidc-client.json b/docs/example/step-5/metadata/oidc-client.json
index 5604e55..878fc67 100644
--- a/docs/example/step-5/metadata/oidc-client.json
+++ b/docs/example/step-5/metadata/oidc-client.json
@@ -4,41 +4,6 @@
"client_name": "Credential offer caller",
"client_secret": "CHANGE-ME"
},
- {
- "client_id": "offer-caller/wallet",
- "client_name": "Wallets redeeming a pre-authorized code minted by offer-caller",
- "token_endpoint_auth_method": "none",
- "grant_types": ["urn:ietf:params:oauth:grant-type:pre-authorized_code"]
- },
- {
- "client_id": "id.animo.paradym",
- "client_name": "Paradym Wallet",
- "redirect_uris": ["https://paradym.id/invitation/redirect"],
- "scope": "openid GeantIncubatorDiploma_SDJWT GeantIncubatorDiploma_W3C GeantIncubatorDiploma_DIDWEB GeantIncubatorDiploma_URL",
- "audience": [
- "credentials",
- "urn:shibboleth.oidc.op.resource:https://issuer.example.org"
- ],
- "token_endpoint_auth_method": "none",
- "response_types": ["code"],
- "grant_types": [
- "authorization_code",
- "urn:ietf:params:oauth:grant-type:pre-authorized_code"
- ]
- },
- {
- "client_id": "wallet-dev",
- "client_name": "TOPPAN Wallet",
- "redirect_uris": ["walletapp-goid-openid4vci-callback://authorization"],
- "scope": "openid GeantIncubatorDiploma_URL",
- "audience": [
- "credentials",
- "urn:shibboleth.oidc.op.resource:https://issuer.example.org"
- ],
- "token_endpoint_auth_method": "none",
- "response_types": ["code"],
- "grant_types": ["authorization_code"]
- },
{
"client_id": "eudiw-abca",
"client_name": "Hopae EUDI Wallet",
diff --git a/docs/example/step-5/metadata/verifiable-credentials.json b/docs/example/step-5/metadata/verifiable-credentials.json
index 5e54bd6..aa2ceb5 100644
--- a/docs/example/step-5/metadata/verifiable-credentials.json
+++ b/docs/example/step-5/metadata/verifiable-credentials.json
@@ -1,135 +1,5 @@
{
"credential_configurations_supported": {
- "GeantIncubatorDiploma_SDJWT": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_SDJWT",
- "scope": "GeantIncubatorDiploma_SDJWT",
- "_issuance_configuration": {
- "oidfed": false
- },
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "credential_metadata": {
- "display": [
- {
- "name": "Incubator Diploma",
- "locale": "en",
- "description": "Diploma issued by the Trust and Identity Incubator"
- }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_W3C": {
- "format": "vc+sd-jwt",
- "scope": "GeantIncubatorDiploma_W3C",
- "_issuance_configuration": {
- "oidfed": false
- },
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "credential_definition": {
- "@context": [
- "https://www.w3.org/ns/credentials/v2",
- "https://issuer.example.org/credentials/GeantIncubatorDiploma_W3C"
- ],
- "type": [
- "VerifiableCredential",
- "GeantIncubatorDiploma_W3C"
- ]
- },
- "credential_metadata": {
- "display": [
- {
- "name": "Incubator Diploma, W3C",
- "locale": "en",
- "description": "Diploma issued by the Trust and Identity Incubator"
- }
- ],
- "claims": [
- { "path": ["credentialSubject","diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["credentialSubject","mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["credentialSubject","eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["credentialSubject","givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["credentialSubject","familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["credentialSubject","affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_DIDWEB": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_DIDWEB",
- "scope": "GeantIncubatorDiploma_DIDWEB",
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "_issuance_configuration": {
- "issuer": "did:web",
- "oidfed": false
- },
- "credential_metadata": {
- "display": [
- { "name": "Incubator Diploma, did:web", "locale": "en" }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
- "GeantIncubatorDiploma_URL": {
- "format": "dc+sd-jwt",
- "vct": "GeantIncubatorDiploma_URL",
- "scope": "GeantIncubatorDiploma_URL",
- "cryptographic_binding_methods_supported": ["did:jwk", "jwk"],
- "credential_signing_alg_values_supported": ["ES256"],
- "proof_types_supported": {
- "jwt": {
- "proof_signing_alg_values_supported": ["ES256", "ES384", "ES512"]
- }
- },
- "_issuance_configuration": {
- "issuer": "url"
- },
- "credential_metadata": {
- "display": [
- { "name": "Incubator Diploma, url", "locale": "en" }
- ],
- "claims": [
- { "path": ["diploma"], "display": [{ "name": "Diploma", "locale": "en" }] },
- { "path": ["mail"], "display": [{ "name": "Email", "locale": "en" }] },
- { "path": ["eppn"], "display": [{ "name": "Principal name", "locale": "en" }] },
- { "path": ["givenName"], "display": [{ "name": "Given names", "locale": "en" }] },
- { "path": ["familyName"], "display": [{ "name": "Family name", "locale": "en" }] },
- { "path": ["affiliation"], "display": [{ "name": "Affiliation", "locale": "en" }] }
- ]
- }
- },
"GeantIncubatorDiploma_HAIP": {
"format": "dc+sd-jwt",
"vct": "GeantIncubatorDiploma_HAIP",
diff --git a/docs/example/step-5/static/oauth-authorization-server.json b/docs/example/step-5/static/oauth-authorization-server.json
index 1aa03ac..d8d01f7 100644
--- a/docs/example/step-5/static/oauth-authorization-server.json
+++ b/docs/example/step-5/static/oauth-authorization-server.json
@@ -6,7 +6,6 @@
"token_endpoint":"$baseUrl/idp/profile/openid/vci/token",
"jwks_uri":"$baseUrl/idp/profile/oidc/keyset",
"token_endpoint_auth_methods_supported":[
- "none",
"attest_jwt_client_auth"
],
"client_attestation_signing_alg_values_supported":[
@@ -20,8 +19,7 @@
"code"
],
"grant_types_supported":[
- "authorization_code",
- "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+ "authorization_code"
],
"code_challenge_methods_supported":[
"S256"
@@ -36,10 +34,6 @@
],
"scopes_supported":[
"openid",
- "GeantIncubatorDiploma_SDJWT",
- "GeantIncubatorDiploma_W3C",
- "GeantIncubatorDiploma_DIDWEB",
- "GeantIncubatorDiploma_URL",
"GeantIncubatorDiploma_HAIP",
"GeantIncubatorDiploma_MDOC"
],
diff --git a/docs/example/step-5/webapps/root/credentials/GeantIncubatorDiploma_W3C.json b/docs/example/step-5/webapps/root/credentials/GeantIncubatorDiploma_W3C.json
deleted file mode 100644
index 3f2fb9a..0000000
--- a/docs/example/step-5/webapps/root/credentials/GeantIncubatorDiploma_W3C.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
- "@context": {
- "diploma": "https://vocabulary.example.org/terms#diploma",
- "mail": "https://vocabulary.example.org/terms#mail",
- "eppn": "https://vocabulary.example.org/terms#eppn",
- "givenName": "https://vocabulary.example.org/terms#givenName",
- "familyName": "https://vocabulary.example.org/terms#familyName",
- "affiliation": "https://vocabulary.example.org/terms#affiliation"
- }
-}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list