Package ch.admin.bj.swiyu.sdjwtvalidator

Class SdJwtVcValidator

java.lang.Object
ch.admin.bj.swiyu.sdjwtvalidator.SdJwtVcValidator
public class SdJwtVcValidator extends Object
Validates SD-JWT VC tokens according to the Swiss Profile VC specification (RFC 9901).

Extends the base DID-based JWT validation provided by DidJwtValidator with SD-JWT VC specific rules mandated by the Swiss Profile:

  • typ JOSE header must be dc+sd-jwt (configurable for migration phase)
  • _sd_alg claim must be sha-256
  • Registered claims (iss, nbf, exp, iat, cnf, vct, vct#integrity, status, vct_metadata_uri, vct_metadata_uri#integrity, _sd, _sd_alg) MUST NOT appear as selectively disclosed claims (RFC 9901 §3.2.2.2)

Typical usage – Flow B (two-step, no internal HTTP calls):


 // Step 1: get the DID resolution URL, caller performs the HTTP GET
 String didUrl = validator.getAndValidateResolutionUrl(sdJwt);

 // Step 2: validate with the fetched DID Document
 boolean valid = validator.validateSdJwtVc(sdJwt, didDocument);

Migration phase (accepting both dc+sd-jwt and vc+sd-jwt):


 new SdJwtVcValidator(didJwtValidator,
     Set.of(SdJwtVcValidator.TYP_DC_SD_JWT, SdJwtVcValidator.TYP_VC_SD_JWT));

This class is framework-agnostic and has no Spring dependencies.

  • Field Details

    • TYP_DC_SD_JWT

      public static final String TYP_DC_SD_JWT
      typ value required by SD-JWT VC spec (post-migration).
      See Also:

    • TYP_VC_SD_JWT

      public static final String TYP_VC_SD_JWT
      typ value accepted during the migration phase alongside TYP_DC_SD_JWT.
      See Also:

    • PROTECTED_CLAIMS

      public static final Set<String> PROTECTED_CLAIMS
      Registered JWT claims that MUST NOT appear in any Disclosure per RFC 9901 §3.2.2.2 and the Swiss Profile VC specification.

  • Constructor Details

    • SdJwtVcValidator

      public SdJwtVcValidator(DidJwtValidator didJwtValidator)
      Creates an SdJwtVcValidator that accepts only dc+sd-jwt as typ.
      Parameters:
      didJwtValidator - the underlying DID-based JWT validator; must not be null

    • SdJwtVcValidator

      public SdJwtVcValidator(DidJwtValidator didJwtValidator, Set<String> acceptedTypValues)
      Creates an SdJwtVcValidator with a configurable set of accepted typ values.

      Use this constructor during the migration phase to accept both dc+sd-jwt and vc+sd-jwt.

      Parameters:
      didJwtValidator - the underlying DID-based JWT validator; must not be null
      acceptedTypValues - the set of accepted typ header values; must not be empty

  • Method Details

    • getAndValidateResolutionUrl

      public String getAndValidateResolutionUrl(String sdJwt)
      Step 1 of Flow B – validates the typ header and returns the DID resolution URL.

      The caller is expected to perform the HTTP GET to the returned URL to fetch the DID Document, and then call validateSdJwtVc(String, DidDoc).

      Parameters:
      sdJwt - the SD-JWT string (<issuer-jwt>~[<disclosure>~]*)
      Returns:
      the validated DID resolution URL for the caller to fetch
      Throws:
      JwtValidatorException - if the typ is invalid or DID resolution fails

    • validateSdJwtVc

      public void validateSdJwtVc(String sdJwt, ch.admin.eid.did_sidekicks.DidDoc didDocument)
      Step 2 of Flow B – validates the full SD-JWT VC against the pre-fetched DID Document.

      Checks performed in order:

      1. typ header is in the configured set of accepted values
      2. _sd_alg claim equals sha-256
      3. No registered/protected claim appears in any Disclosure
      4. DID-based signature verification (delegated to DidJwtValidator)
      Parameters:
      sdJwt - the SD-JWT string
      didDocument - the pre-fetched DID Document for signature verification
      Throws:
      JwtValidatorException - if any check fails

    • validateSdJwtVc

      public void validateSdJwtVc(String sdJwt, com.nimbusds.jose.jwk.JWKSet jwkSet)
      Flow A – validates the SD-JWT VC directly against the provided JWK set.

      Use this when the JWK set is already available and no DID resolution is needed. Same structural checks (typ, _sd_alg, protected claims) are applied.

      Parameters:
      sdJwt - the SD-JWT string
      jwkSet - the JWK set containing the public key(s) to verify against
      Throws:
      JwtValidatorException - if any check fails