[WAL-896] feat: authenticated OpenID4VP presentation and signed DC API - #2141
Open
JakeFernandes98 wants to merge 18 commits into
Open
[WAL-896] feat: authenticated OpenID4VP presentation and signed DC API#2141JakeFernandes98 wants to merge 18 commits into
JakeFernandes98 wants to merge 18 commits into
Conversation
Contributor
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
10 tasks
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(verifier2): expose authenticated request objects * feat(wallet): finalize authenticated OpenID4VP presentation flow
…ches Keep WAL-896's plain-request RedirectUri gate, but refuse a contradicting response destination with the same message as Request Object binding.
Android does not inherit jvmMain, so WAL-896's new expect had no actual and compileAndroidMain failed during assembleDebug.
openid4vp-wallet is JVM-only, so Android loaded OrderedCertificateChain_jvmKt for platformSupportsPkixCertificatePathValidation. Keep the actual in jvmCommon so the JVM and Android artifacts expose the same class.
RFC 5280 treats a missing KeyUsage as unrestricted. Requiring digitalSignature when the extension is absent rejected verifier attestation JWTs that still sign the request correctly.
ClientIdTrustConfiguration now takes a trust store, not a list of CertificateDer, so the demo PEMs need the same wrapping as the iOS bridge.
HAIP signed-only is the default: verifiers must send signed JARs, and redirect_uri is rejected. Unsigned JSON redirect_uri requests are accepted only when the flag is on.
Wallets only accept unsigned requests for that prefix; signed JARs keep pre-registered/x509 client IDs, and public-demo signed E2E is skipped until demo deploys inline request objects.
redirect_uri is only generated when both the per-session and service client_id are empty. An explicit or configured id is left unchanged.
…ntials A multiple=false query was collapsing the whole store to the first match, so picking any other same-doctype credential failed after selection.
JakeFernandes98
force-pushed
the
feature/wal-896-final
branch
from
September 1, 2026 17:14
0bb936d to
7242762
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is the WAL-896 identity PR on
feature/wal-896-final. It supersedes walt-id/waltid-identity#2091 (feature/wal-896-dc-api), which is closed; that branch is kept.Wallets and verifiers can complete authenticated OpenID4VP presentations: Verifier2 exposes signed Request Objects, Wallet2 and the mobile SDK authenticate them, and the first signed Digital Credentials API path (
openid4vp-v1-signedwith encrypteddc_api.jwt) is wired through shared KMP, Android, and Compose.Default wallet behavior accepts signed Request Objects with a signable client ID, and also accepts unsigned JSON fetched via
request_uriwithredirect_uri(the Verifier2 bootstrap). There is no operator flag for HAIP signed-only; that can be added later.Related PRs
OpenID4VP request authentication
Wallet2 authenticates the final Authorization Request before match/present. There is no
allowUnsignedRequests(or similar) product config.x509_san_dns,x509_hash, DID,verifier_attestation,pre-registeredredirect_urirequest_uriredirect_urirequest_urialg=noneredirect_urialg=noneDC API always advertises and accepts
openid4vp-v1-signedandopenid4vp-v1-unsigned.openid4vp-v1-multisignedstays rejected.UnsignedRequestObjectPolicyremains insideAuthorizationRequestResolver(ALLOW_UNSIGNEDdefault;REQUIRE_SIGNEDfor tests and a possible later HAIP profile). It is not threaded through Wallet2 routes,wallet-service.conf, or the mobile SDK.What Changed
Verifier2
request_uri).Wallet2 and shared resolver
AuthorizationRequestResolverimplements the table above.clientIdTrustfromwallet-service.conf(x509TrustAnchorsas an in-memory PKIX trust store). X.509 prefixes fail closed when anchors are empty.Mobile SDK
present(requestUrl)andpreviewPresentation(requestUrl)use the same resolver policy as DC API.Trust material
x509_san_dns/x509_hashare not empty-list fail-closed.wallet-service.conf.Architecture Notes
redirect_uri(including walt.id JSONrequest_uribootstrap). It is not a HAIP signed-only profile.request_uriis the Verifier2 bootstrap path. OpenID4VP JARrequest_uriisapplication/oauth-authz-req+jwt.REQUIRE_SIGNEDwithout adding a Wallet2 config today.Caveats and Follow-Ups
openid4vp-v1-multisignedis out of scope.haip-vp://OS scheme registration is out of scope; protocol parse is scheme-agnostic and demos still registeropenid4vp.resolveCertificateChainon receive are not in this PR.x509_hashfor signed requests, encrypteddirect_post.jwt, and a signed-only HTTP profile).Breaking
x509_*, DID, attestation, pre-registered) fail closed without matching trust material.redirect_uriviarequest_uriremains accepted; operators who want HAIP signed-only have no config switch yet.