[java-idp-plugin-vci] branch main updated: Remove repetitive part
Codeberg
noreply at shibboleth.net
Thu Sep 24 18:00:41 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/3a80c0eac7ad3839a98323e04a8a5759e74f14d1
The following commit(s) were added to refs/heads/main by this push:
new 3a80c0e Remove repetitive part
3a80c0e is described below
commit 3a80c0eac7ad3839a98323e04a8a5759e74f14d1
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Sep 24 20:59:27 2026 +0300
Remove repetitive part
---
README.md | 61 ++++++++++++++++++++++++++++++++++---------------------------
1 file changed, 34 insertions(+), 27 deletions(-)
diff --git a/README.md b/README.md
index e24a27f..ca0f72c 100644
--- a/README.md
+++ b/README.md
@@ -1628,21 +1628,6 @@ and the whole *etc/jetty-rewrite-rules.xml* in [Discovery documents](#discovery-
An endpoint is enabled by adding its profile configuration bean to a relying party. Nothing is
enabled by default.
-**OpenID.VCI.CredentialOffer**, **OpenID.VCI.Token**, **OpenID.VCI.Credentials**,
-**OpenID.VCI.Nonce**, **OAuth.StatusList.Revoke** and **OAuth.StatusList.Assignments** inherit the
-OAuth2 settings of the OP plugin, `tokenEndpointAuthMethods`, `accessTokenLifetime`, `forcePKCE`,
-`securityConfiguration` and DPoP settings among them. The rest serve requests without a client
-and inherit nothing of that. Each setting also has a `…LookupStrategy` variant that takes a
-`Function` returning the value.
-
-#### Common to all profiles
-
-| Name | Type | Default | Description |
-|---|---|---|---|
-| `inboundInterceptorFlows` | List<String> | | Run after the request is decoded and the profile is selected, before authentication. |
-| `outboundInterceptorFlows` | List<String> | | Run after the response message is formed, before it is committed. Also for an error response. |
-| `messageHandler` | Function<MessageContext,Exception> | | Runs on the inbound message context before authentication, and on the outbound one before encoding. |
-
#### OpenID.VCI.IssuerMetadata
Endpoint `/idp/profile/openid/vci/issuer-metadata`, profile ID `http://geant.org/ns/profiles/openid/vci/issuer-metadata`.
@@ -1650,10 +1635,11 @@ Endpoint `/idp/profile/openid/vci/issuer-metadata`, profile ID `http://geant.org
| Name | Type | Default | Description |
|---|---|---|---|
| `issuerMetadataSignatureSigningConfiguration` | SignatureSigningConfiguration | **openidvci.issuerMetadata.SigningConfiguration** | Signing of the metadata. Published unsigned until **openidvci.issuerMetadata.SigningCredentials** exists. Signed metadata is served for `Accept: application/jwt`. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
**OAuth.JWTVCIssuer** (`/idp/profile/oauth/jwt-vc-issuer`), **OAuth.AuthorizationServer**
(`/idp/profile/oauth/authorization-server`) and **DID.Document** (`/idp/profile/did/document`)
-have no settings of this plugin.
+have one setting, `outboundInterceptorFlows`, as above.
#### OpenID.VCI.CredentialOffer
@@ -1663,6 +1649,10 @@ Endpoint `/idp/profile/openid/vci/credential-offer`, profile ID `http://geant.or
|---|---|---|---|
| `preAuthorizedCodeLifetime` | Duration | `PT10M` | Lifetime of the pre-authorized code. Property `openidvci.preAuthorizedCode.defaultLifetime`. |
| `preAuthorizedCodeLength` | Integer | `0` | `0` seals the whole offer in the code, no storage needed. `10` or more is a short code of an offer in storage. Property `openidvci.preAuthorizedCode.defaultLength`. |
+| `tokenEndpointAuthMethods` | Collection<String> | | Of the OP plugin. Client authentication of the caller, `client_secret_basic` for instance. |
+| `inboundInterceptorFlows` | List<String> | | Interceptor flows run after the request is decoded, before authentication. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
+| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the inbound message before authentication and on the outbound one before encoding. |
Request, a `POST` of `application/json`:
@@ -1683,6 +1673,10 @@ Endpoint `/idp/profile/openid/vci/token`, profile ID `http://geant.org/ns/profil
| `grantTypes` | Set<String> | `authorization_code`, `urn:ietf:params:oauth:grant-type:pre-authorized_code` | Grants served. The wallet client has to have the grant in its `grant_types`. |
| `accessTokenClaimsSetManipulationStrategy` | Function | | Of the OP plugin. Must be **openidvci.TokenManipulationStrategy**. |
| `tokenEndpointAuthMethods` | Collection<String> | | Of the OP plugin. `none` for public wallets, `attest_jwt_client_auth` for Wallet Attestation. |
+| `dpopProofNonceGenerator` | Function | | Of the OP plugin. `#{null}` for no DPoP nonce. |
+| `inboundInterceptorFlows` | List<String> | | Interceptor flows run after the request is decoded, before authentication. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
+| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the inbound message before authentication and on the outbound one before encoding. |
