[java-idp-plugin-vci] branch main updated: tx code failure retires the code. sanitize log entries of tx code

Codeberg noreply at shibboleth.net
Tue Sep 22 11:04:12 UTC 2026


This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/fd662651a38e621ef814f985d9308a77ca96ae74

The following commit(s) were added to refs/heads/main by this push:
     new fd66265  tx code failure retires the code. sanitize log entries of tx code
fd66265 is described below

commit fd662651a38e621ef814f985d9308a77ca96ae74
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Tue Sep 22 14:04:00 2026 +0300

    tx code failure retires the code. sanitize log entries of tx code
---
 .../context/navigate/APIRequestClientIDLookupFunction.java        | 8 ++++++++
 .../plugin/openidvci/profile/impl/ConsumeCredentialOffer.java     | 5 ++---
 .../shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java     | 4 ++--
 .../shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java  | 3 +--
 .../net/shibboleth/idp/flows/openid/vci/token/token-flow.xml      | 6 +++---
 5 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
index f70ca7d..a9565dd 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/context/navigate/APIRequestClientIDLookupFunction.java
@@ -21,6 +21,7 @@ import java.io.IOException;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.geant.shibboleth.plugin.openidvci.messaging.context.TokenContext;
 import org.geant.shibboleth.plugin.openidvci.messaging.impl.CredentialOfferRequest;
 import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCITokenRequest;
 import org.geant.shibboleth.plugin.openidvci.storage.CredentialOfferCache;
@@ -93,6 +94,13 @@ public class APIRequestClientIDLookupFunction implements ContextDataLookupFuncti
                 && msg.getClientAuthentication().getClientID() != null) {
             return msg.getClientAuthentication().getClientID();
         }
+        if (message instanceof OpenIDVCITokenRequest) {
+            final TokenContext tokenContext = input.getSubcontext(TokenContext.class);
+            final CredentialOfferObject offer = tokenContext != null ? tokenContext.getCredentialOfferObject() : null;
+            if (offer != null && offer.getClientID() != null) {
+                return new ClientID(offer.getClientID().getValue() + "/wallet");
+            }
+        }
         if (message instanceof OpenIDVCITokenRequest msg && msg.getPreAuthorizedCode() != null
                 && credentialOfferCache != null) {
             try {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java
index 797cb0a..926c0ec 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ConsumeCredentialOffer.java
@@ -109,10 +109,9 @@ public class ConsumeCredentialOffer extends AbstractProfileAction {
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         try {
             credentialOfferCache.removeCredentialOffer(preAuthorizedCode);
-            log.debug("{} Credential Offer of pre-authorized code {} consumed", getLogPrefix(), preAuthorizedCode);
+            log.debug("{} Credential Offer of the pre-authorized code consumed", getLogPrefix());
         } catch (final IOException e) {
-            log.error("{} Removing Credential Offer of pre-authorized code {} failed", getLogPrefix(),
-                    preAuthorizedCode, e);
+            log.error("{} Removing Credential Offer of the pre-authorized code failed", getLogPrefix(), e);
             ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
         }
     }
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
index 78e7213..91e8c76 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
@@ -183,7 +183,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
             return;
         } else if (PreAuthorizedCodeGrant.GRANT_TYPE.equals(grant.getType())) {
             final String code = getOpenIDVCITokenRequest().getPreAuthorizedCode();
-            log.info("{} Unwrapping pre-authorization code: {}", getLogPrefix(), code);
+            log.info("{} Unwrapping pre-authorization code", getLogPrefix());
             final Exception e;
             try {
                 final CredentialOfferClaimsSet credentialOffer = CredentialOfferClaimsSet.parse(code, dataSealer);
@@ -233,7 +233,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
             } catch (final IOException | net.minidev.json.parser.ParseException e1) {
                 e = e1;
             }
-            log.error("{} Validating pre-authorized code {} failed", getLogPrefix(), code, e);
+            log.error("{} Validating pre-authorized code failed", getLogPrefix(), e);
             ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
         }
         ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
index b4db195..edafa08 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/ValidateTxCode.java
@@ -89,8 +89,7 @@ public class ValidateTxCode extends AbstractProfileAction {
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         log.info("{} Validating tx-code", getLogPrefix());
         if (!requiredTxCode.getValue().equals(providedTxCode)) {
-            log.error("{} Provided tx code {} did not match required one {}.", getLogPrefix(), providedTxCode,
-                    requiredTxCode.getValue());
+            log.error("{} Provided tx code did not match the required one.", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, OpenIDVCIEventIds.INVALID_TX_CODE);
         }
 
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
index aabc3fe..765eb7b 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
@@ -7,7 +7,7 @@
       OpenIDVCIValidateTxCode                      transaction code of a pre-authorized offer
       OpenIDVCIValidatePreAuthorizedCode           one time use of a pre-authorized code
       OpenIDVCISetAuthorizationDetailsToResponseContext   credential authorization details
-      OpenIDVCIConsumeCredentialOffer              retires the offer once the token is issued
+      OpenIDVCIConsumeCredentialOffer              retires a stored offer before the transaction code is read
       OpenIDVCIBranchOnPreAuthorizedCodeGrant state   takes that grant aside
       OpenIDVCIPreAuthzGrantProcessing state       the pre-authorized code grant branch
       OpenIDVCIBuildTokensForCredentialsAccess state  the opaque access token of both grants
@@ -114,8 +114,9 @@
 
     <!-- ADDED. The pre-authorized code grant of OpenID4VCI. -->
     <action-state id="OpenIDVCIPreAuthzGrantProcessing">
-        <evaluate expression="OpenIDVCIValidateTxCode" />
         <evaluate expression="OpenIDVCIValidatePreAuthorizedCode" />
+        <evaluate expression="OpenIDVCIConsumeCredentialOffer" />
+        <evaluate expression="OpenIDVCIValidateTxCode" />
         <evaluate expression="'proceed'" />
 
         <transition on="proceed" to="OpenIDVCIBuildTokensForCredentialsAccess" />
@@ -126,7 +127,6 @@
         <evaluate expression="OpenIDVCISetAuthorizationDetailsToResponseContext" />
         <evaluate expression="BuildOIDCAccessToken" />
         <evaluate expression="SetOAuthAccessTokenToResponseContext" />
-        <evaluate expression="OpenIDVCIConsumeCredentialOffer" />
         <evaluate expression="'proceed'" />
 
         <transition on="proceed" to="BuildResponseMessage" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list