italia/eid-wallet-it-docs 1.4.7

1.4.7. LTS

on GitHub

Breaking changes

1. PAR typ must be oauth-authz-req+jwt (#1187). Wallet and Issuer must move together, or the PAR is rejected.
2. PAR scope is required (#1187). An Issuer that checks scope rejects a Wallet that still sends only authorization_details.
3. Federation type wallet_solution → openid_wallet_provider (#1220). Wallet Providers may publish both names with the same payload until consumers switch.

1. Security: PAR typ must be oauth-authz-req+jwt

The Request Object header typ is required and must be oauth-authz-req+jwt (RFC 8725). In 1.4.6 it was optional and defaulted to JWT (example: jwt).

• Wallet sends oauth-authz-req+jwt and the Issuer still allows only jwt / JWT → PAR rejected.
• Issuer allows only oauth-authz-req+jwt and the Wallet still sends jwt / JWT or omits typ → PAR rejected.

Rollout. Issuers accept oauth-authz-req+jwt, and legacy jwt / JWT for a limited period only before all the participants will be aligned.

Security. Explicit typ stops a JWT from another flow (attestation, DPoP, entity statement) being accepted as a PAR. Keep signature, iss, aud, exp and Wallet Attestation checks on every accepted typ. Close the legacy window once Wallets have moved.

2. PAR payload must include scope

scope and authorization_details are both required (OpenID4VC HAIP). A Wallet that sends only authorization_details fails as soon as the Issuer checks scope.

Rollout. Wallets add scope from the advertised Credential Configuration and keep authorization_details. Issuers still accept a missing scope until then, then require both. If both name the same Credential type, follow authorization_details.

3. Federation type wallet_solution → openid_wallet_provider

The metadata member, trust-mark type and listing entity_type use openid_wallet_provider. The JSON object under the key is unchanged.

Rollout. Publish both names with the same payload (same jwks, same wallet_metadata), then sign the Entity Configuration once:

"metadata": {
  "openid_wallet_provider": { },
  "wallet_solution": { }
}

Consumers accept either name. Drop wallet_solution after they have switched. Two members with different keys or endpoints are an invalid configuration: those keys sign Wallet Attestations.

Also in this release

• #1187 — The Credential Issuer Authorization Server chooses User authentication. Wallet hints are optional. PID is CieID L3. IT-Wallet ID is CieID L3 unless authorization_details contains it_l2+document_proof.
• #1214 — OAS3 security is only BearerAuth. The Voucher is always required; DPoP and Agid-JWT-TrackingEvidence stay header parameters. Regenerate clients.
• #1215 — The Relying Party distinguishes the User from the claims it requests.
• #1208 — Registry endpoint alignment.
• #1213 — credential catalog normative language about params presence- #1213

Full changelog: 1.4.6...1.4.7