openid-data-classes/at.asitplus.openid

Package-level declarations

Types

@Serializable

data class AuthenticationRequestParameters(val responseType: String? = null, val clientId: String? = null, val redirectUrl: String? = null, val scope: String? = null, val state: String? = null, val nonce: String? = null, val walletNonce: String? = null, val claims: AuthnRequestClaims? = null, val clientMetadata: RelyingPartyMetadata? = null, val idTokenHint: String? = null, val idTokenType: String? = null, val presentationDefinition: PresentationDefinition? = null, val presentationDefinitionUrl: String? = null, val dcqlQuery: DCQLQuery? = null, val authorizationDetails: Set<AuthorizationDetails>? = null, val walletIssuer: String? = null, val userHint: String? = null, val issuerState: String? = null, val responseMode: OpenIdConstants.ResponseMode? = null, val responseUrl: String? = null, val audience: String? = null, val issuer: String? = null, val issuedAt: Instant? = null, val resource: String? = null, val codeChallenge: String? = null, val codeChallengeMethod: String? = null, val lang: String? = null, val credentialID: ByteArray? = null, val signatureQualifier: SignatureQualifier? = null, val numSignatures: Int? = null, val hashes: Hashes? = null, val hashAlgorithmOid: ObjectIdentifier? = null, val description: String? = null, val accountToken: JsonWebToken? = null, val clientData: String? = null, val transactionData: List<TransactionDataBase64Url>? = null, val expectedOrigins: List<String>? = null, val verifierInfo: List<VerifierInfo>? = null) : RequestParameters

Contents of an OIDC Authentication Request.

AuthenticationResponseParameters

@Serializable

data class AuthenticationResponseParameters(val code: String? = null, val idToken: String? = null, val vpToken: JsonElement? = null, val presentationSubmission: PresentationSubmission? = null, val state: String? = null, val issuer: String? = null, val audience: String? = null, val expiration: Instant? = null, val response: String? = null)

Contents of an OIDC Authentication Response.

AuthnRequestClaims

@Serializable

data class AuthnRequestClaims(val idTokenMap: Map<String, AuthnRequestSingleClaim?>? = null, val userInfoMap: Map<String, AuthnRequestSingleClaim?>? = null)

AuthnRequestSingleClaim

@Serializable

data class AuthnRequestSingleClaim(val essential: Boolean? = null, val value: String? = null, val values: Array<String>? = null)

AuthorizationDetails

@Serializable

sealed class AuthorizationDetails

BatchCredentialIssuanceMetadata

@Serializable

data class BatchCredentialIssuanceMetadata(val batchSize: Int)

ClaimDescription

@Serializable

data class ClaimDescription(val path: List<String>, val mandatory: Boolean? = null, val display: Set<DisplayProperties>? = null)

ClientNonceResponse

@Serializable

data class ClientNonceResponse(val clientNonce: String)

CredentialFormatEnum

@Serializable(with = CredentialFormatSerializer::class)

enum CredentialFormatEnum : Enum<CredentialFormatEnum>

CredentialFormatSerializer

object CredentialFormatSerializer : KSerializer<CredentialFormatEnum>

CredentialMetadata

@Serializable

data class CredentialMetadata(val claimDescription: Set<ClaimDescription>? = null, val display: Set<DisplayProperties>? = null)

OID4VCI: Object containing information relevant to the usage and display of issued Credentials. Credential Format-specific mechanisms can overwrite the information in this object to convey Credential metadata. Format-specific mechanisms, such as SD-JWT VC display metadata are always preferred by the Wallet over the information in this object, which serves as the default fallback.

CredentialOffer

@Serializable

data class CredentialOffer(val credentialIssuer: String, val configurationIds: Collection<String>, val grants: CredentialOfferGrants? = null)

CredentialOfferGrants

@Serializable

data class CredentialOfferGrants(val authorizationCode: CredentialOfferGrantsAuthCode? = null, val preAuthorizedCode: CredentialOfferGrantsPreAuthCode? = null)

OID4VCI: Object indicating to the Wallet the Grant Types the Credential Issuer's Authorization Server is prepared to process for this Credential Offer. Every grant is represented by a name/value pair. The name is the Grant Type identifier; the value is an object that contains parameters either determining the way the Wallet MUST use the particular grant and/or parameters the Wallet MUST send with the respective request(s).

