Skip to content

Commit 22d6a51

Browse files
saralongobardiacnsaralongobardiacn
committed
Merge branch 'main' into poc/openid4vci
2 parents e35d274 + 1591133 commit 22d6a51

14 files changed

Lines changed: 186 additions & 179 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# eudi-wallet-it-python
22

3-
![CI build](https://github.com/italia/eudi-wallet-it-python/workflows/pyeudiw/badge.svg)
3+
[![CI Build](https://github.com/italia/eudi-wallet-it-python/actions/workflows/python-app.yml/badge.svg)](https://github.com/italia/eudi-wallet-it-python/actions/workflows/python-app.yml)
44
![Python version](https://img.shields.io/badge/license-Apache%202-blue.svg)
55
![py-versions](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12-blue?logo=python)
66
[![GitHub issues](https://img.shields.io/github/issues/italia/eudi-wallet-it-python.svg)](https://github.com/italia/eudi-wallet-it-python/issues)

‎docs/TRUST.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ The module `pyeudiw.trust.handler.x509` provides a source of trusted entities ba
6969
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- |
7070
| config.x509.client_id_scheme | The scheme in the client id used in the request | x509_san_dns |
7171
| config.x509.certificate_authorities | It's a list of trusted certificate authorities composed of dict where the key should be (in order) the DNS, the URI or the Distinguished Name (RFC4514) of<br />the certificate and the value a x509 certificate in PEM Format. | |
72-
| config.x509.relying_party_certificate_chains_by_ca | It's an object containing the chain's relative to the certificate authorities listed in certificate_authorities parameter and<br /> must be relative to the RP. In particular leaf certificate's DNS, the URI or the CN must match the client id and <br />must be related to metadata_jwks[0].<br />The certificates can be in PEM Format only. | |
72+
| config.x509.leaf_certificate_chains_by_ca | Object containing the X509 chain's relative to the RP under a known CA, listed within the certificate_authorities list. It must be related to metadata_jwks[0]. The certificates are provided in PEM format. | |
7373

7474
## Write a Custom Trust Handler Module
7575

‎example/satosa/integration_test/commons.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@
3232
)
3333
from pyeudiw.tools.utils import exp_from_now, iat_now
3434
from pyeudiw.trust.model.trust_source import TrustSourceData
35-
from .saml2_sp import saml2_request
36-
from .settings import (
35+
from saml2_sp import saml2_request
36+
from settings import (
3737
IDP_BASEURL,
3838
CONFIG_DB,
3939
RP_EID,

‎example/satosa/integration_test/testconfig/potential/wp2uc1/userdenies/pyeudiw_backend.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -285,7 +285,7 @@ config:
285285
O6HVbDnJXTA34/I4snisJfZQ+Z9gln921+2Q27sMvyS7aBqtocDuWB0w3XZ3aCYk
286286
DTEzMjUtQA==
287287
-----END CERTIFICATE-----
288-
relying_party_certificate_chains_by_ca: # X.509 chains in PEM format. Please note: Leaf's certificate MUST be related to metadata_jwks[0]
288+
leaf_certificate_chains_by_ca: # X.509 chains in PEM format. Please note: Leaf's certificate MUST be related to metadata_jwks[0]
289289
ca.example.com:
290290
- |
291291
-----BEGIN CERTIFICATE-----

