feat: OpenIdFed for the verifier

packages/openid4vc/package.json

@@ -42,6 +42,7 @@
     "class-transformer": "catalog:",
     "rxjs": "catalog:",
     "zod": "catalog:",
+    "@openid-federation/core": "0.1.1-alpha.17",
     "@openid4vc/openid4vci": "0.3.0-alpha-20251031103301",
     "@openid4vc/oauth2": "0.3.0-alpha-20251031103301",
     "@openid4vc/openid4vp": "0.3.0-alpha-20251031103301",

packages/openid4vc/src/openid4vc-holder/OpenId4VcHolderApi.ts

@@ -22,6 +22,7 @@ import type {
 import { OpenId4VpHolderService } from './OpenId4vpHolderService'
 import type {
   OpenId4VpAcceptAuthorizationRequestOptions,
+  OpenId4VpResolveTrustChainsOptions,
   ResolveOpenId4VpAuthorizationRequestOptions,
 } from './OpenId4vpHolderServiceOptions'
 
@@ -219,4 +220,8 @@ export class OpenId4VcHolderApi {
   public async sendNotification(options: OpenId4VciSendNotificationOptions) {
     return this.openId4VciHolderService.sendNotification(this.agentContext, options)
   }
+
+  public async resolveOpenIdFederationChains(options: OpenId4VpResolveTrustChainsOptions) {
+    return this.openId4VpHolderService.resolveOpenIdFederationChains(this.agentContext, options)
+  }
 }

packages/openid4vc/src/openid4vc-holder/OpenId4vpHolderService.ts

@@ -16,9 +16,14 @@ import {
   DifPresentationExchangeSubmissionLocation,
   Hasher,
   injectable,
+  JwsService,
   Kms,
   TypedArrayEncoder,
 } from '@credo-ts/core'
+import {
+  fetchEntityConfiguration as federationFetchEntityConfiguration,
+  resolveTrustChains as federationResolveTrustChains,
+} from '@openid-federation/core'
 import type { Jwk } from '@openid4vc/oauth2'
 import {
   extractEncryptionJwkFromJwks,
@@ -35,7 +40,9 @@ import type { OpenId4VpVersion } from '../openid4vc-verifier'
 import { getOid4vcCallbacks } from '../shared/callbacks'
 import type {
   OpenId4VpAcceptAuthorizationRequestOptions,
+  OpenId4VpFetchEntityConfigurationOptions,
   OpenId4VpResolvedAuthorizationRequest,
+  OpenId4VpResolveTrustChainsOptions,
   ParsedTransactionDataEntry,
   ResolveOpenId4VpAuthorizationRequestOptions,
 } from './OpenId4vpHolderServiceOptions'
@@ -49,10 +56,15 @@ export class OpenId4VpHolderService {
 
   private getOpenid4vpClient(
     agentContext: AgentContext,
-    options?: { trustedCertificates?: EncodedX509Certificate[]; isVerifyOpenId4VpAuthorizationRequest?: boolean }
+    options?: {
+      trustedCertificates?: EncodedX509Certificate[]
+      trustedFederationEntityIds?: string[]
+      isVerifyOpenId4VpAuthorizationRequest?: boolean
+    }
   ) {
     const callbacks = getOid4vcCallbacks(agentContext, {
       trustedCertificates: options?.trustedCertificates,
+      trustedFederationEntityIds: options?.trustedFederationEntityIds,
       isVerifyOpenId4VpAuthorizationRequest: options?.isVerifyOpenId4VpAuthorizationRequest,
     })
     return new Openid4vpClient({ callbacks })
@@ -121,6 +133,7 @@ export class OpenId4VpHolderService {
   ): Promise<OpenId4VpResolvedAuthorizationRequest> {
     const openid4vpClient = this.getOpenid4vpClient(agentContext, {
       trustedCertificates: options?.trustedCertificates,
+      trustedFederationEntityIds: options?.trustedFederationEntityIds,
       isVerifyOpenId4VpAuthorizationRequest: true,
     })
     const { params } = openid4vpClient.parseOpenid4vpAuthorizationRequest({ authorizationRequest })
@@ -138,11 +151,47 @@ export class OpenId4VpHolderService {
       client.prefix !== 'x509_hash' &&
       client.prefix !== 'decentralized_identifier' &&
       client.prefix !== 'origin' &&
-      client.prefix !== 'redirect_uri'
+      client.prefix !== 'redirect_uri' &&
+      client.prefix !== 'openid_federation'
     ) {
       throw new CredoError(`Client id prefix '${client.prefix}' is not supported`)
     }
 
+    if (client.prefix === 'openid_federation') {
+      const jwsService = agentContext.dependencyManager.resolve(JwsService)
+
+      const entityConfiguration = await federationFetchEntityConfiguration({
+        entityId: client.identifier,
+        verifyJwtCallback: async ({ jwt, jwk }) => {
+          const res = await jwsService.verifyJws(agentContext, {
+            jws: jwt,
+            jwsSigner: {
+              method: 'jwk',
+              jwk: Kms.PublicJwk.fromUnknown(jwk),
+            },
+          })
+
+          return res.isValid
+        },
+      })
+      if (!entityConfiguration)
+        throw new CredoError(`Unable to fetch entity configuration for entityId '${client.identifier}'`)
+
+      const openidRelyingPartyMetadata = entityConfiguration.metadata?.openid_relying_party
+      if (!openidRelyingPartyMetadata) {
+        throw new CredoError(`Federation entity '${client.identifier}' does not have 'openid_relying_party' metadata.`)
+      }
+
+      // FIXME: we probably don't want to override this, but otherwise the accept logic doesn't have
+      // access to the correct metadata. Should we also pass client to accept?
+      // @ts-expect-error
+      verifiedAuthorizationRequest.authorizationRequestPayload.client_metadata = openidRelyingPartyMetadata
+      // FIXME: we should not just override the metadata?
+      // When federation is used we need to use the federation metadata
+      // @ts-expect-error
+      client.clientMetadata = openidRelyingPartyMetadata
+    }
+
     const returnValue = {
       authorizationRequestPayload: verifiedAuthorizationRequest.authorizationRequestPayload,
       origin: options?.origin,
@@ -169,6 +218,7 @@ export class OpenId4VpHolderService {
       verifier: {
         clientIdPrefix: client.prefix,
         effectiveClientId: client.effective,
+        clientMetadata: client.clientMetadata,
       },
       transactionData: pexResult?.matchedTransactionData ?? dcqlResult?.matchedTransactionData,
       presentationExchange: pexResult?.pex,
@@ -504,6 +554,8 @@ export class OpenId4VpHolderService {
 
     const response = await openid4vpClient.createOpenid4vpAuthorizationResponse({
       authorizationRequestPayload,
+      // We overwrite the client metadata on the authorization request payload when using OpenID Federation
+      clientMetadata: authorizationRequestPayload.client_metadata,
       origin: options.origin,
       authorizationResponsePayload: {
         vp_token: vpToken,
@@ -581,4 +633,50 @@ export class OpenId4VpHolderService {
       presentationDuringIssuanceSession: responseJson?.presentation_during_issuance_session as string | undefined,
     } as const
   }
+
+  public async resolveOpenIdFederationChains(agentContext: AgentContext, options: OpenId4VpResolveTrustChainsOptions) {
+    const jwsService = agentContext.dependencyManager.resolve(JwsService)
+
+    const { entityId, trustAnchorEntityIds } = options
+
+    return federationResolveTrustChains({
+      entityId,
+      trustAnchorEntityIds,
+      verifyJwtCallback: async ({ jwt, jwk }) => {
+        const res = await jwsService.verifyJws(agentContext, {
+          jws: jwt,
+          jwsSigner: {
+            method: 'jwk',
+            jwk: Kms.PublicJwk.fromUnknown(jwk),
+          },
+        })
+
+        return res.isValid
+      },
+    })
+  }
+
+  public async fetchOpenIdFederationEntityConfiguration(
+    agentContext: AgentContext,
+    options: OpenId4VpFetchEntityConfigurationOptions
+  ) {
+    const jwsService = agentContext.dependencyManager.resolve(JwsService)
+
+    const { entityId } = options
+
+    return federationFetchEntityConfiguration({
+      entityId,
+      verifyJwtCallback: async ({ jwt, jwk }) => {
+        const res = await jwsService.verifyJws(agentContext, {
+          jws: jwt,
+          jwsSigner: {
+            method: 'jwk',
+            jwk: Kms.PublicJwk.fromUnknown(jwk),
+          },
+        })
+
+        return res.isValid
+      },
+    })
+  }
 }

packages/openid4vc/src/openid4vc-holder/OpenId4vpHolderServiceOptions.ts

@@ -6,14 +6,15 @@ import type {
   DifPresentationExchangeDefinition,
   EncodedX509Certificate,
 } from '@credo-ts/core'
-import type { ResolvedOpenid4vpAuthorizationRequest } from '@openid4vc/openid4vp'
+import type { ClientMetadata, ResolvedOpenid4vpAuthorizationRequest } from '@openid4vc/openid4vp'
 import type { OpenId4VpAuthorizationRequestPayload } from '../shared'
 
