OpenID for Verifiable Presentations (EUDI wallet, eIDAS 2.0) (v6.6)

pac4j-openid4vp provides an OpenID4VP client for Java: it allows you to authenticate users with a digital wallet, using the OpenID for Verifiable Presentations protocol. Your application acts as a verifier: it asks the wallet to present credentials, such as the person identification data of the European Digital Identity wallet (EUDI wallet).

Requires a wallet compatible with OpenID4VP 1.0 final. Earlier drafts using client_id_scheme or presentation_definition are not supported.

1) Dependency

You need to use the following module: pac4j-openid4vp.

Example (Maven dependency):

<dependency>
    <groupId>org.pac4j</groupId>
    <artifactId>pac4j-openid4vp</artifactId>
    <version>${pac4j.version}</version>
</dependency>

OpenID4VP shares the OAuth vocabulary with OpenID Connect (client_id, nonce, signed request objects), but the wallet presents credentials directly to the application: there is no token endpoint or user info endpoint, and the module does not depend on pac4j-oidc.

Each credential verifier also needs an optional library, not included by default: add the one of the verifier you use, as described for the SD-JWT VC verifier and the mdoc verifier.

2) The protocol, briefly

Request: configure a DCQL query describing the credentials and attributes your application needs.
Consent: the wallet asks the user to approve sharing them.
Validation: pac4j and the configured credential verifiers validate the response before creating a user profile.
Browser return: on the same device, setUseRedirectUri(true) makes the wallet return to the pac4j callback, which checks the return code, completes authentication and restores the saved request. The option defaults to false. Start in the device’s default browser and keep the same browser profile for the wallet return; see Returning to the application.

Choose a client for a wallet opened by URL or QR code, or through the browser’s Digital Credentials API. Requests are signed and responses encrypted by default. Configure trusted issuers and credential validation before accepting presentations.

3) The EUDI wallet: ARF and HAIP

The European Digital Identity wallet (EUDI wallet) is part of the eIDAS 2.0 framework. Its Architecture and Reference Framework (ARF) uses the High Assurance Interoperability Profile (HAIP) 1.0 to define its OpenID4VP requirements.

Use EudiWalletClient for the EUDI PID profile:

Fixed settings: signed requests with x509_hash and encrypted responses with direct_post.jwt.
Signing material: supply the relying party access certificate, its private key and certificate chain through keystore, or through jwks with an x5c chain. Follow the target wallet’s registration and trust requirements.
Requested data: configure a DCQL query matching the wallet’s credential format and attribute names.
User profile: returns an EudiPidProfile. Choose the claim identifying the user: the PID defines no sub and none of its attributes is assumed to be a stable identifier, so the client refuses to initialize until a profile identifier resolver is configured, such as ProfileIdResolver.issuerAndClaim(...) with a claim requested in the DCQL query.

Use OpenId4VpClient if the wallet requires different settings, such as x509_san_dns, or for credentials other than the PID. See Clients and configuration.

SD-JWT VC and mdoc validation are provided through optional libraries. Selecting EudiWalletClient does not provide a complete EUDI trust or status validation setup: see Configuring credential verifiers.

OpenID for Verifiable Presentations (EUDI wallet, eIDAS 2.0) (v6.6)

1) Dependency

2) The protocol, briefly

3) The EUDI wallet: ARF and HAIP

4) Usage