‎example/satosa/pyeudiw_backend.yaml‎

Lines changed: 63 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,7 @@ config:
224224
module: pyeudiw.trust.handler.federation
225225
class: FederationHandler
226226
config:
227+
client_id: 'openid_federation:https://localhost/OpenID4VP' # this MUST be configured with the RP's HTTPS URI where the backed is made available for discovery
227228
httpc_params: *httpc_params
228229
cache_ttl: 0
229230
entity_configuration_exp: 600
@@ -265,100 +266,72 @@ config:
265266
module: pyeudiw.trust.handler.x509
266267
class: X509Handler
267268
config:
268-
# client_id: *client_id
269-
client_id_scheme: x509_san_dns # this will be prepended in the client id scheme used in the request.
270-
include_issued_jwt_header_param: true # default false; if true, it will include x5c header parameters in the signed presentation request issued by this trust handler
269+
client_id: "x509_san_dns:localhost"
271270
certificate_authorities:
272271
ca.example.com: |
273272
-----BEGIN CERTIFICATE-----
274-
MIIDYzCCAkugAwIBAgIUHVMNJD9vqAA4mR+QAJyEQFW4kjQwDQYJKoZIhvcNAQEL
275-
BQAwUjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwg
276-
Qz1JVDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNDAz
277-
MTU0NzU2WhcNMjYwNDA0MTU0NzU2WjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxl
278-
LmNvbSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQsw
279-
CQYDVQQGEwJJVDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMf3zvlY
280-
zX1DYgv9QjRusMQjSRNdZi72/ydnxO/cAQ1GsgLZ8ewqIL1CnXtIs6i2F8poUOec
281-
g957xk1db6sTqEWXRi5h9IfMUFcd5G7gIbJzjXCiLSVz6m9vZlvqR7BDka1VQhuH
282-
rW2xEIE6+F2lWxJ+crimea/c5VlMKBCh+gQldFq3lTu6smGUz8xl8rhleBPgTgZz
283-
TO4VuVO1dOb/S4lq9twfVYCTznF9vgaNaNh3la7yjzCf+zpSTGQD8TFO8ws1SZRq
284-
O0bkabW8/5XsnwFHLT2LMSPkWMgMD8r+7xef93bvbEy7SA4Hw1Iow2xIIcTDYQ7F
285-
77HQ3OjkogHmhrMCAwEAAaMxMC8wEgYDVR0TAQH/BAgwBgEB/wIBATAZBgNVHREE
286-
EjAQgg5jYS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEApRUUxw5Dn0wd
287-
lFPApjn7n/SZyx5I1XnOHOIk8aWD0KFFa1zsnONlmRDgC8EQ5XKw3nMUwvnCQUR8
288-
6FmrqP5gINHdqfvWiitC0eQdDhMhIHvdfUMBicgZ0XDVjDZhD6W9A+IWwR3ySLCf
289-
lZHA5JwjYhpAjMYFXwSVZklOre34zJL6CRwgIUKjc9uyGPmlnVRFTUcUqLB9Uq/U
290-
dFc7XMPBAbMt1frOJRj6P1OFtubuC0INpEhzivg3+w8bXmpEN6e2hBvIjoNkgnWF
291-
O6HVbDnJXTA34/I4snisJfZQ+Z9gln921+2Q27sMvyS7aBqtocDuWB0w3XZ3aCYk
292-
DTEzMjUtQA==
273+
MIICJzCCAc6gAwIBAgIUFqb+aMtaYydHFIh9qXKzZVz7eQYwCgYIKoZIzj0EAwIw
274+
UjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1J
275+
VDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNjE1MTY1
276+
MTA2WhcNMjYwNjE2MTY1MTA2WjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxlLmNv
277+
bSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQswCQYD
278+
VQQGEwJJVDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJOfDFsMn2zgJ1Kb5hXU
279+
r/dDyOwRjm2LRiVFjgUSnhy/09FapToxjB7FAGZMJb/Q3JyCUc32WOGfXYA5izT+
280+
Ul6jgYEwfzASBgNVHRMBAf8ECDAGAQH/AgECMBkGA1UdEQQSMBCCDmNhLmV4YW1w
281+
bGUuY29tMA4GA1UdDwEB/wQEAwIBpjA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczov
282+
L2NhLmV4YW1wbGUuY29tL2NybC9jYS5leGFtcGxlLmNvbS5jcmwwCgYIKoZIzj0E
283+
AwIDRwAwRAIgafkpE88vVHf1AoNrRvqLNaiRwdw569kUbhwVrbXN7dYCIH0OkXvk
284+
tX5+FvfFc70mO+2FvYtOV0U4pruy8e807ATO
293285
-----END CERTIFICATE-----
294-
relying_party_certificate_chains_by_ca: # X.509 chains in PEM format. Please note: Leaf's certificate MUST be related to metadata_jwks[0]
295-
ca.example.com:
296-
- |
297-
-----BEGIN CERTIFICATE-----
298-
MIIDfzCCAmegAwIBAgIUN3niXMK8XOjhIvf6EUD4sz80XIkwDQYJKoZIhvcNAQEL
299-
BQAwTjEpMCcGA1UEAwwgaHR0cHM6Ly9pbnRlcm1lZGlhdGUuZXhhbXBsZS5uZXQx
300-
FDASBgNVBAoMC0V4YW1wbGUgSU5UMQswCQYDVQQGEwJJVDAeFw0yNTA0MDMxNTQ3
301-
NTZaFw0yNjA0MDQxNTQ3NTZaMFcxMTAvBgNVBAMMKENOPWVhZi5leGFtcGxlLmNv
302-
bSwgTz1FeGFtcGxlIExlYWYsIEM9SVQxFTATBgNVBAoMDEV4YW1wbGUgTGVhZjEL
303-
MAkGA1UEBhMCSVQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCw/qO3
304-
VfAkTQkMrHLgHuvcl1vxbptJGhW6fKNYyCXkhp+oXAewmViAIBY95OsAv6LKN2dY
305-
LVywe5OpaN2d0Mv6ioRquuqgMDJxWR8VNRMPzX/BWFZTMDDGFAeJPs9NQixXub1U
306-
aV8L+R0KlCXkJwrXLHadDUpupY5XX/lacyCc38Sk2bO2RkOcmYp51V245vZ0pbCc
307-
tLd9wa9TFdzzsOMDMLa9+BBKhB9cBlvAi3JLo6KcWJScHFG+31ljYhqmMjX7DAMo
308-
p5Guo8L59XahZOsyqhgC8gOd/0CMocBsjDurfTX7v55pQwXWFW0DPVd5e8ynTArz
309-
+5Kj1WC/W8eEGk7BAgMBAAGjTDBKMAwGA1UdEwEB/wQCMAAwOgYDVR0RBDMwMYIQ
310-
bGVhZi5leGFtcGxlLm9yZ4YdaHR0cHM6Ly9leGFtcGxlLmNvbS9PcGVuSUQ0VlAw
311-
DQYJKoZIhvcNAQELBQADggEBACF2aoCODW4tziNQs41C9N363xYPt21uIQy0CQ24
312-
1hRZ8Ev6yIQ/WORfzciLHZsWizZdS3D5oDY7K+WAgMpDSR0Ah9dXMfJjOxcUib57
313-
Zh+YOi443fjU/5/DBHyHgfEvDy1QXXHJuDbgchzAv9u8uY0ibUb/GHy4OKaj9bOI
314-
8g6qgZtT2wkfdHQPX+fpwZueTaHhoXJV+JTuE227fIjLZ5ThbvO0xbE3q4I/v+Gu
315-
ZZ713LQaG2RwdJWTimJUi6Sro5s0YR6qRGejHmiS1FbJOOG4AAE4PkhkxVogItVE
316-
Z4nqCEfD1RT6iwiWyXIYh3cNpWvcE3t4j7e/Su5IhW/Cv2E=
317-
-----END CERTIFICATE-----
318-
- |
319-
-----BEGIN CERTIFICATE-----
320-
MIIDRDCCAiygAwIBAgIUUOBXQmkRjQvfhU1YJbMEOMnPxvQwDQYJKoZIhvcNAQEL
321-
BQAwUjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwg
322-
Qz1JVDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNDAz
323-
MTU0NzU2WhcNMjYwNDA0MTU0NzU2WjBOMSkwJwYDVQQDDCBodHRwczovL2ludGVy
324-
bWVkaWF0ZS5leGFtcGxlLm5ldDEUMBIGA1UECgwLRXhhbXBsZSBJTlQxCzAJBgNV
325-
BAYTAklUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsSUAY+mCs1eB
