vck-openid/at.asitplus.wallet.lib.openid/OpenId4VpHolder

OpenId4VpHolder

class OpenId4VpHolder @JvmOverloads constructor(holder: Holder = HolderAgent(keyMaterial = EphemeralKeyWithoutCert()), encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false, relyingPartyValidator: RelyingPartyValidator = RelyingPartyValidator())(source)

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09).

The verifier (see OpenId4VpVerifier) creates the Authentication Request, we can parse and validate it in startAuthorizationResponsePreparation, show the information to the user, and create the response in finalizeAuthorizationResponse, and send it back to the verifier.

This class sends no HTTP requests: wallets fetch a request object passed by reference, and post responses to the verifier, with OpenId4VpProtocolClient, which returns at.asitplus.wallet.lib.HttpExchanges for any HTTP stack.

Constructors

OpenId4VpHolder

@JvmOverloads

constructor(holder: Holder = HolderAgent(keyMaterial = EphemeralKeyWithoutCert()), encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false, relyingPartyValidator: RelyingPartyValidator = RelyingPartyValidator())

constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial), encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, relyingPartyTrust: Set<RelyingPartyTrust>? = null, walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false)

Maps the certificates of RelyingPartyTrust.Certificates in relyingPartyTrust to the anchors of the access certificate providers of a RelyingPartyValidator; the other sources no longer take effect, so requests with their client identifier prefixes are rejected if trust is configured.

Types

Companion

object Companion

JsonWebKeyLookupInput

data class JsonWebKeyLookupInput(val clientId: String?)

Properties

metadata

val metadata: OAuth2AuthorizationServerMetadata

Functions

createAuthnErrorResponse

suspend fun createAuthnErrorResponse(error: Throwable, state: AuthorizationResponsePreparationState): KmmResult<AuthenticationResponseResult>

Creates an error response for the error, which can be sent to the verifier / relying party.

createAuthnResponse

suspend fun createAuthnResponse(request: RequestParametersFrom<AuthenticationRequestParameters>): KmmResult<AuthenticationResponseResult>

Pass in the deserialized AuthenticationRequestParameters, which were either encoded as query params, or JSON serialized as a JWT Request Object.

suspend fun ~~createAuthnResponse~~(input: String): KmmResult<AuthenticationResponseResult>

Pass in the URL sent by the Verifier (containing the AuthenticationRequestParameters as query parameters), to create AuthenticationResponseResult that can be sent back to the Verifier.

finalizeAuthorizationResponse

suspend fun finalizeAuthorizationResponse(preparationState: AuthorizationResponsePreparationState, credentialPresentation: CredentialPresentation? = null): KmmResult<AuthenticationResponseResult>

Finalize the authorization response, given the preparationState from startAuthorizationResponsePreparation, and the credentialPresentation selected by the user.

getMatchingCredentials

suspend fun getMatchingCredentials(preparationState: AuthorizationResponsePreparationState): KmmResult<CredentialMatchingResult<SubjectCredentialStore.StoreEntry>>

Matches the presentation request from preparationState against the holder's available credentials.

startAuthorizationResponsePreparation

suspend fun startAuthorizationResponsePreparation(params: RequestParametersFrom<AuthenticationRequestParameters>): KmmResult<AuthorizationResponsePreparationState>

Validates the AuthenticationRequestParameters from params. The verifier's keys are the jwks of its client_metadata, else those from lookupJsonWebKeysForClient; a jwks_uri is ignored, as OpenID4VP 1.0, 5.1 defines only jwks, and requires other metadata parameters to be ignored. Clients need to inform the user, get consent, and resume in finalizeAuthorizationResponse.

suspend fun ~~startAuthorizationResponsePreparation~~(input: String): KmmResult<AuthorizationResponsePreparationState>

Parses the AuthenticationRequestParameters from input, fetching the request object passed by reference in request_uri, and validates it, see the overload taking parsed parameters. Clients need to inform the user, get consent, and resume in finalizeAuthorizationResponse.

suspend fun startAuthorizationResponsePreparation(params: RequestParametersFrom<AuthenticationRequestParameters>, policy: ValidationPolicy): KmmResult<AuthorizationRequestValidation>

Validates params under policy, see RequestObjectChecks, and prepares the response like the overload without a policy. The preparation state is returned also for a rejected request, e.g. to show the user why, or to answer the verifier with an error from finalizeAuthorizationResponse: check the decision of AuthorizationRequestValidation.validationReport before presenting anything.