vck-openid/at.asitplus.wallet.lib.oidvci

Package-level declarations

Types

@Serializable

data class AuthorizationDetails(val type: String, val credentialConfigurationId: String? = null, val format: CredentialFormatEnum? = null, val docType: String? = null, val claims: Map<String, Map<String, RequestedCredentialClaimSpecification>>? = null, val credentialDefinition: SupportedCredentialFormatDefinition? = null, val sdJwtVcType: String? = null, val locations: Set<String>? = null, val credentialIdentifiers: Set<String>? = null)

OID4VCI: The request parameter authorization_details defined in Section 2 of (RFC9396) MUST be used to convey the details about the Credentials the Wallet wants to obtain. This specification introduces a new authorization details type openid_credential and defines the following parameters to be used with this authorization details type.

CodeService

interface CodeService

CredentialFormatEnum

@Serializable(with = CredentialFormatSerializer::class)

enum CredentialFormatEnum : Enum<CredentialFormatEnum>

CredentialFormatSerializer

object CredentialFormatSerializer : KSerializer<CredentialFormatEnum>

CredentialIssuer

class CredentialIssuer(authorizationService: OAuth2AuthorizationServer, issuer: Issuer, credentialSchemes: Set<ConstantIndex.CredentialScheme>, publicContext: String = "https://wallet.a-sit.at/credential-issuer", credentialEndpointPath: String = "/credential", buildIssuerCredentialDataProviderOverride: (OidcUserInfoExtended) -> IssuerCredentialDataProvider = { OAuth2IssuerCredentialDataProvider(it) })

Server implementation to issue credentials using OID4VCI.

CredentialOffer

@Serializable

data class CredentialOffer(val credentialIssuer: String, val configurationIds: Collection<String>, val grants: CredentialOfferGrants? = null)

CredentialOfferGrants

@Serializable

data class CredentialOfferGrants(val authorizationCode: CredentialOfferGrantsAuthCode? = null, val preAuthorizedCode: CredentialOfferGrantsPreAuthCode? = null)

OID4VCI: Object indicating to the Wallet the Grant Types the Credential Issuer's Authorization Server is prepared to process for this Credential Offer. Every grant is represented by a name/value pair. The name is the Grant Type identifier; the value is an object that contains parameters either determining the way the Wallet MUST use the particular grant and/or parameters the Wallet MUST send with the respective request(s).

CredentialOfferGrantsAuthCode

@Serializable

data class CredentialOfferGrantsAuthCode(val issuerState: String? = null, val authorizationServer: String? = null)

CredentialOfferGrantsPreAuthCode

@Serializable

data class CredentialOfferGrantsPreAuthCode(val preAuthorizedCode: String, val transactionCode: CredentialOfferGrantsPreAuthCodeTransactionCode? = null, val waitIntervalSeconds: Int? = 5, val authorizationServer: String? = null)

CredentialOfferGrantsPreAuthCodeTransactionCode

@Serializable

data class CredentialOfferGrantsPreAuthCodeTransactionCode(val inputMode: String? = "numeric", val length: Int? = null, val description: String? = null)

CredentialOfferUrlParameters

@Serializable

data class CredentialOfferUrlParameters(val credentialOffer: JsonObject? = null, val credentialOfferUrl: String? = null)

OID4VCI: The Credential Issuer sends Credential Offer using an HTTP GET request or an HTTP redirect to the Wallet's Credential Offer Endpoint defined in Section 11.1.The Credential Offer object, which is a JSON-encoded object with the Credential Offer parameters, can be sent by value or by reference.

CredentialRequestParameters

@Serializable

data class CredentialRequestParameters(val format: CredentialFormatEnum? = null, val credentialIdentifier: String? = null, val credentialResponseEncryption: SupportedAlgorithmsContainer? = null, val docType: String? = null, val claims: Map<String, Map<String, RequestedCredentialClaimSpecification>>? = null, val credentialDefinition: SupportedCredentialFormatDefinition? = null, val sdJwtVcType: String? = null, val proof: CredentialRequestProof? = null)

CredentialRequestProof

@Serializable

data class CredentialRequestProof(val proofType: OpenIdConstants.ProofType, val jwt: String? = null, val cwt: String? = null)

CredentialRequestProofSupported

@Serializable

data class CredentialRequestProofSupported(val supportedSigningAlgorithms: Collection<String>)

CredentialResponseParameters

@Serializable

data class CredentialResponseParameters(val format: CredentialFormatEnum? = null, val credential: String? = null, val acceptanceToken: String? = null, val clientNonce: String? = null, val clientNonceExpiresIn: Duration? = null)

CredentialSubjectMetadataSingle

@Serializable

data class CredentialSubjectMetadataSingle(val mandatory: Boolean? = null, val valueType: String? = null, val display: Set<DisplayProperties>? = null)

OID4VCI: W3C VC: To express the specifics about the claim, the most deeply nested value MAY be an object that includes the following parameters defined by this specification (other parameters MAY also be used).

