vck-openid-ktor/at.asitplus.wallet.lib.ktor.openid/OpenId4VpKtorHolder

OpenId4VpKtorHolder

class OpenId4VpKtorHolder(httpClient: HttpClient, keyMaterial: KeyMaterial, holder: Holder, encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { OpenId4VpHolder.DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false, relyingPartyValidator: RelyingPartyValidator = RelyingPartyValidator())(source)

Implements the wallet side of Self-Issued OpenID Provider v2 and OpenID for Verifiable Presentations with ktor, by sending the requests of OpenId4VpProtocolClient, which implements the protocol.

The parameters after httpClient are passed on to OpenId4VpHolder, see there.

Constructors

OpenId4VpKtorHolder

constructor(httpClient: HttpClient, keyMaterial: KeyMaterial, holder: Holder, encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { OpenId4VpHolder.DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false, relyingPartyValidator: RelyingPartyValidator = RelyingPartyValidator())

constructor(httpClient: HttpClient, keyMaterial: KeyMaterial, holder: Holder, encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", relyingPartyTrust: Set<RelyingPartyTrust>?, walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { OpenId4VpHolder.DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false)

constructor(engine: HttpClientEngine, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, keyMaterial: KeyMaterial, holderAgent: HolderAgent, randomSource: RandomSource = RandomSource.Secure, allowedDcApiOriginSchemes: suspend () -> Set<String> = { OpenId4VpHolder.DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, relyingPartyTrust: Set<RelyingPartyTrust>? = null, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, requireEncryptedRequests: Boolean = false)

Types

AuthenticationForward

data class AuthenticationForward(val authenticationResponseResult: AuthenticationResponseResult.DcApi) : OpenId4VpKtorHolder.AuthenticationResult

AuthenticationResult

sealed interface AuthenticationResult

AuthenticationSuccess

data class AuthenticationSuccess(val redirectUri: String? = null) : OpenId4VpKtorHolder.AuthenticationResult

FormDataContentPlain

class ~~FormDataContentPlain~~(formData: Parameters) : OutgoingContent.ByteArrayContent

Our implementation of ktor's FormDataContent, but with contentType without charset appended, so that some strict mDoc verifiers accept our authn response

Properties

dcApiHolder

val dcApiHolder: DcApiHolder

iso180137AnnexCHolder

val iso180137AnnexCHolder: Iso180137AnnexCHolder

openId4VpHolder

val openId4VpHolder: OpenId4VpHolder

Functions

finalizeAuthorizationResponse

suspend fun finalizeAuthorizationResponse(preparationState: AuthorizationResponsePreparationState, credentialPresentation: CredentialPresentation? = null): KmmResult<OpenId4VpKtorHolder.AuthenticationResult>

Calls openId4VpHolder to finalize the authentication response. In case the result shall be POSTed to the verifier, we call client to do that, and return the redirect_uri of that POST (which the Wallet may open in a browser), see OpenId4VpProtocolClient.sendAuthorizationResponse. In case the result shall be sent as a redirect to the verifier, we return that URL. In case the result shall be returned via the Digital Credentials API, an AuthenticationForward will be returned with the result to be forwarded.

finalizeDcApiResponse

suspend fun finalizeDcApiResponse(state: DcApiPreparationState, credentialPresentation: CredentialPresentation? = null): KmmResult<DigitalCredentialInterface>

Finalizes state into a platform-independent Digital Credentials API response model.

getMatchingCredentials

suspend fun getMatchingCredentials(preparationState: AuthorizationResponsePreparationState): KmmResult<CredentialMatchingResult<SubjectCredentialStore.StoreEntry>>

Exceptions may be sent to the verifier in sendAuthnErrorResponse.

suspend fun getMatchingCredentials(state: DcApiPreparationState): KmmResult<CredentialMatchingResult<SubjectCredentialStore.StoreEntry>>

Matches credentials through the protocol handler captured by state.

prepareDcApiRequest

suspend fun prepareDcApiRequest(request: RequestParametersFrom.DcApiRequest): KmmResult<DcApiPreparationState>

Prepares either an OpenID4VP or Annex C request received through the Digital Credentials API.

suspend fun prepareDcApiRequest(request: RequestParametersFrom.DcApiRequest, policy: ValidationPolicy): KmmResult<DcApiRequestValidation>

Prepares either an OpenID4VP or Annex C request received through the Digital Credentials API under policy, returning its report next to the state, see DcApiHolder.startAuthorizationResponsePreparation: null only for an Annex C request without registration certificates. A rejected request is a successful result.

sendAuthnErrorResponse

suspend fun sendAuthnErrorResponse(error: Throwable, state: AuthorizationResponsePreparationState)

Sends an error response with the appropriate method. Returns nothing as we don't expect a useful response from the remote verifier.

startAuthorizationResponsePreparation

suspend fun startAuthorizationResponsePreparation(request: RequestParametersFrom<AuthenticationRequestParameters>): KmmResult<AuthorizationResponsePreparationState>

suspend fun startAuthorizationResponsePreparation(input: String): KmmResult<AuthorizationResponsePreparationState>

Parses input, loads the request object, and validates the request, see OpenId4VpProtocolClient.prepareAuthorizationResponse.

suspend fun startAuthorizationResponsePreparation(request: RequestParametersFrom<AuthenticationRequestParameters>, policy: ValidationPolicy): KmmResult<AuthorizationRequestValidation>

Validates request under policy, returning its report next to the state, see OpenId4VpHolder.startAuthorizationResponsePreparation. A rejected request is a successful result with its report and state, so the wallet can show why, answer with sendAuthnErrorResponse, or continue after the user decided to. Its wallet_nonce is consumed, so validate a request once, with this method or the one without a policy, never with both.

suspend fun startAuthorizationResponsePreparation(input: String, policy: ValidationPolicy): KmmResult<AuthorizationRequestValidation>

Parses input, loads the request object, and validates the request under policy, returning its report next to the state, see OpenId4VpProtocolClient.prepareAuthorizationResponse. A rejected request is a successful result with its report and state; the result fails only for transport errors and input that can not be parsed. The wallet_nonce is consumed, so validate a request once, with this method or the one without a policy.

startPresentationReturningUrl

suspend fun startPresentationReturningUrl(request: RequestParametersFrom<AuthenticationRequestParameters>): KmmResult<OpenId4VpKtorHolder.AuthenticationSuccess>