CredentialOfferGrantsAuthCode

@Serializable

data class CredentialOfferGrantsAuthCode(val issuerState: String? = null, val authorizationServer: String? = null)

CredentialOfferGrantsPreAuthCode

@Serializable

data class CredentialOfferGrantsPreAuthCode(val preAuthorizedCode: String, val transactionCode: CredentialOfferGrantsPreAuthCodeTransactionCode? = null, val waitIntervalSeconds: Int? = 5, val authorizationServer: String? = null)

CredentialOfferGrantsPreAuthCodeTransactionCode

@Serializable

data class CredentialOfferGrantsPreAuthCodeTransactionCode(val inputMode: String? = "numeric", val length: Int? = null, val description: String? = null)

CredentialOfferUrlParameters

@Serializable

data class CredentialOfferUrlParameters(val credentialOffer: JsonObject? = null, val credentialOfferUrl: String? = null)

OID4VCI: The Credential Issuer sends Credential Offer using an HTTP GET request or an HTTP redirect to the Wallet's Credential Offer Endpoint defined in Section 11.1.The Credential Offer object, which is a JSON-encoded object with the Credential Offer parameters, can be sent by value or by reference.

CredentialRequestParameters

@Serializable

data class CredentialRequestParameters(val credentialIdentifier: String? = null, val credentialConfigurationId: String? = null, val credentialResponseEncryption: CredentialResponseEncryption? = null, val proofs: CredentialRequestProofContainer? = null)

CredentialRequestProofContainer

@Serializable

data class CredentialRequestProofContainer(val jwt: Set<String>? = null, val attestation: Set<String>? = null)

CredentialRequestProofSupported

@Serializable

data class CredentialRequestProofSupported(val supportedSigningAlgorithms: Collection<String>? = null, val keyAttestationRequired: KeyAttestationRequired? = null)

CredentialResponseEncryption

@Serializable

data class CredentialResponseEncryption(val jsonWebKey: JsonWebKey, val jweAlgorithm: JweAlgorithm? = null, val jweEncryptionString: String)

CredentialResponseParameters

@Serializable

data class CredentialResponseParameters(val credentials: Set<CredentialResponseSingleCredential>? = null, val transactionId: String? = null, val interval: Duration? = null, val notificationId: String? = null)

CredentialResponseSingleCredential

@Serializable

data class CredentialResponseSingleCredential(val credential: JsonElement)

CredentialSubjectMetadataSingle

@Serializable

data class CredentialSubjectMetadataSingle(val mandatory: Boolean? = null, val valueType: String? = null, val display: Set<DisplayProperties>? = null)

OID4VCI: W3C VC: To express the specifics about the claim, the most deeply nested value MAY be an object that includes the following parameters defined by this specification (other parameters MAY also be used).

CscAuthorizationDetails

@Serializable

@SerialName(value = "credential")

data class CscAuthorizationDetails(val credentialID: String? = null, val signatureQualifier: SignatureQualifier? = null, val documentDigests: Collection<OAuthDocumentDigest>, val hashAlgorithmOid: ObjectIdentifier, val locations: Collection<String>? = null, val documentLocations: Collection<DocumentLocation>? = null) : AuthorizationDetails

CSC-API v2.0.0.2 The authorization details type credential allows applications to pass the details of a certain credential authorization in a single JSON object

DCQLQueryStringTransformingSerializer

object DCQLQueryStringTransformingSerializer : KSerializer<DCQLQuery>

DisplayLogoProperties

@Serializable

data class DisplayLogoProperties(val url: String? = null, val uri: String? = null, val altText: String? = null)

OID4VCI: OPTIONAL. Object with information about the logo of the Credential.

DisplayProperties

@Serializable

data class DisplayProperties(val name: String? = null, val locale: String? = null, val logo: DisplayLogoProperties? = null, val description: String? = null, val backgroundColor: String? = null, val backgroundImage: DisplayLogoProperties? = null, val textColor: String? = null)

OID4VCI: OPTIONAL. A non-empty array of objects, where each object contains the display properties of the supported Credential for a certain language.

DurationSecondsIntSerializer

object DurationSecondsIntSerializer : KSerializer<Duration>

IdToken

@Serializable

data class IdToken(val issuer: String, val audience: String, val issuedAt: Instant, val expiration: Instant, val subject: String, val nonce: String, val subjectJwk: JsonWebKey? = null)

OpenID Connect ID Token, usually signed as JWS in id_token in a URL

IdTokenType

@Serializable(with = IdTokenTypeSerializer::class)

enum IdTokenType : Enum<IdTokenType>

IdTokenTypeSerializer

object IdTokenTypeSerializer : KSerializer<IdTokenType>

IssuerMetadata

@Serializable

data class IssuerMetadata(val issuer: String? = null, val credentialIssuer: String, val authorizationServers: Set<String>? = null, val credentialEndpointUrl: String, val nonceEndpointUrl: String? = null, val deferredCredentialEndpointUrl: String? = null, val notificationEndpointUrl: String? = null, val credentialResponseEncryption: SupportedAlgorithmsContainer? = null, val credentialRequestEncryption: SupportedAlgorithmsContainer? = null, val batchCredentialIssuance: BatchCredentialIssuanceMetadata? = null, val displayProperties: Set<DisplayProperties>? = null, val supportedCredentialConfigurations: Map<String, SupportedCredentialFormat>? = null)

Metadata about the credential issuer in OpenID4VCI

JarRequestParameters

@Serializable

data class JarRequestParameters(val clientId: String? = null, val request: String? = null, val requestUri: String? = null, val requestUriMethod: JarRequestParameters.RequestUriMethod? = null, val state: String? = null) : RequestParameters

JsonObjectStringEncodedSerializer

class JsonObjectStringEncodedSerializer<T>(val serializer: KSerializer<T>) : KSerializer<T>

JwsSignedSerializer

object JwsSignedSerializer : KSerializer<JwsSigned<*>>

Class that de-/serializes JwsSigned without respecting the generic type

JwtVcIssuerMetadata

@Serializable

data class JwtVcIssuerMetadata(val issuer: String, val jsonWebKeySet: JsonWebKeySet? = null, val jsonWebKeySetUrl: String? = null)

Metadata about the credential issuer in SD-JWT VC

KeyAttestationRequired

@Serializable

data class KeyAttestationRequired(val keyStorage: Collection<String>? = null, val userAuthentication: Collection<String>? = null)

OAuth2AuthorizationServerMetadata

@Serializable

data class OAuth2AuthorizationServerMetadata(val issuer: String, val authorizationEndpoint: String? = null, val userInfoEndpoint: String? = null, val pushedAuthorizationRequestEndpoint: String? = null, val requirePushedAuthorizationRequests: Boolean? = null, val tokenEndpoint: String? = null, val jsonWebKeySetUrl: String? = null, val registrationEndpoint: String? = null, val scopesSupported: Set<String>? = null, val responseTypesSupported: Set<String>? = null, val responseModesSupported: Set<String>? = null, val grantTypesSupported: Set<String>? = null, val tokenEndPointAuthMethodsSupported: Set<String>? = null, val tokenEndPointAuthSigningAlgValuesSupported: Set<String>? = null, val subjectTypesSupported: Set<String>? = null, val idTokenSigningAlgorithmsSupportedStrings: Set<String>? = null, val requestObjectSigningAlgorithmsSupportedStrings: Set<String>? = null, val requireSignedRequestObject: Boolean? = null, val subjectSyntaxTypesSupported: Set<String>? = null, val idTokenTypesSupported: Set<IdTokenType>? = null, val presentationDefinitionUriSupported: Boolean = true, val vpFormatsSupported: VpFormatsSupported? = null, val clientIdSchemesSupported: Set<String>? = null, val clientIdPrefixesSupported: Set<String>? = null, val dpopSigningAlgValuesSupportedStrings: Set<String>? = null, val serviceDocumentation: String? = null, val uiLocalesSupported: Set<String>? = null, val opPolicyUri: String? = null, val opTosUri: String? = null, val revocationEndpoint: String? = null, val revocationEndpointAuthMethodsSupported: Set<String>? = null, val revocationEndpointAuthSigningAlgValuesSupported: Set<String>? = null, val introspectionEndpoint: String? = null, val introspectionEndpointAuthMethodsSupported: Set<String>? = null, val introspectionEndpointAuthSigningAlgValuesSupported: Set<String>? = null, val codeChallengeMethodsSupported: Set<String>? = null)

