vck-openid/at.asitplus.wallet.lib.openid/OpenId4VpVerifier

OpenId4VpVerifier

class OpenId4VpVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptJwe: DecryptJweFun = DecryptJwe(decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), timeLeewaySeconds: Long = 300, clock: Clock = Clock.System, nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())(source)

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09) as well as SIOP V2 (D13, 2023-11-28).

This class creates the Authentication Request (see AuthenticationRequestParameters), clients need to send it to the holder (see OpenId4VpHolder) which will create the Authentication Response, which will be verified here in validateAuthnResponse.

Constructors

OpenId4VpVerifier

@JvmOverloads

constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptJwe: DecryptJweFun = DecryptJwe(decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), timeLeewaySeconds: Long = 300, clock: Clock = Clock.System, nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())

Types

CreatedRequest

typealias ~~CreatedRequest~~ = CreatedRequest

CreationOptions

typealias ~~CreationOptions~~ = CreationOptions

Properties

metadata

val metadata: RelyingPartyMetadata

Creates the at.asitplus.openid.RelyingPartyMetadata, without encryption (see metadataWithEncryption)

metadataWithEncryption

val metadataWithEncryption: RelyingPartyMetadata

Creates the RelyingPartyMetadata, but with parameters set to request encryption of pushed authentication responses, see RelyingPartyMetadata.encryptedResponseEncValues.

verifier

val verifier: Verifier

Verifies the holder's response against our identifier from clientIdScheme.

Functions

createAuthnRequest

suspend fun ~~createAuthnRequest~~(requestOptions: OpenId4VpRequestOptions, requestObjectParameters: RequestObjectParameters? = null): AuthenticationRequestParameters

suspend fun createAuthnRequest(requestOptions: OpenId4VpRequestOptions, creationOptions: CreationOptions): KmmResult<CreatedRequest>

Creates a new authentication request conforming to OpenID4VP.

createAuthnRequestAsSignedRequestObject

suspend fun ~~createAuthnRequestAsSignedRequestObject~~(requestOptions: OpenId4VpRequestOptions, requestObjectParameters: RequestObjectParameters? = null): KmmResult<JwsCompactTyped<AuthenticationRequestParameters>>

submitAuthnRequest

suspend fun ~~submitAuthnRequest~~(authenticationRequestParameters: AuthenticationRequestParameters, externalId: String? = null)

validateAuthnResponse

suspend fun validateAuthnResponse(input: ResponseParametersFrom): KmmResult<AuthnResponseResult>

Validates an Authentication Response from the Wallet, in case it has been parsed into ResponseParametersFrom with ResponseParser.

suspend fun validateAuthnResponse(input: String): KmmResult<AuthnResponseResult>

Validates an Authentication Response from the Wallet, where input is either:

suspend fun ~~validateAuthnResponse~~(input: OpenId4VpResponse, externalId: String): KmmResult<AuthnResponseResult>

suspend fun ~~validateAuthnResponse~~(input: ResponseParametersFrom, externalId: String? = null): KmmResult<AuthnResponseResult>

suspend fun ~~validateAuthnResponse~~(input: String, externalId: String? = null): KmmResult<AuthnResponseResult>