Entity Configuration of Relying Parties¶
According to Section Configuration of the Federation, as a Federation Entity, the Relying Party is required to maintain a well-known endpoint that hosts its Entity Configuration. The Entity Configuration of Relying Parties MUST contain the parameters defined in the Sections Entity Configuration Leaves and Intermediates and Entity Configurations Common Parameters.
The Relying Parties MUST provide the following metadata types:
federation_entity
wallet_relying_party
Metadata for federation_entity¶
The federation_entity metadata MUST contain the claims as defined in Section Metadata of federation_entity Leaves.
Metadata for wallet_relying_party¶
The wallet_relying_party metadata MUST contain the following parameters.
Claim |
Description |
|---|---|
client_id |
It MUST contain an HTTPS URL that uniquely identifies the RP. See RFC 7591#section-3.2.1 and OpenID Connect Dynamic Client Registration 1.0 Section 3.2. |
client_name |
Human-readable string name of the RP. See RFC 7591#section-2. |
application_type |
String indicating the type of application. It MUST be set to "web" value. See OpenID Connect Dynamic Client Registration 1.0 Section 2. |
request_uris |
JSON Array of request_uri values that are pre-registered by the RP. These URLs MUST use the https scheme. See OpenID Connect Dynamic Client Registration 1.0 Section 2. |
response_uris_supported |
JSON Array of response URI strings to which the Wallet Instance MUST send the Authorization Response using an HTTP POST request as defined by the Response Mode |
authorization_signed_response_alg |
String representing the JWS [RFC 7515] alg algorithm that MUST be used for signing authorization responses. The algorithm none MUST NOT be used. See [oauth-v2-jarm-03] Section 3. |
vp_formats |
JSON object defining the formats and proof types of Verifiable Presentations and Verifiable Credentials the RP supports. It consists of a list of name/value pairs, where each name uniquely identifies a supported type. The RP MUST support at least "vc+sd-jwt" according to OPENID4VC-HAIP Draft 00 Section 7.2.7. The value associated with each name/value pair MUST be a JSON object "sd-jwt_alg_values" that MUST contain a JSON array containing identifiers of cryptographic algorithms the RP supports for protection of a SD-JWT. The alg JOSE header (as defined in RFC 7515) of the presented SD-JWT MUST match one of the array values. See also OpenID4VP Draft 20 Section 9.1. |
presentation_definitions_supported |
JSON Array of supported presentation_definition objects that MUST be compliant to the syntax defined in Section 5 of [DIF.PresentationExchange] and Section 7.2.8 of OPENID4VC-HAIP Draft 00. For presentation_definition objects see also OpenID4VP Section 5.1. |
jwks |
JSON Web Key Set document, passed by value, containing the protocol specific keys for the Relying Party. See [oauth-v2-jarm-03] Section 3, OID-FED Draft 36 Section 5.2.1 and JWK. |
Note
The claims response_uris_supported and presentation_definitions_supported are introduced in this Specification.
Example of a Relying Party Entity Configuration¶
Below a non-normative example of the request made by the Wallet Instance to the openid-federation well-known endpoint to obtain the Relying Party Entity Configuration:
GET /.well-known/openid-federation HTTP/1.1
HOST: relying-party.example.org
Below is a non-normative response example:
{
"iat": 1718207217,
"exp": 1749743216,
"iss": "https://relying-party.example.org",
"sub": "https://relying-party.example.org",
"authority_hints": [
"https://trust-anchor.example.org"
],
"jwks": {
"keys": [
{
"kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
"kty": "EC",
"crv": "P-256",
"x": "jE2RpcQbFQxKpMqehahgZv6smmXD0i/LTP2QRzMADk4",
"y": "qkMx5iqt5PhPu5tfctS6HsP+FmLgrxfrzUV2GwMQuh8"
}
]
},
"metadata": {
"federation_entity": {
"homepage_uri": "https://relying-party.example.org",
"organization_name": "Organization Name",
"contacts": [
"informazioni@example.it",
"protocollo@pec.example.it"
],
"tos_uri": "https://relying-party.example.org/public/info_policy.html",
"policy_uri": "https://relying-party.example.org/public/privacy_policy.html",
"logo_uri": "https://relying-party.example.org/public/logo.svg"
},
"wallet_relying_party": {
"application_type": "web",
"client_id": "https://relying-party.example.org",
"client_name": "Organization Name",
"contacts": [
"informazioni@example.it",
"protocollo@pec.example.it"
],
"request_uris": [
"https://relying-party.example.org/request_uri"
],
"response_uris_supported": [
"https://relying-party.example.org/response_uri"
],
"authorization_signed_response_alg": "ES256",
"vp_formats": {
"vc+sd-jwt": {
"sd-jwt_alg_values": [
"ES256",
"ES384",
"ES512"
]
}
},
"presentation_definitions_supported": [
{
"id": "d76c51b7-ea90-49bb-8368-6b3d194fc131",
"input_descriptors": [
{
"id": "PersonIdentificationData",
"name": "Person Identification Data",
"purpose": "User Authentication",
"format": {
"vc+sd-jwt": {
"alg": [
"ES256",
"ES384",
"ES512"
]
}
},
"constraints": {
"limit_disclosure": "required",
"fields": [
{
"filter": {
"const": "PersonIdentificationData",
"type": "string"
},
"path": [
"$.vct"
]
},
{
"filter": {
"type": "object"
},
"path": [
"$.cnf.jwk"
]
},
{
"path": [
"$.unique_id"
]
},
{
"path": [
"$.tax_id_code"
]
}
]
}
},
{
"id": "WalletAttestation",
"name": "Wallet Attestation",
"purpose": "Wallet Authentication",
"format": {
"jwt": {
"alg": [
"ES256",
"ES384",
"ES512"
]
}
},
"constraints": {
"limit_disclosure": "required",
"fields": [
{
"filter": {
"type": "string"
},
"path": [
"$.iss"
]
},
{
"filter": {
"type": "object"
},
"path": [
"$.cnf.jwk"
]
}
]
}
}
]
}
],
"jwks": {
"keys": [
{
"kid": "f10aca0992694b3581f6f699bfc8a2c6cc687725",
"kty": "EC",
"crv": "P-256",
"x": "jE2RpcQbFQxKpMqehahgZv6smmXD0i/LTP2QRzMADk4",
"y": "qkMx5iqt5PhPu5tfctS6HsP+FmLgrxfrzUV2GwMQuh8"
}
]
}
}
}
}