This implements RFC8414 All descriptions taken from section 2.

OidcAddressClaim

@Serializable

data class OidcAddressClaim(val formatted: String? = null, val street: String? = null, val locality: String? = null, val region: String? = null, val postalCode: String? = null, val country: String? = null)

OpenID Connect Core 1.0

OidcUserInfo

@Serializable

data class OidcUserInfo(val subject: String, val name: String? = null, val givenName: String? = null, val familyName: String? = null, val middleName: String? = null, val nickname: String? = null, val preferredUsername: String? = null, val profile: String? = null, val picture: String? = null, val website: String? = null, val email: String? = null, val emailVerified: Boolean? = null, val gender: String? = null, val birthDate: String? = null, val timezone: String? = null, val locale: String? = null, val phoneNumber: String? = null, val phoneNumberVerified: Boolean? = null, val address: OidcAddressClaim? = null, val ageOver18: Boolean? = null, val updatedAt: Instant? = null)

OpenID Connect Core 1.0

OidcUserInfoExtended

@Serializable

data class OidcUserInfoExtended(val userInfo: OidcUserInfo, val jsonObject: JsonObject)

Holds a deserialized OidcUserInfo as well as a JsonObject with other properties, that could not been parsed into our data class OidcUserInfo. Will be used as a container to represent an authenticated user during the issuing process.

OpenIdAuthorizationDetails

@Serializable

@SerialName(value = "openid_credential")

data class OpenIdAuthorizationDetails(val credentialConfigurationId: String? = null, val claimDescription: Set<ClaimDescription>? = null, val locations: Set<String>? = null, val credentialIdentifiers: Set<String>? = null) : AuthorizationDetails

OID4VCI: The request parameter authorization_details defined in Section 2 of (RFC9396) MUST be used to convey the details about the Credentials the Wallet wants to obtain. This specification introduces a new authorization details type openid_credential and defines the following parameters to be used with this authorization details type.

OpenIdConstants

object OpenIdConstants

PushedAuthenticationResponseParameters

@Serializable

data class PushedAuthenticationResponseParameters(val requestUri: String? = null, val expires: Duration? = null)

Contents of a response to a pushed authorization request, see OAuth 2.0 Pushed Authorization Requests

QCertCreationAcceptance

@Serializable

@SerialName(value = "qcert_creation_acceptance")

data class QCertCreationAcceptance(val qcTermsConditionsUri: String, val qcHash: ByteArray, val qcHashAlgorithmOid: ObjectIdentifier, val credentialIds: Set<String>, val transactionDataHashAlgorithms: Set<String>? = null) : TransactionData

D3.1: UC Specification WP3: Transaction data entry used to gather the user’s consent to the terms of service of the Verifier (e.g. the QTSP)

QesAuthorization

@Serializable

@SerialName(value = "qes_authorization")

data class QesAuthorization(val signatureQualifier: SignatureQualifier? = null, val credentialID: String? = null, val documentDigests: List<RqesDocumentDigestEntry>, val processID: String? = null, val credentialIds: Set<String>, val transactionDataHashAlgorithms: Set<String>? = null) : TransactionData

D3.1: UC Specification WP3: Transaction data entry used to authorize a qualified electronic signature

