vck-openid/at.asitplus.wallet.lib.openid/DcApiVerifier

DcApiVerifier

class DcApiVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptJwe: DecryptJweFun = DecryptJwe(decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), stateToIsoMdocRequestStore: MapStore<String, IsoMdocRequest> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())(source)

Implements a verifier for the Digital Credentials API, similar to OpenId4VpVerifier for OpenID4VP.

This class creates the request for the Digital Credentials API in createAuthnRequest (see at.asitplus.dcapi.request.verifier.CredentialRequestOptions), which the relying party's frontend needs to pass to the browser (navigator.credentials.get()). The browser forwards it to the holder (see OpenId4VpHolder), which will create the Authentication Response, which will be verified here in validateAuthnResponse.

Constructors

DcApiVerifier

@JvmOverloads

constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptJwe: DecryptJweFun = DecryptJwe(decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), stateToIsoMdocRequestStore: MapStore<String, IsoMdocRequest> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())

Properties

metadata

val metadata: RelyingPartyMetadata

Creates the at.asitplus.openid.RelyingPartyMetadata, without encryption (see metadataWithEncryption)

metadataWithEncryption

val metadataWithEncryption: RelyingPartyMetadata

Creates the RelyingPartyMetadata, but with parameters set to request encryption of pushed authentication responses, see RelyingPartyMetadata.encryptedResponseEncValues.

verifier

val verifier: Verifier

Verifies the holder's response against our identifier from clientIdScheme.

Functions

createAuthnRequest

suspend fun createAuthnRequest(requestOptions: OpenId4VpRequestOptions, vararg creationOptions: DcApiCreationOptions): KmmResult<CredentialRequestOptions>

Creates a new authentication request for the W3C Digital Credentials API, i.e. the object that the relying party's frontend needs to pass to the browser in navigator.credentials.get().

createDcApiSessionTranscriptAnnexC

fun createDcApiSessionTranscriptAnnexC(toBeHashed: SessionTranscriptContentHashable): SessionTranscript

validateAuthnResponse

suspend fun validateAuthnResponse(input: DigitalCredentialInterface, externalId: String, expectedOrigin: String? = null): KmmResult<DcApiResponseResult>

suspend fun validateAuthnResponse(input: String, externalId: String, expectedOrigin: String? = null): KmmResult<DcApiResponseResult>

Validates an Authentication Response from the Wallet, where input is a signed or unsigned DC API response.