[java-idp-plugin-vci] branch main updated: Improve readability

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/a12ee0af2b35e0370dd0746acbb74b21d8306022

The following commit(s) were added to refs/heads/main by this push:
     new a12ee0a  Improve readability
a12ee0a is described below

commit a12ee0af2b35e0370dd0746acbb74b21d8306022
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Wed Sep 30 21:24:57 2026 +0300

    Improve readability
---
 README.md | 44 +++++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index ec87e06..215c6b9 100644
--- a/README.md
+++ b/README.md
@@ -1709,32 +1709,34 @@ A wallet names the credential it wants in the
   [token response](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-successful-token-response). It names one Credential Dataset of a
   configuration.
 
-The wallet uses `credential_identifier` when the token response has `credential_identifiers`, and
-`credential_configuration_id` otherwise. By default nothing needs configuring, the simple path of
+If the token response has `credential_identifiers`, the wallet uses `credential_identifier`.
+Otherwise it uses `credential_configuration_id`. By default you need to configure nothing. The
 [First installation](#first-installation-by-example) uses `credential_configuration_id` only.
 
 What you control:
 
-- **What a code flow wallet may ask for.** The wallet asks a credential by
+- **What a code flow wallet may ask for.** The wallet asks for a credential by
   [`scope`](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-scope-parameter-to-re) or by
-  [`authorization_details`](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-authorization-details). For `scope`, give the
-  configuration a `scope` in *metadata/verifiable-credentials.json* and allow it for the client in
-  *metadata/oidc-client.json*. The access token covers only the configurations whose `scope` was
-  granted and those the wallet named in `authorization_details`, whatever else the attribute filter
-  released. A configuration without `scope` can be asked only with `authorization_details`.
-- **When identifiers are issued.** The token response has `credential_identifiers` for a
-  configuration the wallet asked with `authorization_details`, in the authorization request, also a
-  pushed one, or in the token request, and for an authorized configuration that has several
-  credentials for the user, see
-  [Several credentials of one configuration](#several-credentials-of-one-configuration). Otherwise
-  it has none, and most wallets, which use `credential_configuration_id` only, work as they are.
-- **Wallets that ignore the identifiers.** Once identifiers were issued, the credential endpoint
-  accepts only those and refuses `credential_configuration_id`, as
-  [Section 8.2](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request) requires. Some wallets ask with
-  `authorization_details` and still send `credential_configuration_id`. To accept that, set
-  `allowCredentialConfigurationIdWithIdentifiers` on the credentials profile of those wallets. It
-  does not help with a configuration of several credentials, there the configuration id cannot tell
-  which one.
+  [`authorization_details`](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-using-authorization-details).
+  For `scope`, give the configuration a `scope` in *metadata/verifiable-credentials.json*. Then
+  allow the scope for the client in *metadata/oidc-client.json*. A configuration without `scope`
+  can be asked for only with `authorization_details`.
+- **When identifiers are issued.** The token response has `credential_identifiers` in two cases:
+  - The wallet asked for the configuration with `authorization_details`. It may be in the
+    authorization request, in the pushed authorization request or in the token request.
+  - The user has several credentials of one configuration, see
+    [Several credentials of one configuration](#several-credentials-of-one-configuration).
+
+  In other cases the token response has no `credential_identifiers`. Most wallets use
+  `credential_configuration_id` only, and they work without changes.
+- **Wallets that ignore the identifiers.** If the token response had identifiers, the credential
+  endpoint accepts only them. It refuses `credential_configuration_id`, as
+  [Section 8.2](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request)
+  requires. Some wallets ask with `authorization_details` but still send
+  `credential_configuration_id`. To accept that, set
+  `allowCredentialConfigurationIdWithIdentifiers` on the credentials profile of those wallets.
+  This does not help when the user has several credentials of one configuration. Then the
+  configuration id does not tell which credential the wallet wants.
 
 ```xml
 <bean parent="RelyingPartyByName" c:relyingPartyIds="offer-caller/wallet">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.