From 4e4972f209f2c6caff677ea28be42b620f1c888c Mon Sep 17 00:00:00 2001 From: mishasizov-SK <109598497+mishasizov-SK@users.noreply.github.com> Date: Tue, 7 Nov 2023 13:59:10 +0200 Subject: [PATCH] feat: Add attest_jwt_client_auth option to Credential Issuer metadata (#1509) Signed-off-by: Mykhailo Sizov --- docs/v1/openapi.yaml | 6 ++++++ pkg/restapi/v1/issuer/openapi.gen.go | 3 +++ pkg/service/wellknown/provider/testdata/profile.json | 1 + pkg/service/wellknown/provider/wellknown_service.go | 1 + pkg/service/wellknown/provider/wellknown_service_test.go | 2 ++ 5 files changed, 13 insertions(+) diff --git a/docs/v1/openapi.yaml b/docs/v1/openapi.yaml index fec3aa045..375e92eca 100644 --- a/docs/v1/openapi.yaml +++ b/docs/v1/openapi.yaml @@ -918,6 +918,11 @@ components: description: An array of objects, where each object contains display properties of a Credential Issuer for a certain language. items: $ref: '#/components/schemas/CredentialDisplay' + token_endpoint_auth_methods_supported: + type: array + items: + type: string + description: JSON array containing a list of client authentication methods supported by this token endpoint. Default is "none". required: - authorization_endpoint - token_endpoint @@ -929,6 +934,7 @@ components: - credential_issuer - credential_endpoint - credentials_supported + - token_endpoint_auth_methods_supported description: WellKnownOpenIDIssuerConfiguration represents the OIDC Configuration response for cases when VCS serves as IDP. CredentialIssuanceHistoryData: title: CredentialIssuanceHistory response diff --git a/pkg/restapi/v1/issuer/openapi.gen.go b/pkg/restapi/v1/issuer/openapi.gen.go index ffb25c53d..d3bbc1841 100644 --- a/pkg/restapi/v1/issuer/openapi.gen.go +++ b/pkg/restapi/v1/issuer/openapi.gen.go @@ -361,6 +361,9 @@ type WellKnownOpenIDIssuerConfiguration struct { // URL of the OP's OAuth 2.0 Token Endpoint. TokenEndpoint string `json:"token_endpoint"` + + // JSON array containing a list of client authentication methods supported by this token endpoint. Default is "none". + TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"` } // PostCredentialsStatusJSONBody defines parameters for PostCredentialsStatus. diff --git a/pkg/service/wellknown/provider/testdata/profile.json b/pkg/service/wellknown/provider/testdata/profile.json index 205a5e60b..5912a8baf 100644 --- a/pkg/service/wellknown/provider/testdata/profile.json +++ b/pkg/service/wellknown/provider/testdata/profile.json @@ -8,6 +8,7 @@ "signed_issuer_metadata_supported": true, "grant_types_supported": ["grantType1","grantType2"], "scopes_supported": ["scope1","scope1"], + "token_endpoint_auth_methods_supported": ["none","attest_jwt_client_auth"], "pre-authorized_grant_anonymous_access_supported": true, "wallet_initiated_auth_flow_supported": true, "enable_dynamic_client_registration": true diff --git a/pkg/service/wellknown/provider/wellknown_service.go b/pkg/service/wellknown/provider/wellknown_service.go index 524455e02..1a100aaa9 100644 --- a/pkg/service/wellknown/provider/wellknown_service.go +++ b/pkg/service/wellknown/provider/wellknown_service.go @@ -150,6 +150,7 @@ func (s *Service) getOpenIDIssuerConfig(issuerProfile *profileapi.Issuer) *issue final.GrantTypesSupported = issuerProfile.OIDCConfig.GrantTypesSupported final.ScopesSupported = issuerProfile.OIDCConfig.ScopesSupported final.PreAuthorizedGrantAnonymousAccessSupported = issuerProfile.OIDCConfig.PreAuthorizedGrantAnonymousAccessSupported + final.TokenEndpointAuthMethodsSupported = issuerProfile.OIDCConfig.TokenEndpointAuthMethodsSupported if issuerProfile.OIDCConfig.EnableDynamicClientRegistration { regURL, _ := url.JoinPath(host, "oidc", issuerProfile.ID, issuerProfile.Version, "register") diff --git a/pkg/service/wellknown/provider/wellknown_service_test.go b/pkg/service/wellknown/provider/wellknown_service_test.go index c5081a05e..635763a2a 100644 --- a/pkg/service/wellknown/provider/wellknown_service_test.go +++ b/pkg/service/wellknown/provider/wellknown_service_test.go @@ -211,6 +211,7 @@ func checkWellKnownOpenIDIssuerConfiguration( if includedOIDCConfig { assert.Equal(t, []string{"grantType1", "grantType2"}, res.GrantTypesSupported) assert.Equal(t, []string{"scope1", "scope1"}, res.ScopesSupported) + assert.Equal(t, []string{"none", "attest_jwt_client_auth"}, res.TokenEndpointAuthMethodsSupported) assert.True(t, res.PreAuthorizedGrantAnonymousAccessSupported) if includedClientRegistration { @@ -225,6 +226,7 @@ func checkWellKnownOpenIDIssuerConfiguration( assert.Nil(t, res.ScopesSupported) assert.False(t, res.PreAuthorizedGrantAnonymousAccessSupported) assert.Nil(t, res.RegistrationEndpoint) + assert.Nil(t, res.TokenEndpointAuthMethodsSupported) } }