DefaultCodeService

class DefaultCodeService : CodeService

DefaultNonceService

class DefaultNonceService : NonceService

DefaultTokenService

class DefaultTokenService : TokenService

DisplayLogoProperties

@Serializable

data class DisplayLogoProperties(val url: String? = null, val uri: String? = null, val altText: String? = null)

OID4VCI: OPTIONAL. Object with information about the logo of the Credential.

DisplayProperties

@Serializable

data class DisplayProperties(val name: String? = null, val locale: String? = null, val logo: DisplayLogoProperties? = null, val description: String? = null, val backgroundColor: String? = null, val backgroundImage: DisplayLogoProperties? = null, val textColor: String? = null)

OID4VCI: OPTIONAL. Array of objects, where each object contains the display properties of the supported Credential for a certain language.

IssuerMetadata

@Serializable

data class IssuerMetadata(val issuer: String? = null, val credentialIssuer: String? = null, val authorizationServers: Set<String>? = null, val credentialEndpointUrl: String? = null, val tokenEndpointUrl: String? = null, val jsonWebKeySetUrl: String? = null, val authorizationEndpointUrl: String? = null, val batchCredentialEndpointUrl: String? = null, val deferredCredentialEndpointUrl: String? = null, val notificationEndpointUrl: String? = null, val credentialResponseEncryption: SupportedAlgorithmsContainer? = null, val supportsCredentialIdentifiers: Boolean? = false, val supportedCredentialConfigurations: Map<String, SupportedCredentialFormat>? = null, val displayProperties: Set<DisplayProperties>? = null, val responseTypesSupported: Set<String>? = null, val scopesSupported: Set<String>? = null, val subjectTypesSupported: Set<String>? = null, val idTokenSigningAlgorithmsSupported: Set<JwsAlgorithm>? = null, val requestObjectSigningAlgorithmsSupported: Set<JwsAlgorithm>? = null, val subjectSyntaxTypesSupported: Set<String>? = null, val idTokenTypesSupported: Set<IdTokenType>? = null, val presentationDefinitionUriSupported: Boolean = true, val vpFormatsSupported: VpFormatsSupported? = null, val clientIdSchemesSupported: Set<String>? = null)

To be serialized into /.well-known/openid-credential-issuer

NonceService

interface NonceService

OAuth2AuthorizationServer

interface OAuth2AuthorizationServer

Used by CredentialIssuer to obtain user data when issuing credentials using OID4VCI.

OAuth2AuthorizationServerMetadata

@Serializable

data class OAuth2AuthorizationServerMetadata(val issuer: String, val authorizationEndpoint: String, val pushedAuthorizationRequestEndpoint: String? = null, val requirePushedAuthorizationRequests: Boolean? = null, val tokenEndpoint: String, val jwksUri: String? = null, val registrationEndpoint: String? = null, val scopesSupported: Set<String>? = null, val responseTypesSupported: Set<String>? = null, val responseModesSupported: Set<String>? = null, val grantTypesSupported: Set<String>? = null, val tokenEndPointAuthMethodsSupported: Set<String>? = null, val tokenEndPointAuthSigningAlgValuesSupported: Set<String>? = null, val serviceDocumentation: String? = null, val uiLocalesSupported: Set<String>? = null, val opPolicyUri: String? = null, val opTosUri: String? = null, val revocationEndpoint: String? = null, val revocationEndpointAuthMethodsSupported: Set<String>? = null, val revocationEndpointAuthSigningAlgValuesSupported: Set<String>? = null, val introspectionEndpoint: String? = null, val introspectionEndpointAuthMethodsSupported: Set<String>? = null, val introspectionEndpointAuthSigningAlgValuesSupported: Set<String>? = null, val codeChallengeMethodsSupported: Set<String>? = null)

This implements RFC8414 All descriptions taken from section 2.

OAuth2DataProvider

interface OAuth2DataProvider

Interface used in SimpleAuthorizationService to actually load user data, converting it into OidcUserInfo.

OAuth2Error

@Serializable

data class OAuth2Error(val error: String, val errorDescription: String? = null, val errorUri: String? = null)

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html OpenID for Verifiable Credential Issuance Published: 3 February 2023

OAuth2Exception

class OAuth2Exception(val error: String, val errorDescription: String? = null) : Throwable

OAuth2IssuerCredentialDataProvider

class OAuth2IssuerCredentialDataProvider(userInfo: OidcUserInfoExtended, clock: Clock = Clock.System) : IssuerCredentialDataProvider

Adapter implementation to convert userInfo obtained from an OAuth2AuthorizationServer into credentials needed by IssuerCredentialDataProvider.

