[java-idp-plugin-vci] branch main updated: Enforce PKCE and PAR

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/8822055510a7ee13f35dfd167ec23071b633a698

The following commit(s) were added to refs/heads/main by this push:
     new 8822055  Enforce PKCE and PAR
8822055 is described below

commit 8822055510a7ee13f35dfd167ec23071b633a698
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Mon Sep 14 09:37:26 2026 +0300

    Enforce PKCE and PAR
---
 README.md                                          | 29 +++++++++++++++++++---
 .../static/oauth-authorization-server.json         |  4 +++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 6bdbb1b..0c7477b 100644
--- a/README.md
+++ b/README.md
@@ -719,7 +719,9 @@ code flow:
           <property name="profileConfigurations">
               <list>
                   <bean parent="OIDC.SSO"
-                        p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
+                        p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+                        p:forcePKCE="true"
+                        p:requirePushedAuthorizationRequest="true" />
                   <bean parent="OpenID.VCI.Token"
                         p:tokenEndpointAuthMethods="#{{'none'}}"
                         p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
@@ -1302,6 +1304,7 @@ See [DID.Document](#diddocument).
    "issuer":"$issuer",
    "authorization_endpoint":"$baseUrl/idp/profile/oidc/authorize",
    "pushed_authorization_request_endpoint":"$baseUrl/idp/profile/oauth2/pushed-authorization",
+   "require_pushed_authorization_requests":true,
    "token_endpoint":"$baseUrl/idp/profile/openid/vci/token",
    "jwks_uri":"$baseUrl/idp/profile/oidc/keyset",
    "token_endpoint_auth_methods_supported":[
@@ -1313,6 +1316,12 @@ See [DID.Document](#diddocument).
    "response_types_supported":[
       "code"
    ],
+   "code_challenge_methods_supported":[
+      "S256"
+   ],
+   "scopes_supported":[
+      "openid"
+   ],
    "authorization_details_types_supported":[
       "openid_credential"
    ]
@@ -1321,6 +1330,16 @@ See [DID.Document](#diddocument).
 
 </details>
 
+`require_pushed_authorization_requests` and `code_challenge_methods_supported` describe the OP,
+they do not configure it. Both are off in the OP by default. Back them on the **OIDC.SSO** bean:
+
+```xml
+<bean parent="OIDC.SSO"
+      p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+      p:forcePKCE="true"
+      p:requirePushedAuthorizationRequest="true" />
+```
+
 Then the paths. No `/.well-known/` location is an IdP path, so you wire each one to its
 endpoint in Jetty. Wallets that run in a browser need also `Access-Control-Allow-Origin` in the
 responses, so that header belongs to the same file. With Jetty rewrite handler:
@@ -1869,7 +1888,9 @@ examples of this document. `OIDC.Keyset`, `OIDC.Configuration`, `OAUTH2.TokenAud
                 <ref bean="OAuth.StatusList" />
                 <!-- The three below are for unregistered wallets running the code flow -->
                 <bean parent="OIDC.SSO"
-                      p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
+                      p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+                      p:forcePKCE="true"
+                      p:requirePushedAuthorizationRequest="true" />
                 <bean parent="OpenID.VCI.Token"
                       p:tokenEndpointAuthMethods="#{{'none'}}"
                       p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
@@ -1914,7 +1935,9 @@ examples of this document. `OIDC.Keyset`, `OIDC.Configuration`, `OAUTH2.TokenAud
           <property name="profileConfigurations">
               <list>
                   <bean parent="OIDC.SSO"
-                        p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy" />
+                        p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
+                        p:forcePKCE="true"
+                        p:requirePushedAuthorizationRequest="true" />
                   <bean parent="OpenID.VCI.Token"
                         p:tokenEndpointAuthMethods="#{{'none'}}"
                         p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
diff --git a/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/static/oauth-authorization-server.json b/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/static/oauth-authorization-server.json
index 0789d4e..75267e7 100644
--- a/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/static/oauth-authorization-server.json
+++ b/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/static/oauth-authorization-server.json
@@ -2,6 +2,7 @@
    "issuer":"$issuer",
    "authorization_endpoint":"$baseUrl/idp/profile/oidc/authorize",
    "pushed_authorization_request_endpoint":"$baseUrl/idp/profile/oauth2/pushed-authorization",
+   "require_pushed_authorization_requests":true,
    "token_endpoint":"$baseUrl/idp/profile/openid/vci/token",
    "jwks_uri":"$baseUrl/idp/profile/oidc/keyset",
    "token_endpoint_auth_methods_supported":[
@@ -13,6 +14,9 @@
    "response_types_supported":[
       "code"
    ],
+   "code_challenge_methods_supported":[
+      "S256"
+   ],
    "scopes_supported":[
       "openid"
    ],

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.