 // TODO: export from oid4vp
 export type ParsedTransactionDataEntry = NonNullable<ResolvedOpenid4vpAuthorizationRequest['transactionData']>[number]
 
 export interface ResolveOpenId4VpAuthorizationRequestOptions {
   trustedCertificates?: EncodedX509Certificate[]
+  trustedFederationEntityIds?: string[]
   origin?: string
 }
 
@@ -83,8 +84,8 @@ export interface OpenId4VpResolvedAuthorizationRequest {
      * The client id metadata.
      *
      * In case of 'openid_federation' client id prefix, this will be the metadata from the federation.
-     * clientMetadata?: ClientMetadata
      */
+    clientMetadata?: ClientMetadata
   }
 
   /**
@@ -135,3 +136,12 @@ export interface OpenId4VpAcceptAuthorizationRequestOptions {
    */
   origin?: string
 }
+
+export interface OpenId4VpResolveTrustChainsOptions {
+  entityId: string
+  trustAnchorEntityIds: [string, ...string[]]
+}
+
+export interface OpenId4VpFetchEntityConfigurationOptions {
+  entityId: string
+}

packages/openid4vc/src/openid4vc-issuer/OpenId4VcIssuerModule.ts

@@ -22,6 +22,7 @@ import {
   configurePushedAuthorizationRequestEndpoint,
   configureRedirectEndpoint,
 } from './router'
+import { configureFederationEndpoint } from './router/federationEndpoint'
 
 /**
  * @public
@@ -189,6 +190,7 @@ export class OpenId4VcIssuerModule implements Module {
     configurePushedAuthorizationRequestEndpoint(issuerEndpointsRouter, this.config)
     configureAuthorizationEndpoint(issuerEndpointsRouter, this.config)
     configureRedirectEndpoint(issuerEndpointsRouter, this.config)
+    configureFederationEndpoint(issuerEndpointsRouter)
 
     // First one will be called for all requests (when next is called)
     issuerContextRouter.use(async (req: OpenId4VcIssuanceRequest, _res: unknown, next) => {