OidcAddressClaim

@Serializable

data class OidcAddressClaim(val formatted: String? = null, val street: String? = null, val locality: String? = null, val region: String? = null, val postalCode: String? = null, val country: String? = null)

OpenID Connect Core 1.0

OidcUserInfo

@Serializable

data class OidcUserInfo(val subject: String, val name: String? = null, val givenName: String? = null, val familyName: String? = null, val middleName: String? = null, val nickname: String? = null, val preferredUsername: String? = null, val profile: String? = null, val picture: String? = null, val website: String? = null, val email: String? = null, val emailVerified: Boolean? = null, val gender: String? = null, val birthDate: String? = null, val timezone: String? = null, val locale: String? = null, val phoneNumber: String? = null, val phoneNumberVerified: Boolean? = null, val address: OidcAddressClaim? = null, val ageOver18: Boolean? = null, val updatedAt: Instant? = null)

OpenID Connect Core 1.0

OidcUserInfoExtended

data class OidcUserInfoExtended(val userInfo: OidcUserInfo, val jsonObject: JsonObject)

Holds a deserialized OidcUserInfo as well as a JsonObject with other properties, that could not been parsed.

Parameters

typealias Parameters = Map<String, String>

SimpleAuthorizationService

class SimpleAuthorizationService(dataProvider: OAuth2DataProvider, credentialSchemes: Set<ConstantIndex.CredentialScheme>, codeService: CodeService = DefaultCodeService(), tokenService: TokenService = DefaultTokenService(), clientNonceService: NonceService = DefaultNonceService(), val publicContext: String = "https://wallet.a-sit.at/authorization-server", val authorizationEndpointPath: String = "/authorize", val tokenEndpointPath: String = "/token") : OAuth2AuthorizationServer

Simple authorization server implementation, to be used for CredentialIssuer, when issuing credentials directly from a local dataProvider.

SupportedAlgorithmsContainer

@Serializable

data class SupportedAlgorithmsContainer(val supportedAlgorithms: Set<JsonWebAlgorithm>, val supportedEncryptionAlgorithms: Set<JweAlgorithm>? = null, val encryptionRequired: Boolean? = null)

SupportedCredentialFormat

@Serializable

data class SupportedCredentialFormat

OID4VCI: Object that describes specifics of the Credential that the Credential Issuer supports issuance of. This object contains a list of name/value pairs, where each name is a unique identifier of the supported Credential being described. This identifier is used in the Credential Offer to communicate to the Wallet which Credential is being offered.

SupportedCredentialFormatDefinition

@Serializable

data class SupportedCredentialFormatDefinition(val types: Collection<String>? = null, val credentialSubject: Map<String, CredentialSubjectMetadataSingle>? = null, val claims: Map<String, RequestedCredentialClaimSpecification>? = null)

OID4VCI: W3C VC: REQUIRED. Object containing the detailed description of the Credential type. It consists of at least the following two parameters: type, credentialSubject`.

TokenRequestParameters

@Serializable

data class TokenRequestParameters(val grantType: String, val code: String? = null, val redirectUrl: String, val clientId: String, val authorizationDetails: Set<AuthorizationDetails>? = null, val preAuthorizedCode: String? = null, val transactionCode: CredentialOfferGrantsPreAuthCodeTransactionCode? = null, val codeVerifier: String? = null)

TokenResponseParameters

@Serializable

data class TokenResponseParameters(val accessToken: String, val refreshToken: String? = null, val tokenType: String, val expires: Duration, val scope: String? = null, val clientNonce: String? = null, val clientNonceExpiresIn: Duration? = null, val authorizationPending: Boolean? = null, val interval: Duration? = null, val authorizationDetails: Set<AuthorizationDetails>? = null)

TokenService

interface TokenService

VpFormatsSupported

@Serializable

data class VpFormatsSupported(val vcJwt: SupportedAlgorithmsContainer? = null, val vcJsonLd: SupportedAlgorithmsContainer? = null, val jsonLinkedData: SupportedAlgorithmsContainer? = null)

OID4VP: An object containing a list of key value pairs, where the key is a string identifying a Credential format supported by the Wallet. Valid Credential format identifier values are defined in Annex E of OpenID.VCI. Other values may be used when defined in the profiles of this specification.

WalletService

class WalletService(clientId: String = "https://wallet.a-sit.at/app", redirectUrl: String = "/callback", cryptoService: CryptoService = DefaultCryptoService(RandomKeyPairAdapter()), jwsService: JwsService = DefaultJwsService(cryptoService), coseService: CoseService = DefaultCoseService(cryptoService), remoteResourceRetriever: RemoteResourceRetrieverFunction = { null })

Client service to retrieve credentials using OpenID for Verifiable Credential Issuance. Implemented from Draft openid-4-verifiable-credential-issuance-1_0-11, 2023-02-03.