326-
/hWKtF0kncwTRn3jgczjZWmUSSBZT3PzqmD9uqlgEBrv2sOGwO4bBDnutCAHhfnl
327-
2gXifvg2PJHQWu/g1kVY396K+d91nrqQhUabo2cpEca66t7InPMnXkMR5DG6rNP6
328-
l05OLKQIvoTaHzef0rAS4f+5gF7IcRtGq9G8QRnd2lwLmDYRPKY3jp/uvLosOatv
329-
Nx5p2XtxETgOSv4GEtjax3jxkMDIIPrHwTJGWwsGvasEI5lQ/G67OjFZjjSaoJ95
330-
SSPhXoIydmOmXKDN3GY7ZqT9HntuSzyB3GZ4DMLyOdZdvYvt08hUCJnnY0kGhhtW
331-
gW0xb/wyKwIDAQABoxYwFDASBgNVHRMBAf8ECDAGAQH/AgEAMA0GCSqGSIb3DQEB
332-
CwUAA4IBAQBAwwumBWSI/guarZsNd8hEOVZ7dWRQDLxfDZB1jKtgqA2jCEbNGwpY
333-
41NRRfkTi9EfZXXVdbk9xrjNWVsGdDn/Kh/1/b4uatu2ocRG5R3e2KkZMaK1/Ru2
334-
LFP6gvi7i8dvEr8IQqlg+CrEb11CjMXZi36jRZhtSUnUfmUR4hqCN/qzALdiKvHS
335-
NpEu0D6x6l7YEhwtpX7bvWdnEzCUrAUltMPO9pZUR1LBSPTCMSd+vUhJw/84EJEg
336-
D6Lw8OxzYyzSNOrGTqfplqlHrD/WpI6DB6Yq4Rpefz84AWraGVtZbYAlQMyK1EKS
337-
C3Lef0OGQC0anzAXDsGr1As8HdEuSngu
338-
-----END CERTIFICATE-----
339-
- |
340-
-----BEGIN CERTIFICATE-----
341-
MIIDYzCCAkugAwIBAgIUHVMNJD9vqAA4mR+QAJyEQFW4kjQwDQYJKoZIhvcNAQEL
342-
BQAwUjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwg
343-
Qz1JVDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNDAz
344-
MTU0NzU2WhcNMjYwNDA0MTU0NzU2WjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxl
345-
LmNvbSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQsw
346-
CQYDVQQGEwJJVDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMf3zvlY
347-
zX1DYgv9QjRusMQjSRNdZi72/ydnxO/cAQ1GsgLZ8ewqIL1CnXtIs6i2F8poUOec
348-
g957xk1db6sTqEWXRi5h9IfMUFcd5G7gIbJzjXCiLSVz6m9vZlvqR7BDka1VQhuH
349-
rW2xEIE6+F2lWxJ+crimea/c5VlMKBCh+gQldFq3lTu6smGUz8xl8rhleBPgTgZz
350-
TO4VuVO1dOb/S4lq9twfVYCTznF9vgaNaNh3la7yjzCf+zpSTGQD8TFO8ws1SZRq
351-
O0bkabW8/5XsnwFHLT2LMSPkWMgMD8r+7xef93bvbEy7SA4Hw1Iow2xIIcTDYQ7F
352-
77HQ3OjkogHmhrMCAwEAAaMxMC8wEgYDVR0TAQH/BAgwBgEB/wIBATAZBgNVHREE
353-
EjAQgg5jYS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEApRUUxw5Dn0wd
354-
lFPApjn7n/SZyx5I1XnOHOIk8aWD0KFFa1zsnONlmRDgC8EQ5XKw3nMUwvnCQUR8
355-
6FmrqP5gINHdqfvWiitC0eQdDhMhIHvdfUMBicgZ0XDVjDZhD6W9A+IWwR3ySLCf
356-
lZHA5JwjYhpAjMYFXwSVZklOre34zJL6CRwgIUKjc9uyGPmlnVRFTUcUqLB9Uq/U
357-
dFc7XMPBAbMt1frOJRj6P1OFtubuC0INpEhzivg3+w8bXmpEN6e2hBvIjoNkgnWF
358-
O6HVbDnJXTA34/I4snisJfZQ+Z9gln921+2Q27sMvyS7aBqtocDuWB0w3XZ3aCYk
359-
DTEzMjUtQA==
360-
-----END CERTIFICATE-----
361-
286+
leaf_certificate_chains_by_ca: # X.509 chains in PEM format. Please note: Leaf's certificate MUST be related to metadata_jwks[0]
287+
ca.example.com:
288+
- |
289+
-----BEGIN CERTIFICATE-----
290+
MIICPTCCAeOgAwIBAgIUHoZHzmND8rCMUj6Rpk8hw1dok+swCgYIKoZIzj0EAwIw
291+
TjEpMCcGA1UEAwwgaHR0cHM6Ly9pbnRlcm1lZGlhdGUuZXhhbXBsZS5uZXQxFDAS
292+