RelyingPartyMetadata

@Serializable

data class RelyingPartyMetadata(val redirectUris: List<String>? = null, val jsonWebKeySet: JsonWebKeySet? = null, val jsonWebKeySetUrl: String? = null, val idTokenSignedResponseAlgString: String? = null, val authorizationEncryptedResponseAlgString: String? = null, val authorizationEncryptedResponseEncodingString: String? = null, val encryptedResponseEncValuesSupportedString: Set<String>? = null, val idTokenEncryptedResponseAlgString: String? = null, val idTokenEncryptedResponseEncodingString: String? = null, val subjectSyntaxTypesSupported: Set<String>? = null, val vpFormatsSupported: VpFormatsSupported? = null, val clientIdScheme: OpenIdConstants.ClientIdScheme? = OpenIdConstants.ClientIdScheme.PreRegistered)

RequestObjectParameters

@Serializable

data class RequestObjectParameters(val walletMetadataString: String? = null, val walletNonce: String? = null) : RequestParameters

OpenID4VP: This request is (optionally) sent from the wallet when requesting the Request Object from the Verifier.

RequestParameters

@Serializable(with = RequestParametersSerializer::class)

sealed class RequestParameters

Any set of parameters that might need complex parsing. See at.asitplus.wallet.lib.openid.RequestParser Uses open serialization in order to avoid type-discriminator in serialization

RequestParametersFrom

@Serializable(with = RequestParametersFromSerializer::class)

sealed class RequestParametersFrom<S : RequestParameters>

RequestParametersFromSerializer

class RequestParametersFromSerializer<T : RequestParameters>(parameterSerializer: KSerializer<T>) : KSerializer<RequestParametersFrom<T>>

In order to de-/serialize generic types we need a kind of factory approach Because we deal with a sealed class we can use an intermediary jsonSerializer, find the correct object and the specific type of the generic type and then finalize the serialization

RequestParametersSerializer

object RequestParametersSerializer : JsonContentPolymorphicSerializer<RequestParameters>

TODO RequestObjectParameters can never be serialized into! (needs non-nullable field in either AuthenticationRequestParameters or RequestObjectParameters)

ResponseParametersFrom

sealed class ResponseParametersFrom

Intermediate class to transport the source of parsed AuthenticationResponseParameters

SignatureRequestParameters

@Serializable

data class SignatureRequestParameters(val responseType: String, val clientId: String, val clientIdScheme: OpenIdConstants.ClientIdScheme? = null, val responseMode: OpenIdConstants.ResponseMode? = null, val responseUrl: String? = null, val nonce: String? = null, val state: String? = null, val signatureQualifier: SignatureQualifier = SignatureQualifier.EU_EIDAS_QES, val documentDigests: List<OAuthDocumentDigest>, val documentLocations: List<DocumentLocation>, val hashAlgorithmOid: ObjectIdentifier = Digest.SHA256.oid, val clientData: String? = null, val transactionData: List<TransactionDataBase64Url>? = null) : RequestParameters

In the Wallet centric model this is the request coming from the Driving application to the wallet which starts the process

SupportedAlgorithmsContainer

@Serializable

data class SupportedAlgorithmsContainer(val supportedAlgorithmsStrings: Set<String>? = null, val supportedEncryptionAlgorithmsStrings: Set<String>? = null, val encryptionRequired: Boolean? = null, val jsonWebKeySet: JsonWebKeySet? = null)

SupportedAlgorithmsContainerIso

@Serializable

data class SupportedAlgorithmsContainerIso(val issuerAuthAlgorithmInts: Set<Int>? = null, val deviceAuthAlgorithmInts: Set<Int>? = null)

SupportedAlgorithmsContainerJwt

@Serializable

data class SupportedAlgorithmsContainerJwt(val algorithmStrings: Set<String>? = null)

SupportedAlgorithmsContainerSdJwt

@Serializable

data class SupportedAlgorithmsContainerSdJwt(val sdJwtAlgorithmStrings: Set<String>? = null, val kbJwtAlgorithmStrings: Set<String>? = null)

SupportedCredentialFormat

@Serializable

data class SupportedCredentialFormat

OID4VCI: Object that describes specifics of the Credential that the Credential Issuer supports issuance of. This object contains a list of name/value pairs, where each name is a unique identifier of the supported Credential being described. This identifier is used in the Credential Offer to communicate to the Wallet which Credential is being offered.