packages/openid4vc/src/openid4vc-issuer/router/federationEndpoint.ts

@@ -0,0 +1,116 @@
+import { type Buffer, Kms } from '@credo-ts/core'
+import { createEntityConfiguration, type EntityConfigurationClaimsOptions } from '@openid-federation/core'
+import type { Response, Router } from 'express'
+import { getRequestContext, sendErrorResponse } from '../../shared/router'
+import type { OpenId4VcIssuanceRequest } from './requestContext'
+
+// TODO: It's also possible that the issuer and the verifier can have the same openid-federation endpoint. In that case we need to combine them.
+
+export function configureFederationEndpoint(router: Router) {
+  // TODO: this whole result needs to be cached and the ttl should be the expires of this node
+
+  router.get('/.well-known/openid-federation', async (request: OpenId4VcIssuanceRequest, response: Response, next) => {
+    const { agentContext, issuer } = getRequestContext(request)
+
+    try {
+      const kms = agentContext.resolve(Kms.KeyManagementApi)
+
+      // TODO: Should be only created once per issuer and be used between instances
+      const federationKey = Kms.PublicJwk.fromPublicJwk(
+        (
+          await kms.createKey({
+            type: {
+              kty: 'OKP',
+              crv: 'Ed25519',
+            },
+          })
+        ).publicJwk
+      )
+
+      const now = new Date()
+      const expires = new Date(now.getTime() + 1000 * 60 * 60 * 24) // 1 day from now
+
+      // TODO: We need to generate a key and always use that for the entity configuration
+
+      const kid = federationKey.keyId
+      const alg = federationKey.signatureAlgorithm
+
+      const issuerDisplay = issuer.display?.[0]
+
+      const entityConfiguration = await createEntityConfiguration({
+        claims: {
+          sub: issuer.issuerId,
+          iss: issuer.issuerId,
+          iat: now,
+          exp: expires,
+          jwks: {
+            keys: [{ alg, ...federationKey.toJson() } as EntityConfigurationClaimsOptions['jwks']['keys'][number]],
+          },
+          metadata: {
+            federation_entity: issuerDisplay
+              ? {
+                  organization_name: issuerDisplay.name,
+                  logo_uri: issuerDisplay.logo?.uri,
+                }
+              : undefined,
+            openid_provider: {
+              // TODO: The type isn't correct yet down the line so that needs to be updated before
+              // credential_issuer: issuerMetadata.issuerUrl,
+              // token_endpoint: issuerMetadata.tokenEndpoint,
+              // credential_endpoint: issuerMetadata.credentialEndpoint,
+              // authorization_server: issuerMetadata.authorizationServer,
+              // authorization_servers: issuerMetadata.authorizationServer
+              //   ? [issuerMetadata.authorizationServer]
+              //   : undefined,
+              // credentials_supported: issuerMetadata.credentialsSupported,
+              // credential_configurations_supported: issuerMetadata.credentialConfigurationsSupported,
+              // display: issuerMetadata.issuerDisplay,
+              // dpop_signing_alg_values_supported: issuerMetadata.dpopSigningAlgValuesSupported,
+
+              client_registration_types_supported: ['automatic'],
+              jwks: {
+                keys: [
+                  // TODO: Not 100% sure if this is the right key that we want to expose here or a different one
+                  issuer.resolvedAccessTokenPublicJwk.toJson() as EntityConfigurationClaimsOptions['jwks']['keys'][number],
+                ],
+              },
+            },
+          },
+        },
+        header: {
+          kid,
+          alg,
+          typ: 'entity-statement+jwt',
+        },
+        signJwtCallback: async ({ toBeSigned }) => {
+          const kms = agentContext.resolve(Kms.KeyManagementApi)
+          const signed = await kms.sign({
+            data: toBeSigned as Buffer,
+            algorithm: federationKey.signatureAlgorithm,
+            keyId: federationKey.keyId,
+          })
+
+          return signed.signature
+        },
+      })
+
+      response.writeHead(200, { 'Content-Type': 'application/entity-statement+jwt' }).end(entityConfiguration)
+    } catch (error) {
+      agentContext.config.logger.error('Failed to create entity configuration', {
+        error,
+      })
+      sendErrorResponse(
+        response,
+        next,
+        agentContext.config.logger,
+        500,
+        'invalid_request',
+        'Failed to create entity configuration'
+      )
+      return
+    }
+
+    // NOTE: if we don't call next, the agentContext session handler will NOT be called
+    next()
+  })
+}

packages/openid4vc/src/openid4vc-verifier/OpenId4VcVerifierModule.ts

@@ -7,7 +7,7 @@ import { OpenId4VcVerifierModuleConfig } from './OpenId4VcVerifierModuleConfig'
 import { OpenId4VpVerifierService } from './OpenId4VpVerifierService'
 import { OpenId4VcVerifierRepository } from './repository'
 import type { OpenId4VcVerificationRequest } from './router'
-import { configureAuthorizationEndpoint } from './router'
+import { configureAuthorizationEndpoint, configureFederationEndpoint } from './router'
 import { configureAuthorizationRequestEndpoint } from './router/authorizationRequestEndpoint'
 
 /**
@@ -75,6 +75,10 @@ export class OpenId4VcVerifierModule implements Module {
     configureAuthorizationEndpoint(verifierEndpointRouter, this.config)
     configureAuthorizationRequestEndpoint(verifierEndpointRouter, this.config)
 
+    // TODO: The keys needs to be passed down to the federation endpoint to be used in the entity configuration for the openid relying party
+    // TODO: But the keys also needs to be available for the request signing. They also needs to get saved because it needs to survive a restart of the agent.
+    configureFederationEndpoint(verifierEndpointRouter, this.config.federation)
+
     // First one will be called for all requests (when next is called)
     verifierContextRouter.use(async (req: OpenId4VcVerificationRequest, _res: unknown, next) => {
       const { agentContext } = getRequestContext(req)