BgNVBAoMC0V4YW1wbGUgSU5UMQswCQYDVQQGEwJJVDAeFw0yNTA2MTUxNjUxMDZa
293+
Fw0yNjA2MTYxNjUxMDZaMFgxMjAwBgNVBAMMKUNOPWxlYWYuZXhhbXBsZS5jb20s
294+
IE89RXhhbXBsZSBMZWFmLCBDPUlUMRUwEwYDVQQKDAxFeGFtcGxlIExlYWYxCzAJ
295+
BgNVBAYTAklUMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQ46FDkhMjewZIP9q
296+
P8ZKZIP+ZEemctvjxeP0l3vWHMIhPuWwbF0l7CaieT2XX9MBVjH+eLHJ1O0jVJuf
297+
QuR8QKOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMCcGA1UdEQQgMB6CCWxvY2Fs
298+
aG9zdIYRaHR0cHM6Ly9sb2NhbGhvc3QwDgYDVR0PAQH/BAQDAgGmMEIGA1UdHwQ7
299+
MDkwN6A1oDOGMWh0dHBzOi8vbGVhZi5leGFtcGxlLmNvbS9jcmwvbGVhZi5leGFt
300+
cGxlLmNvbS5jcmwwCgYIKoZIzj0EAwIDSAAwRQIhAL1kC7cvzWp8T1qx9bB0QL3O
301+
1sjHIcKrHttkVrn+DRNgAiAvquUGn5zmpnoNVEzta8W+6po9KP/MfUb7oifqEvR9
302+
gQ==
303+
-----END CERTIFICATE-----
304+
- |
305+
-----BEGIN CERTIFICATE-----
306+
MIICHDCCAcKgAwIBAgIUacxcub/wg7IelStXNkgaiSS6syowCgYIKoZIzj0EAwIw
307+
UjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1J
308+
VDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNjE1MTY1
309+
MTA2WhcNMjYwNjE2MTY1MTA2WjBOMSkwJwYDVQQDDCBodHRwczovL2ludGVybWVk
310+
aWF0ZS5leGFtcGxlLm5ldDEUMBIGA1UECgwLRXhhbXBsZSBJTlQxCzAJBgNVBAYT
311+
AklUMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZcOJK9fXANy51BFirWXOCipi
312+
qFWFH4TlRwbAj8L4eYNV5oCqMiY8sxhtK3qX6BdUBYBiio7IQBIhmeLXFBi+2aN6
313+
MHgwEgYDVR0TAQH/BAgwBgEB/wIBATAOBgNVHQ8BAf8EBAMCAaYwUgYDVR0fBEsw
314+
STBHoEWgQ4ZBaHR0cHM6Ly9pbnRlcm1lZGlhdGUuZXhhbXBsZS5uZXQvY3JsL2lu
315+
dGVybWVkaWF0ZS5leGFtcGxlLm5ldC5jcmwwCgYIKoZIzj0EAwIDSAAwRQIhAJMk
316+
C6fSNuhegoI4wQa057vespZDawTeRotGMY/sU3fnAiB3wpPqzLnEIldTJQeztA0f
317+
2TqlVlfiUgsTaGDC/rRtbg==
318+
-----END CERTIFICATE-----
319+
- |
320+
-----BEGIN CERTIFICATE-----
321+
MIICJzCCAc6gAwIBAgIUFqb+aMtaYydHFIh9qXKzZVz7eQYwCgYIKoZIzj0EAwIw
322+
UjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1J
323+
VDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNjE1MTY1
324+
MTA2WhcNMjYwNjE2MTY1MTA2WjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxlLmNv
325+
bSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQswCQYD
326+
VQQGEwJJVDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJOfDFsMn2zgJ1Kb5hXU
327+
r/dDyOwRjm2LRiVFjgUSnhy/09FapToxjB7FAGZMJb/Q3JyCUc32WOGfXYA5izT+
328+
Ul6jgYEwfzASBgNVHRMBAf8ECDAGAQH/AgECMBkGA1UdEQQSMBCCDmNhLmV4YW1w
329+
bGUuY29tMA4GA1UdDwEB/wQEAwIBpjA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczov
330+
L2NhLmV4YW1wbGUuY29tL2NybC9jYS5leGFtcGxlLmNvbS5jcmwwCgYIKoZIzj0E
331+
AwIDRwAwRAIgafkpE88vVHf1AoNrRvqLNaiRwdw569kUbhwVrbXN7dYCIH0OkXvk
332+
tX5+FvfFc70mO+2FvYtOV0U4pruy8e807ATO
333+
-----END CERTIFICATE-----
334+
362335
private_keys: *metadata_jwks
363336