SupportedCredentialFormatDefinition

@Serializable

data class SupportedCredentialFormatDefinition(val types: Set<String>? = null)

OID4VCI: W3C VC: REQUIRED. Object containing the detailed description of the Credential type. It consists of at least the following two parameters: type, credentialSubject`.

TokenIntrospectionRequest

@Serializable

data class TokenIntrospectionRequest(val token: String, val tokenTypeHint: String? = null)

RFC 7662: OAuth 2.0 Token Introspection: Request.

TokenIntrospectionResponse

@Serializable

data class TokenIntrospectionResponse(val active: Boolean, val scope: String? = null, val clientId: String? = null, val username: String? = null, val tokenType: String? = null, val expiration: Instant? = null, val issuedAt: Instant? = null, val notBefore: Instant? = null, val subject: String? = null, val audience: String? = null, val issuer: String? = null, val jwtId: String? = null, val authorizationDetails: Set<AuthorizationDetails>? = null)

RFC 7662: OAuth 2.0 Token Introspection: Response.

TokenRequestParameters

@Serializable

data class TokenRequestParameters(val grantType: String, val code: String? = null, val scope: String? = null, val resource: String? = null, val audience: String? = null, val requestedTokenType: String? = null, val subjectToken: String? = null, val subjectTokenType: String? = null, val actorToken: String? = null, val actorTokenType: String? = null, val refreshToken: String? = null, val redirectUrl: String? = null, val clientId: String? = null, val authorizationDetails: Set<AuthorizationDetails>? = null, val preAuthorizedCode: String? = null, val transactionCode: String? = null, val codeVerifier: String? = null, val clientData: String? = null)

TokenResponseParameters

@Serializable

data class TokenResponseParameters(val accessToken: String, val refreshToken: String? = null, val tokenType: String, val expires: Duration? = null, val scope: String? = null, val authorizationPending: Boolean? = null, val interval: Duration? = null, val authorizationDetails: Set<AuthorizationDetails>? = null, val credentialId: String? = null)

TransactionData

@Serializable

sealed class TransactionData

OID4VP Draft 24: OPTIONAL. Array of strings, where each string is a base64url encoded JSON object that contains a typed parameter set with details about the transaction that the Verifier is requesting the End-User to authorize.

TransactionDataBase64Url

typealias TransactionDataBase64Url = JsonPrimitive

Denotes a JSON string containing a Base64Url encoded TransactionData element This is useful in classes defined in OpenID4VP since JSON string representation is not strongly standardized (normal vs pretty-print etc) so de-/serialization between different parties with different serializer settings may lead to erroneous request rejection.

UrlSerializer

object UrlSerializer : KSerializer<Url>

VerifierInfo

@Serializable

data class VerifierInfo(val format: String, val data: String, val credentialIds: Set<String>)

OID4VP 1.0: OPTIONAL. A non-empty array of attestations about the Verifier relevant to the Credential Request. These attestations MAY include Verifier metadata, policies, trust status, or authorizations. Attestations are intended to support authorization decisions, inform Wallet policy enforcement, or enrich the End-User consent dialog.

VpFormatsSupported

@Serializable

data class VpFormatsSupported(val vcJwt: SupportedAlgorithmsContainerJwt? = null, val dcSdJwt: SupportedAlgorithmsContainerSdJwt? = null, val msoMdoc: SupportedAlgorithmsContainerIso? = null)

OID4VP: An object containing a list of name/value pairs, where the name is a Credential Format Identifier and the value defines format-specific parameters that a Wallet supports. For specific values that can be used, see Appendix B. Deployments can extend the formats supported, provided Issuers, Holders and Verifiers all understand the new format.

Functions

digest

fun TransactionDataBase64Url.digest(digest: Digest): ByteArray

OID4VP: TransactionData is Base64URL encoded but the hash is taken over the string itself and should not be Base64URL decoded before computing the hash. See lengthy discussion here

truncateToSeconds

fun Instant.truncateToSeconds(): Instant

Truncate to seconds, i.e., strip milliseconds.