[java-idp-plugin-vci] 03/05: Authorization code lifetime per HAIP

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/FAPI
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/f354e2e84adff68873e70b744a280ce91065a674

commit f354e2e84adff68873e70b744a280ce91065a674
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Mon Sep 28 17:37:49 2026 +0300

    Authorization code lifetime per HAIP
---
 README.md | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index b6fa79d..394e2f6 100644
--- a/README.md
+++ b/README.md
@@ -1554,7 +1554,12 @@ being the alias of your test plan:
 </details>
 
 In *conf/relying-party.xml* PKCE and PAR are required, `iss` is returned in the authorization
-response and both token and PAR endpoints take the Wallet Attestation:
+response, the authorization code lives one minute and both token and PAR endpoints take the
+Wallet Attestation. HAIP requires the Credential Issuer to follow
+[FAPI 2.0](https://openid.net/specs/fapi-security-profile-2_0-final.html), and
+[FAPI 2.0 5.3.2.1](https://openid.net/specs/fapi-security-profile-2_0-final.html#section-5.3.2.1)
+allows an authorization code at most 60 seconds. The OP plugin default is five minutes, property
+`idp.oidc.authorizeCode.defaultLifetime`:
 
 <details>
 <summary>Example snippet of conf/relying-party.xml</summary>
@@ -1569,7 +1574,7 @@ response and both token and PAR endpoints take the Wallet Attestation:
                   <bean parent="OIDC.SSO"
                         p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
                         p:forcePKCE="true" p:requirePushedAuthorizationRequest="true"
-                        p:includeIssuerInResponse="true" />
+                        p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
                   <bean parent="OpenID.VCI.Token"
                         p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
                         p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}" />
@@ -2490,7 +2495,7 @@ The file as it is at the end of [First installation, by example](#first-installa
                   <bean parent="OIDC.SSO"
                         p:authorizationCodeClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
                         p:forcePKCE="true" p:requirePushedAuthorizationRequest="true"
-                        p:includeIssuerInResponse="true" />
+                        p:includeIssuerInResponse="true" p:authorizeCodeLifetime="PT1M" />
                   <bean parent="OpenID.VCI.Token"
                         p:accessTokenClaimsSetManipulationStrategy-ref="openidvci.TokenManipulationStrategy"
                         p:tokenEndpointAuthMethods="#{{'attest_jwt_client_auth'}}" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.