[java-idp-plugin-vci] branch main updated: Improve relying-party.xml explanation readability

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/1520f83b2ff8cf5134a3fc24b5f305aa91942dc0

The following commit(s) were added to refs/heads/main by this push:
     new 1520f83  Improve relying-party.xml explanation readability
1520f83 is described below

commit 1520f83b2ff8cf5134a3fc24b5f305aa91942dc0
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Mon Sep 7 19:03:19 2026 +0300

    Improve relying-party.xml explanation readability
---
 README.md | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 10b81ec..0d876b2 100644
--- a/README.md
+++ b/README.md
@@ -347,19 +347,14 @@ different identity. You register both:
 
 </details>
 
-The first of the three relying parties is the anonymous half of the deployment. A wallet reads
-the Credential Issuer metadata and asks for a nonce before it has any client identity, and the
-last three beans of that list come with the OP plugin. Without `OIDC.Keyset` nothing serves the
-`jwks_uri` that *static/jwt-vc-issuer.json* names, without `OIDC.Configuration` there is no
-`/.well-known/openid-configuration` for a wallet to read and without `OAUTH2.TokenAudience` the
-`audience` values of a wallet client are not honoured. The same three are needed by the
-authorization code flow.
-
 The `/wallet` suffix is not a convention you may choose. A wallet that redeems a pre-authorized
 code does not authenticate, so the plugin resolves its client id by taking the client id of the
 creator of the offer and appending `/wallet` to it. Register that exact string or the token
 request has no relying party.
 
+*conf/relying-party.xml* then needs three relying parties. One for what a wallet reads before
+it has any identity at all, one for the caller and one for the wallet that redeems the code:
+
 <details>
 <summary>Example snippet of conf/relying-party.xml</summary>
 
@@ -412,6 +407,12 @@ request has no relying party.
 
 </details>
 
+The last three beans of the anonymous relying party come with the OP plugin. Without
+`OIDC.Keyset` nothing serves the `jwks_uri` that *static/jwt-vc-issuer.json* names, without
+`OIDC.Configuration` there is no `/.well-known/openid-configuration` for a wallet to read and
+without `OAUTH2.TokenAudience` the `audience` values of a wallet client are not honoured. The
+same relying party is needed by the authorization code flow.
+
 The offer request is a `POST` of `application/json` to
 `/idp/profile/openid/vci/credential-offer` authenticated as `offer-caller`. Claim values are
 given literally and keyed with the credential configuration id:

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.