{"id":46252023,"url":"https://github.com/eclipse-xfsc/oid4-vci-authorization-bridge","last_synced_at":"2026-04-02T13:36:22.337Z","repository":{"id":289366384,"uuid":"963959060","full_name":"eclipse-xfsc/oid4-vci-authorization-bridge","owner":"eclipse-xfsc","description":"The pre authorization provides the new grant type for the OID4VCI flow to support issuing operations with the pre authorization flow. This bridge can be later configured in the open id configuration under the type urn:ietf:params:oauth:grant-type:pre-authorized_code which is defined in the OID4VCI Spec ","archived":false,"fork":false,"pushed_at":"2026-03-25T22:17:24.000Z","size":180,"stargazers_count":0,"open_issues_count":5,"forks_count":0,"subscribers_count":7,"default_branch":"main","last_synced_at":"2026-03-26T21:12:38.849Z","etag":null,"topics":["golang","oauth2","ocm-w-stack","oid4vci","pre-authorized-code","vc","vp"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eclipse-xfsc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-04-10T13:26:36.000Z","updated_at":"2026-03-25T22:16:45.000Z","dependencies_parsed_at":"2025-04-22T23:24:58.979Z","dependency_job_id":"657dc002-22d9-4f42-a0fc-5fe44cc190d6","html_url":"https://github.com/eclipse-xfsc/oid4-vci-authorization-bridge","commit_stats":null,"previous_names":["eclipse-xfsc/oid4-vci-authorization-bridge"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/eclipse-xfsc/oid4-vci-authorization-bridge","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eclipse-xfsc%2Foid4-vci-authorization-bridge","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eclipse-xfsc%2Foid4-vci-authorization-bridge/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eclipse-xfsc%2Foid4-vci-authorization-bridge/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eclipse-xfsc%2Foid4-vci-authorization-bridge/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eclipse-xfsc","download_url":"https://codeload.github.com/eclipse-xfsc/oid4-vci-authorization-bridge/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eclipse-xfsc%2Foid4-vci-authorization-bridge/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31307172,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-02T12:59:32.332Z","status":"ssl_error","status_checked_at":"2026-04-02T12:54:48.875Z","response_time":89,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","oauth2","ocm-w-stack","oid4vci","pre-authorized-code","vc","vp"],"created_at":"2026-03-03T22:32:54.662Z","updated_at":"2026-04-02T13:36:22.304Z","avatar_url":"https://github.com/eclipse-xfsc.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Introduction\n\nThe oid4 vci authorization bridge provides the new grant type for the OID4VCI flow to support issuing operations with the pre authorization flow. This bridge can be configured to the open id configuration under the type urn:ietf:params:oauth:grant-type:pre-authorized_code which is defined in the [OID4VCI Spec](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#credential-offer-parameters) The service it self consists of a redis db which contains the temporary stored codes/pins and nonces for the requested codes which can be later exchange by the  token endpoint to the authorization requestor. \n\n# Flows\n\nThe pre authorization bridge will act as a proxy between the code requestor and the token issuer: \n\n```mermaid\nsequenceDiagram\ntitle Pre Authorization Flow\nUser -\u003e\u003e Issuing Service: Request Credential Link\nIssuing Service -\u003e\u003e Pre Authorization Service: Request Code for Offering Link + TTL\nPre Authorization Service-\u003e\u003e Pre Authorization Service: Create Code\nPre Authorization Service-\u003e\u003e Redis: Stores Code in DB with TTL\nPre Authorization Service--\u003e\u003e User: Sends PIN (if required)\nPre Authorization Service-\u003e\u003e Issuing Service: Return Code\nIssuing Service-\u003e\u003e Issuing Service: Create Offering\nIssuing Service -\u003e\u003e User: Transmit Offering Link\nUser -\u003e\u003e Pre Authorization Service: Authorize with Code against /token endpoint\nPre Authorization Service-\u003e\u003e Redis: Check Code/Remove Code\nPre Authorization Service-\u003e\u003e Pre Authorization Service: Generate Token\nPre Authorization Service-\u003e\u003e User: Send Token\nUser-\u003e\u003e Issuing Service: Use Token for Get Credential\nIssuing Service-\u003e\u003e OAuth Server: Check Token against Token Issuer\nIssuing Service -\u003e\u003e User: Return Credential \n\n```\n\n# Dependencies\n\n- Nats\n- Redis\n- Crypto Service (Signing/Well Known)\n\n\n# Bootstrap\n\nPull either the docker image from harbor: \n\n```\ndocker pull node-654e3bca7fbeeed18f81d7c7.ps-xaas.io/ocm-wstack/pre-authorization-bridge:latest\n```\n\nor use the docker compose file or [helm chart](./deployment/helm/). \n\n\n# Developer Information\n\n\nCurrently there are two possibilities for authentication:\n1. only authentication code (via normal authorization server)\n2. authentication code and pin (two-factor)\n\nevery authentication have a configurable time-to-live(ttl)\n\n## Configuration\n````yaml\nprotocol: nats\nnats:\n  url: http://localhost:4222\n  timeoutInSec: 10\n\nlogLevel: debug\nservingPort: 3001\ndatabaseUrl: redis://user:pass@localhost:6379/0\ndefaultTtlInMin: 30\noAuth:\n   signerTopic: sign\n   credentialEndpoint: http://.../credential\n   key: signKey\nwellKnown:\n  issuer: http://localhost:8080\n  token_endpoint: http://localhost:8080/token\n  grant_types_supported: urn:ietf:params:oauth:grant-type:pre-authorized_code\n````\n\nVault must contain an sign key for signing the access tokens. The well known jwks of the crypto service must be publicy available. \n\n## Usage\nBridge expects cloudevent to trigger pre-authentication with following structure:\n````go\ntype offerEvent struct {\n    TwoFactor struct {\n        Enabled          bool   `mapstructure:\"enabled\"`\n        RecipientType    string `mapstructure:\"recipientType\"` //only when Enabled=true\n        RecipientAddress string `mapstructure:\"recipientAddress\"` //only when Enabled=true\n    } `mapstructure:\"twoFactor\"`\n    Ttl time.Duration `mapstructure:\"ttl\"`\n}\n````\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feclipse-xfsc%2Foid4-vci-authorization-bridge","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feclipse-xfsc%2Foid4-vci-authorization-bridge","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feclipse-xfsc%2Foid4-vci-authorization-bridge/lists"}