364337
# Mongodb database configuration

‎pyeudiw/satosa/default/openid4vp_backend.py‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -241,10 +241,16 @@ def pre_request_endpoint(
241241
"internal error: something went wrong when creating your authentication request",
242242
e500
243243
)
244+
245+
qs_params = getattr(context, "qs_params") or {}
246+
client_id_hint = qs_params.get("client_id_hint", None)
247+
has_client_id_hint = client_id_hint is not None and self.trust_evaluator.has_client_id(
248+
client_id_hint
249+
)
244250

245251
# PAR
246252
payload = {
247-
"client_id": self.client_id,
253+
"client_id": client_id_hint if has_client_id_hint else self.client_id,
248254
"request_uri": f"{self.absolute_request_url}?id={state}",
249255
}
250256

‎pyeudiw/sd_jwt/common.py‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,6 @@ class SDJWTCommon:
3636

3737
COMBINED_SERIALIZATION_FORMAT_SEPARATOR = "~"
3838

39-
unsafe_randomness = False
40-
4139
def __init__(self, serialization_format):
4240
if serialization_format not in ("compact", "json"):
4341
raise ValueError(f"Unknown serialization format: {serialization_format}")
@@ -113,17 +111,7 @@ def _generate_salt(self) -> str:
113111
:return: The salt.
114112
:rtype: str
115113
"""
116-
if self.unsafe_randomness:
117-
# This is not cryptographically secure, but it is deterministic
118-
# and allows for repeatable output for the generation of the examples.
119-
logger.warning(
120-
"Using unsafe randomness is not suitable for production use."
121-
)
122-
return self._base64url_encode(
123-
bytes(random.getrandbits(8) for _ in range(16))
124-
)
125-
else:
126-
return self._base64url_encode(secrets.token_bytes(16))
114+
return self._base64url_encode(secrets.token_bytes(16))
127115

128116
def _create_hash_mappings(self, disclosurses_list: List) -> None:
129117
"""

‎pyeudiw/tests/openid4vp/test_vp_mdoc_cbor.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@
2626
"module": "pyeudiw.trust.handler.x509",
2727
"class": "X509Handler",
2828
"config": {
29-
"client_id": f"{BASE_URL}/OpenID4VP",
30-
"relying_party_certificate_chains_by_ca":{
31-
"ca.example.com": DEFAULT_X509_CHAIN,
29+
"client_id": f"x509_san_dns:{BASE_URL.split('://')[-1]}",
30+
"include_issued_jwt_header_param": True,
31+
"leaf_certificate_chains_by_ca": {
32+
f"ca.example.com": DEFAULT_X509_CHAIN,
3233
},
3334
"certificate_authorities": {
3435
"ca.example.com": DER_cert_to_PEM_cert(DEFAULT_X509_CHAIN[-1]),

‎pyeudiw/tests/satosa/test_backend.py‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
from pyeudiw.tests.settings import (
3737
BASE_URL,
3838
CONFIG,
39+
BACKEND_NAME,
3940
CREDENTIAL_ISSUER_CONF,
4041
CREDENTIAL_ISSUER_ENTITY_ID,
4142
INTERNAL_ATTRIBUTES,
@@ -158,7 +159,7 @@ def create_backend(self):
158159
INTERNAL_ATTRIBUTES,
159160
CONFIG,
160161
BASE_URL,
161-
"name"
162+
BACKEND_NAME
162163
)
163164

164165
url_map = self.backend.register_endpoints()
@@ -273,7 +274,7 @@ def _initialize_session(self, nonce, state, session_id, remote_flow_typ = "same_
273274
request_object=request_object)
274275

275276
def test_backend_init(self):
276-
assert self.backend.name == "name"
277+
assert self.backend.name == BACKEND_NAME
277278

278279
# TODO: Move to trust evaluation handlers tests
279280
def test_entity_configuration(self, context):
@@ -302,6 +303,23 @@ def test_pre_request_without_frontend(self):
302303
assert resp.status == "400"
303304
assert resp.message is not None
304305

306+
def test_pre_request_with_client_id_hint(self, context):
307+
context.http_headers = dict(
308+
HTTP_USER_AGENT="Mozilla/5.0 (Linux; Android 10; SM-G960F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36"
309+
)
310+
context.qs_params = {"client_id_hint": f"openid_federation:{BASE_URL}/{BACKEND_NAME}"}
311+
resp = self.backend.pre_request_endpoint(context, InternalData())
312+
313+
assert resp is not None
314+
assert resp.status == "302 Found"
315+
assert resp.message is not None
316+
317+
parsed = urllib.parse.unquote(
318+
resp.message, encoding="utf-8", errors="replace"
319+
)
320+
321+
assert "openid_federation:https://example.com/OpenID4VP" in parsed
322+
305323
def test_pre_request_endpoint(self, context):
306324
internal_data = InternalData()
307325
context.http_headers = dict(

0 commit comments

Comments
 (0)