MultipazProject

multipaz-openid4vci-server/org.multipaz.openid4vci.request

Package-level declarations

Types

data class ResourceBytes(val bytes: ByteString)

ResourceNotFoundException

class ResourceNotFoundException : Exception

Properties

const val PREFIX: String

Functions

authorizeChallenge

suspend fun authorizeChallenge(call: ApplicationCall)

Serves "OAuth 2.0 for First-Party Applications" workflow.

suspend fun authorizeGet(call: ApplicationCall)

suspend fun authorizePost(call: ApplicationCall)

Handle user's authorization and redirect to FinishAuthorizationServlet.

suspend fun credential(call: ApplicationCall)

Issues a credential based on DPoP authentication with access token.

credentialRequest

suspend fun credentialRequest(call: ApplicationCall)

Generates request for Digital Credential for the browser-based authorization workflow.

suspend fun fetchResource(call: ApplicationCall, path: String)

Serves HTTP request by fetching a resource.

finishAuthorization

suspend fun finishAuthorization(call: ApplicationCall)

Finish web-based authorization and hand off the session back to the Wallet App (or Wallet Server).

suspend fun nonce(call: ApplicationCall)

Endpoint to obtain fresh c_nonce (challenge for device binding key attestation).

openid4VpResponse

suspend fun openid4VpResponse(call: ApplicationCall)

Handles presentation-during-issuance OpenId4VP response from the wallet/client.

pushedAuthorizationRequest

suspend fun pushedAuthorizationRequest(call: ApplicationCall)

Pushed Authorization Request, which is the first request to be sent to our OpenID4VCI server if authorize challenge path is not used. In theory, other, simpler (and less secure) forms of client authorization are possible, but our implementation requires Pushed Authorization Request.

suspend fun qrCode(call: ApplicationCall)

Encodes text string (passed as q parameter) into a QR code.

suspend fun token(call: ApplicationCall)

Takes control over authentication session after web-based user authentication. This is a counterpart of the pushedAuthorizationRequest. It checks that (1) hash of code_verifier supplied here matches code_challenge supplied to push authorization, (2) performs DPoP authorization using the key established in push authorization. Once all the checks are done it issues access token that can be used to request a credential and possibly a refresh token that can be used to request more access tokens.

wellKnownOauthAuthorization

suspend fun wellKnownOauthAuthorization(call: ApplicationCall)

Generates .well-known/oauth-authorization-server metadata file.

wellKnownOpenidCredentialIssuer

suspend fun wellKnownOpenidCredentialIssuer(call: ApplicationCall)

Generates .well-known/openid-credential-issuer metadata file.