Add `haip` scheme support

[tladesignz]

John Bradley wrote:

This is the HAIP text in question.

As a way to invoke the Wallet, at least a custom URL scheme haip:// MUST be supported. Implementations MAY support other ways to invoke the wallets as agreed by trust frameworks/ecosystems/jurisdictions, not limited to using other custom URL schemes.

https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html

Any chance of adding it?

[tladesignz]

Well. It's easy to add support with a custom scheme handler. But then, what to do with the URLs?

Just rewrite them with https://funke.wwwallet.org/ and use that to load it into the web view?

If anything more complicated than that, I will need instructions by someone knowledgable.

[tladesignz]

John Bradley wrote:

I think that is all that is required. @mariobodemann may have more info.

[mariobodemann]

The Android wrapper does this for openid4vp:// and I would suggest that it should be similar to haip://: Replace the protocol with https and call the base url with the according url parameters.

I.e. haip://jada=234 becomes https://demo.wwwallet.org/?jada=234. 🤷

[tladesignz]

I.e. haip://jada=234 becomes https://demo.wwwallet.org/?jada=234. 🤷

This wild URL example brought me to the idea to try to find examples of valid haip URLs, which lead to the commit above.

However, if your example one is valid, that's pretty wild, as this would end up either in the host or the path part of a URL after parsing it with typical URL parsers. I very much hope that any key/value pieces are encoded as URL query part leading with a ?. In that case, no change necessary.

[mariobodemann]

Sorry my haip-url was just a poorly thought out example.

Following

https://wsp-wallet-test.governikus-eid.de/AutentIDConnect/sk/login

A valid haip-url could be

haip://?client_id=wsp-wallet-test.governikus-eid.de&request_uri=https%3A%2F%2Fwsp-wallet-test.governikus-eid.de%2FAutentIDConnect%2Frp-auth-request%2Fdbbca8b0-3148-4f29-877d-69bb6a6ad6b6

Sorry for the confusion.

[tladesignz]

Great, that you dug that up!

Just tested it. wwWallet happily ignores that one, at least on my simulator, where I'm not logged in, as I cannot create a passkey there.

Not sure, if there's anything in wwWallet which can actually handle it, and under what circumstances it will handle it.

[tladesignz]

Received via email:

Please use our Governikus demo relying party for testing, which is accessible under the following location: https://servicekonto.test.governikus-eid.de/eudi-mercury-testclient/start

Here some hints on how to use it:

-------------- Relying Party Use --------------

The relying party retrieves two credentials from the wallet: a PID and a POR. This is done in two separate steps. On the starting page of the relying party you should see two buttons (“Per EUDI - Wallet” and “Als PDF zum Ausdrucken”). The left one (“Per EUDI – Wallet”) will lead you to a second page explaining the details of the process.

You can continue using the single available button (“Weiter zur Authentisierung”), which will trigger the authentication flow which tries to retrieve the PID. For this you will be redirected to our intermediary ID Mercury, which can act on behalf of relying parties when interacting with wallets. From the two options offered please choose “EUDI-Wallet (Mobile)” which is the correct choice for wallets using the “haip://” scheme for their initiating call. Then finish the presentation workflow for the PID in your wallet.

After presenting your PID you will be redirected to a new page showing the data from the presented PID. Now you can present your POR using the single available button “Vertretungsvollmacht auslesen”, which will lead you directly to our Wallet Gateway. Please select “EUDI-Wallet (mobile)” again and finish the presentation workflow for the POR in your wallet. The resulting page will display the data from your POR presentation.

@nvoutsin, I have questions:

• Can wwWallet currently handle this at all?
• Are there any preconditions, before it will handle it? (e.g. successful login?)
• Do I need to redirect these requests to a certain endpoint/path?

[tladesignz]

@mariobodemann said:

haip:// -> braucht einen /cb path (""call back"", muss ich noch testen, soll überall gehen)