Class PresentationRequestBuilderOptions

Namespace

Tessio.Verifier.OpenId4Vp

Assembly

Tessio.Verifier.OpenId4Vp.dll

Configuration for SignedPresentationRequestBuilder.

public sealed class PresentationRequestBuilderOptions

Inheritance

object

PresentationRequestBuilderOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Properties

AuthorizationEndpoint

Scheme-and-authority part of the wallet-facing authorization request URI. Defaults to the OpenID4VP universal scheme.

public string AuthorizationEndpoint { get; set; }

Property Value

string

Clock

Time source for iat/exp; system clock when null.

public TimeProvider? Clock { get; set; }

Property Value

TimeProvider

DefaultRequestLifetime

Request lifetime applied when the per-request options carry none. Default: 5 minutes.

public TimeSpan DefaultRequestLifetime { get; set; }

Property Value

TimeSpan

RequestUriBase

When set, requests are delivered by reference: the wallet fetches the signed JAR from {RequestUriBase}/{id} and the hosting layer must serve it there. When null (default), requests are delivered by value inside the authorization request URI.

public Uri? RequestUriBase { get; set; }

Property Value

Uri

SigningCertificateChain

Certificate chain to advertise in the JAR x5c header, leaf certificate first.

public IReadOnlyList<X509Certificate2>? SigningCertificateChain { get; set; }

Property Value

IReadOnlyList<X509Certificate2>

Remarks

Required in practice for the x509_san_dns client_id scheme: the wallet matches the client_id against this certificate's SAN and has no other way to obtain it, so a signed request without x5c is rejected as a malformed JAR before any trust decision is reached.

Kept separate from SigningCredentials rather than read off an X509SecurityKey, because Microsoft.IdentityModel has no ES256 signature provider for that key type: an EC certificate can be advertised but not signed with in that form.

SigningCredentials

Key and algorithm used to sign the JAR request object. In production this key belongs to the verifier's access certificate (WRPAC); any SigningCredentials works, including keys held in Azure Key Vault or an HSM via a custom CryptoProviderFactory.

public required SigningCredentials SigningCredentials { get; set; }

Property Value

SigningCredentials