vck-openid/at.asitplus.wallet.lib.openid/OpenId4VpVerifier

OpenId4VpVerifier

class OpenId4VpVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial? = null, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService = EphemeralEncryptionKeyService(), decryptJwe: DecryptJweFun = DecryptJweWithEphemeralKey(ephemeralEncryptionKeyService, decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), timeLeewaySeconds: Long = 300, clock: Clock = Clock.System, nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())(source)

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09).

This class creates the Authentication Request (see AuthenticationRequestParameters), clients need to send it to the holder (see OpenId4VpHolder) which will create the Authentication Response, which will be verified here in validateAuthnResponse.

Constructors

OpenId4VpVerifier

@JvmOverloads

constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial? = null, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService = EphemeralEncryptionKeyService(), decryptJwe: DecryptJweFun = DecryptJweWithEphemeralKey(ephemeralEncryptionKeyService, decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), timeLeewaySeconds: Long = 300, clock: Clock = Clock.System, nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())

Properties

metadata

val metadata: RelyingPartyMetadata

Creates the at.asitplus.openid.RelyingPartyMetadata, without encryption, i.e. without any key to encrypt responses to (see metadataWithEncryption)

metadataWithEncryption

val metadataWithEncryption: RelyingPartyMetadata

Creates the RelyingPartyMetadata, but with parameters set to request encryption of pushed authentication responses, see RelyingPartyMetadata.encryptedResponseEncValues, advertising decryptionKeyMaterial.

verifier

val verifier: Verifier

Verifies the holder's response against our identifier from clientIdScheme.

Functions

createAuthnRequest

suspend fun createAuthnRequest(requestOptions: OpenId4VpRequestOptions, creationOptions: CreationOptions): KmmResult<CreatedRequest>

Creates a new authentication request conforming to OpenID4VP.

validateAuthnResponse

suspend fun validateAuthnResponse(input: ResponseParametersFrom): KmmResult<AuthnResponseResult>

Validates an Authentication Response from the Wallet, in case it has been parsed into ResponseParametersFrom with ResponseParser.

suspend fun validateAuthnResponse(input: String): KmmResult<AuthnResponseResult>

Validates an Authentication Response from the Wallet, where input is either: