pyeudiw.satosa.backends.openid4vp package

Subpackages

Submodules

pyeudiw.satosa.backends.openid4vp.authorization_request module

pyeudiw.satosa.backends.openid4vp.authorization_request.build_authorization_request_claims(client_id: str, state: str, response_uri: str, default_claims: dict, nonce: str = '', client_metadata: dict | None = None, submission_data: dict | None = None, wallet_nonce: str | None = None) → dict[source]

Primitive function to build the payload claims of the (JAR) authorization request.

Parameters:

  • client_id (str) – the client identifier (who issues the JAR token)

  • state (str) – request session identifier

  • response_uri (str) – endpoint accepting authorization responses

  • default_claims (dict) – a dictionary with the default claims to be used in the request object. It must contain the following mandatory keys: - “expiration_time”: the expiration time in minutes of the request object - “response_mode”: the response mode to be used in the request object - “auth_iss_id”: the issuer identifier of the authorization server - “aud”: the audience of the request object

  • nonce (str) – optional nonce to be inserted in the request object; if not set, a new cryptographically safe uuid v4 nonce is generated.

  • client_metadata (dict) – optional client_metadata to be included in the request object

  • submission_data (dict) – optional submission data, such as the duckle query, to be included in the request object. If this parameter is set, the duckle data is used to build the request object; else the presentation definition retrocompatibility is used.

  • wallet_nonce (str) – optional nonce to be used by the wallet.

Raises:

KeyError – if authorization_config misses mandatory configuration options

Returns:

a dictionary with the complete set of JAR JWT payload claims

Return type:

dict

pyeudiw.satosa.backends.openid4vp.authorization_request.build_authorization_request_url(scheme: str, params: dict) → str[source]

Build authorization request URL that let the wallet download the request object. This is loosely realted to RFC9101 [JAR], section 5.2.1. The scheme is either the scheme portion of a deeplink, such as “haip” or “eudiw”, while params is a dictitonary of query parameters not urlencoded.

pyeudiw.satosa.backends.openid4vp.authorization_response module

pyeudiw.satosa.backends.openid4vp.exceptions module

exception pyeudiw.satosa.backends.openid4vp.exceptions.AuthRespParsingException[source]

Bases: Exception

Raised when the http request corresponding to an authorization response is malformed.

exception pyeudiw.satosa.backends.openid4vp.exceptions.AuthRespValidationException[source]

Bases: Exception

Raised when the http request corresponding to an authorization response is well formed, but not valid (for example, it might be wrapped in an expired token).

exception pyeudiw.satosa.backends.openid4vp.exceptions.InvalidVPToken[source]

Bases: Exception

Raised when a given VP is invalid

exception pyeudiw.satosa.backends.openid4vp.exceptions.MdocCborValidationError[source]

Bases: Exception

Raised when a given VP not contain the issuer

exception pyeudiw.satosa.backends.openid4vp.exceptions.MissingIssuer[source]

Bases: Exception

Raised when a given VP not contain the issuer

exception pyeudiw.satosa.backends.openid4vp.exceptions.NotKBJWT[source]

Bases: Exception

Raised when a given VP format is not Key Binding JWT format

exception pyeudiw.satosa.backends.openid4vp.exceptions.VPExpired[source]

Bases: Exception

Raised when a given VP is expired

exception pyeudiw.satosa.backends.openid4vp.exceptions.VPFormatNotSupported[source]

Bases: Exception

Raised when a given VP format is not supported

exception pyeudiw.satosa.backends.openid4vp.exceptions.VPRevoked[source]

Bases: Exception

Raised when a given VP is revoked

pyeudiw.satosa.backends.openid4vp.interface module

class pyeudiw.satosa.backends.openid4vp.interface.AuthorizationResponseParser[source]

Bases: object

AuthorizationResponseParser is an interface intended to parse direct POST http responses.

An authorization parser is meant to just parse and eventually validate the “lower” applicaiton layer of the transmission, that is, it is used to extract an authorization response from the HTTP layer. It SHOULD NOT be used to validate the actual content of the response, that is, it SHOULD NOT try to validate vp_tokens, presentation_submissions, etc. This is a delicate task that that is best suited for a different, dedicated object, method or interface.

parse_and_validate(context: Context) → AuthorizeResponsePayload[source]

Parse (and optionally validate) a satosa http request, wrapped in its own context, in order to extract an auhtorization response. The validation step might include verification tasks; for example if the data is reepresented as a jwt, the validation should perform a check on the jwt validity.

The concrete implementation SHOULD NOT be used to validate the actual content of the response, that is, it SHOULD NOT try to validate vp_tokens, presentation_submissions, etc. This is a delicate task that that is best suited for a different, dedicated object, method or interface.

Parameters:

context (satosa.context.Context) – an http request wrapped in its own satosa context

Raises:
Returns:

the plain openid4vp authorization response; DCQL is not supported yet

Return type:

AuthorizeResponsePayload

class pyeudiw.satosa.backends.openid4vp.interface.VpTokenParser[source]

Bases: object

VpTokenParser is an interface that specify that an object is able to extract verifiable credentials from a VP token.

get_credentials() → dict[source]
get_issuer_name() → str[source]

Get the issuer name from the token payload.

Raises:

MissingIssuer – if the issuer name is missing in the token payload

Returns:

the issuer name

Return type:

str

class pyeudiw.satosa.backends.openid4vp.interface.VpTokenVerifier[source]

Bases: object

VpTokenVerifier is an interface that specify that an object is able to verify a vp token. The interface supposes that the verification process requires a public key (os the token issuer)

is_active() → bool[source]
is_expired() → bool[source]
is_revoked() → bool[source]
Returns:

if the credential is revoked

verify_challenge() → None[source]

Verifies the challenge of the jwt.

Raises:
verify_signature(public_key: ECKey | RSAKey | dict) → None[source]

Verifies the signature of the jwt.

Parameters:

public_key (ECKey | RSAKey | dict) – the public key to verify the signature

Raises:

JWSVerificationError – if the signature is invalid

pyeudiw.satosa.backends.openid4vp.openid4vp module

class pyeudiw.satosa.backends.openid4vp.openid4vp.OpenID4VPBackend(auth_req_callback_func: Callable[[Context, InternalData], Response], internal_attributes: dict[str, dict[str, str | list[str]]], config: dict[str, Any], base_url: str, name: str)[source]

Bases: BackendModule

get_trust_backend_by_class_name(class_name: str) → TrustHandlerInterface | None[source]
register_endpoints(**kwargs)[source]

See super class satosa.backends.base.BackendModule

Return type:

list[(str, ((satosa.context.Context, Any) -> satosa.response.Response, Any))]

Raises:

ValueError – if more than one backend is configured

start_auth(context: Context, internal_request) → Response[source]

This is the start up function of the backend authorization.

Parameters:

  • context (satosa.context.Context) – the request context

  • internal_request (satosa.internal.InternalData) – Information about the authorization request

Return type:

satosa.response.Response

Returns:

response

pyeudiw.satosa.backends.openid4vp.utils module

pyeudiw.satosa.backends.openid4vp.utils.detect_flow_typ(context: Context, force_same_device_flow_referer_criteria: List[str] | None = None) → RemoteFlowType[source]

Identify or guess the remote flow type based on the authentication context. The logic is as follows: If the User-Agent clearly indicates a smartphone -> SAME_DEVICE If the request has sec-fetch-site == “cross-site” AND the Referer matches at least one of the regex patterns in referer_criteria -> SAME_DEVICE Otherwise -> CROSS_DEVICE

Parameters context: the context of the user authentication force_same_device_flow_referer_criteria: optional list of regex patterns (as strings) that, if matched against the HTTP_REFERER header, indicate a wallet-originated request.

Returns the detected remote flow type (RemoteFlowType).

pyeudiw.satosa.backends.openid4vp.vp module

class pyeudiw.satosa.backends.openid4vp.vp.Vp[source]

Bases: BaseLogger

Class for Verifiable Presentation istance.

check_revocation()[source]

Check if the VP is revoked.

Raises:

RevokedVPToken – if the VP is revoked.

parse_digital_credential() → None[source]
verify(**kwargs) → bool[source]

pyeudiw.satosa.backends.openid4vp.vp_mdoc_cbor module

pyeudiw.satosa.backends.openid4vp.vp_sd_jwt_vc module

Module contents