#### OpenID.VCI.Credentials
@@ -1696,6 +1690,11 @@ Endpoint `/idp/profile/openid/vci/credentials`, profile ID `http://geant.org/ns/
| `proofClaimsValidator` | ClaimsValidator | **openidvci.DefaultProofBodyClaimsValidator** | Validation of key proof claims. |
| `proofNonceGenerator` | Function<ProfileRequestContext,String> | **openidvci.DefaultOpenIDVCINonceGenerator** | Nonce a key proof has to carry. Same generator as in **OpenID.VCI.Nonce**. `#{null}` in both for no nonce. |
| `batchSize` | Integer | `2` | Largest number of key proofs in one request. Not read when the Credential Issuer metadata has `batch_credential_issuance`, its `batch_size` is used. Property `openidvci.batchSize`. |
+| `keyAttestationClaimsValidator` | ClaimsValidator | bean **openidvci.KeyAttestationClaimsValidator** if defined | Validation of key attestation claims, `nonce` among them. |
+| `dpopProofNonceGenerator` | Function | | Of the OP plugin. `#{null}` for no DPoP nonce. |
+| `inboundInterceptorFlows` | List<String> | | Interceptor flows run after the request is decoded, before authentication. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
+| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the inbound message before authentication and on the outbound one before encoding. |
#### OpenID.VCI.Nonce
@@ -1704,6 +1703,8 @@ Endpoint `/idp/profile/openid/vci/nonce`, profile ID `http://geant.org/ns/profil
| Name | Type | Default | Description |
|---|---|---|---|
| `proofNonceGenerator` | Function<ProfileRequestContext,String> | **openidvci.DefaultOpenIDVCINonceGenerator** | Generator of the nonce. Same as in **OpenID.VCI.Credentials**. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
+| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the outbound message before encoding. |
#### OAuth.StatusList
@@ -1712,6 +1713,7 @@ Endpoint `/idp/profile/oauth/status-list/list`, profile ID `http://geant.org/ns/
| Name | Type | Default | Description |
|---|---|---|---|
| `statusListSignatureSigningConfiguration` | SignatureSigningConfiguration | **openidvci.status-list.SigningConfiguration** | Signing of Status List Tokens. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
Request, a `GET` with `id`, the month and the issuer tag as in the `uri` of a credential. Response
is `application/statuslist+jwt`. A month that has ended is `410 retired_status_list`, a value
@@ -1721,7 +1723,14 @@ that is not a month `404 unknown_status_list`.
Endpoint `/idp/profile/oauth/status-list/assignments`, profile ID `http://geant.org/ns/profiles/oauth/status-list/assignments`.
-No settings of this plugin. Request, a `POST` of `application/json`:
+| Name | Type | Default | Description |
+|---|---|---|---|
+| `tokenEndpointAuthMethods` | Collection<String> | | Of the OP plugin. Client authentication of the caller, `client_secret_basic` for instance. |
+| `inboundInterceptorFlows` | List<String> | | Interceptor flows run after the request is decoded, before authentication. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
+| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the inbound message before authentication and on the outbound one before encoding. |
+
+Request, a `POST` of `application/json`:
| Name | Type | Description |
|---|---|---|
@@ -1735,7 +1744,14 @@ Response has `records`, `next` and `high_water`. Give `next` as `from` of the ne
Endpoint `/idp/profile/oauth/status-list/revoke`, profile ID `http://geant.org/ns/profiles/oauth/status-list/revoke`.
-No settings of this plugin. Request, a `POST` of `application/json`, success is `204 No Content`:
+| Name | Type | Default | Description |
+|---|---|---|---|
+| `tokenEndpointAuthMethods` | Collection<String> | | Of the OP plugin. Client authentication of the caller, `client_secret_basic` for instance. |
+| `inboundInterceptorFlows` | List<String> | | Interceptor flows run after the request is decoded, before authentication. |
+| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
+| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the inbound message before authentication and on the outbound one before encoding. |
+
+Request, a `POST` of `application/json`, success is `204 No Content`:
| Name | Type | Description |
|---|---|---|
@@ -1743,15 +1759,6 @@ No settings of this plugin. Request, a `POST` of `application/json`, success is
| `idx` | Integer | The slot, `0` to `1048575`. |
| `client_id` | String | Only where unauthenticated callers are accepted. |
-#### OP plugin settings used with this plugin
-
-| Profile | Name | Value |
-|---|---|---|
-| **OIDC.SSO** | `authorizationCodeClaimsSetManipulationStrategy` | **openidvci.TokenManipulationStrategy** |
-| **OIDC.SSO** | `forcePKCE`, `requirePushedAuthorizationRequest` | `true` for DIIP and HAIP |
-| **OIDC.SSO** | `includeIssuerInResponse` | `true` for HAIP |
-| **OAUTH2.PAR** | `tokenEndpointAuthMethods` | same as the token endpoint of the wallet |
-
### Credential Configuration settings
**File(s):** *metadata/verifiable-credentials.json*
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list