Skip to content

useDPoP Ignored in OpenID4VCI Library #224

@craigaps

Description

@craigaps

When defining the configuration for a wallet, there is an option to set the useDPoP, granted when not provided the default is false. However regardless of this value, it's not passed down into the OpenID4VCI library.

A dpopConstructor is assigned in the OpenId4VCIService.getIssuer function using the data from offer.authorizationServerMetadata.dpopSigningAlgValuesSupported with no ability to set the dpopConstructor to nil avoiding the DPoP JWT in AuthorizationServerClient.submitPushedAuthorizationRequest - in particular in the OpenID4VCI:

AuthorizationServerClient.swift line 332

let tokenHeaders = try await tokenEndPointHeaders(
  url: parEndpoint,
  dpopNonce: dpopNonce
)

Needs to be a way to avoid using DPoP where if the server is not configured for it despite supplying metadata in the .well-known/oauth-authorization-server dpop_signing_alg_values_supported element.

Also, honouring useDPoP it would also leave the token type to Bearer

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions