[java-idp-plugin-vci] branch main updated: tx code failure retires the code. sanitize log entries of tx code
Codeberg
noreply at shibboleth.net
Tue Sep 22 11:04:12 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/fd662651a38e621ef814f985d9308a77ca96ae74
The following commit(s) were added to refs/heads/main by this push:
new fd66265 tx code failure retires the code. sanitize log entries of tx code
fd66265 is described below
commit fd662651a38e621ef814f985d9308a77ca96ae74
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Tue Sep 22 14:04:00 2026 +0300
tx code failure retires the code. sanitize log entries of tx code
---
.../context/navigate/APIRequestClientIDLookupFunction.java | 8 ++++++++
.../plugin/openidvci/profile/impl/ConsumeCredentialOffer.java | 5 ++---
.../shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java | 4 ++--
.../shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java | 3 +--
.../net/shibboleth/idp/flows/openid/vci/token/token-flow.xml | 6 +++---
5 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
index f70ca7d..a9565dd 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
@@ -21,6 +21,7 @@ import java.io.IOException;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.geant.shibboleth.plugin.openidvci.messaging.context.TokenContext;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferRequest;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCITokenRequest;
import org.geant.shibboleth.plugin.openidvci.storage.CredentialOfferCache;
@@ -93,6 +94,13 @@ public class APIRequestClientIDLookupFunction implements ContextDataLookupFuncti
&& msg.getClientAuthentication().getClientID() != null) {
return msg.getClientAuthentication().getClientID();
}
+ if (message instanceof OpenIDVCITokenRequest) {
+ final TokenContext tokenContext = input.getSubcontext(TokenContext.class);
+ final CredentialOfferObject offer = tokenContext != null ? tokenContext.getCredentialOfferObject() : null;
+ if (offer != null && offer.getClientID() != null) {
+ return new ClientID(offer.getClientID().getValue() + "/wallet");
+ }
+ }
if (message instanceof OpenIDVCITokenRequest msg && msg.getPreAuthorizedCode() != null
&& credentialOfferCache != null) {
try {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java
index 797cb0a..926c0ec 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java
@@ -109,10 +109,9 @@ public class ConsumeCredentialOffer extends AbstractProfileAction {
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
try {
credentialOfferCache.removeCredentialOffer(preAuthorizedCode);
- log.debug("{} Credential Offer of pre-authorized code {} consumed", getLogPrefix(), preAuthorizedCode);
+ log.debug("{} Credential Offer of the pre-authorized code consumed", getLogPrefix());
} catch (final IOException e) {
- log.error("{} Removing Credential Offer of pre-authorized code {} failed", getLogPrefix(),
- preAuthorizedCode, e);
+ log.error("{} Removing Credential Offer of the pre-authorized code failed", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
}
}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
index 78e7213..91e8c76 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
@@ -183,7 +183,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
return;
} else if (PreAuthorizedCodeGrant.GRANT_TYPE.equals(grant.getType())) {
final String code = getOpenIDVCITokenRequest().getPreAuthorizedCode();
- log.info("{} Unwrapping pre-authorization code: {}", getLogPrefix(), code);
+ log.info("{} Unwrapping pre-authorization code", getLogPrefix());
final Exception e;
try {
final CredentialOfferClaimsSet credentialOffer = CredentialOfferClaimsSet.parse(code, dataSealer);
@@ -233,7 +233,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
} catch (final IOException | net.minidev.json.parser.ParseException e1) {
e = e1;
}
- log.error("{} Validating pre-authorized code {} failed", getLogPrefix(), code, e);
+ log.error("{} Validating pre-authorized code failed", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
}
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
index b4db195..edafa08 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
@@ -89,8 +89,7 @@ public class ValidateTxCode extends AbstractProfileAction {
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
log.info("{} Validating tx-code", getLogPrefix());
if (!requiredTxCode.getValue().equals(providedTxCode)) {
- log.error("{} Provided tx code {} did not match required one {}.", getLogPrefix(), providedTxCode,
- requiredTxCode.getValue());
+ log.error("{} Provided tx code did not match the required one.", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OpenIDVCIEventIds.INVALID_TX_CODE);
}
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
index aabc3fe..765eb7b 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
@@ -7,7 +7,7 @@
OpenIDVCIValidateTxCode transaction code of a pre-authorized offer
OpenIDVCIValidatePreAuthorizedCode one time use of a pre-authorized code
OpenIDVCISetAuthorizationDetailsToResponseContext credential authorization details
- OpenIDVCIConsumeCredentialOffer retires the offer once the token is issued
+ OpenIDVCIConsumeCredentialOffer retires a stored offer before the transaction code is read
OpenIDVCIBranchOnPreAuthorizedCodeGrant state takes that grant aside
OpenIDVCIPreAuthzGrantProcessing state the pre-authorized code grant branch
OpenIDVCIBuildTokensForCredentialsAccess state the opaque access token of both grants
@@ -114,8 +114,9 @@
<!-- ADDED. The pre-authorized code grant of OpenID4VCI. -->
<action-state id="OpenIDVCIPreAuthzGrantProcessing">
- <evaluate expression="OpenIDVCIValidateTxCode" />
<evaluate expression="OpenIDVCIValidatePreAuthorizedCode" />
+ <evaluate expression="OpenIDVCIConsumeCredentialOffer" />
+ <evaluate expression="OpenIDVCIValidateTxCode" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="OpenIDVCIBuildTokensForCredentialsAccess" />
@@ -126,7 +127,6 @@
<evaluate expression="OpenIDVCISetAuthorizationDetailsToResponseContext" />
<evaluate expression="BuildOIDCAccessToken" />
<evaluate expression="SetOAuthAccessTokenToResponseContext" />
- <evaluate expression="OpenIDVCIConsumeCredentialOffer" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="BuildResponseMessage" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list