OpenID4VCI Plugin #47

dbluhm · 2023-12-01T21:42:04Z

This PR adds a plugin implementing the OpenID4VCI protocol (Issuance only -- future work will address OpenID4VP and I'm not sure if that should be in this plugin or a separate one). See the README for details on the implementation.

A couple of things to call out:

This Plugin Implements Draft 11 of OpenID4VCI (https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-11.html).
We have been testing against the Sphereon Wallet. Kudos to the Sphereon team for their work on that!
To interoperate with Sphereon, we needed to add support for did:jwk and verifying ES256K signatures. This implementation is within this plugin right now (as a resolver and a helper method). We plan to contribute this to ACA-Py Core.
We plan to have automated tests against AFJ's OpenID4VCI package as soon as PR OpenId4Vc Support credo-ts#1639 is merged and released.
Not implemented (yet):
- ldp_vc, sd_jwt_vc
- Authorization Code Flow
- Only signature suite supported by ACA-Py for jwt-vc right now is EdDSA
- GET /.well-known/openid-configuration
- GET /.well-known/oauth-authorization-server
- Batch Credential Issuance
- We're limited to DID Methods that ACA-Py supports for issuance (more can be added by Plugin, e.g. DID Web); did:sov, did:key
- Multitenancy Support; we need to figure out the right way to identify a sub-wallet from OpenID4VCI endpoints.

dbluhm · 2023-12-01T21:43:34Z

@swcurran We'd like to demo this at the next ACA-PUG call!
@jamshale Quick ACK that we have some structural things to adjust to meet the expectations of the GHA (and some failing unit tests, right this minute)

swcurran · 2023-12-01T21:46:05Z

Definitely want to see the demo — great stuff! Looking forward to it!

jamshale · 2023-12-01T22:03:04Z

@dbluhm I think the unit tests may be failing just because the integration test folder needs to be renamed from int --> integration or it tries to run the integration tests as unit tests.

This implements a did:jwk resolver. See openwallet-foundation/acapy-plugins#47 for context. Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

oid4vci/pyproject.toml

dbluhm · 2023-12-01T22:28:22Z

Currently failing unit tests are legit failures; we'll get them taken care of (probably Monday 😄)

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

Signed-off-by: Char Howland <char@indicio.tech>

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

Signed-off-by: Char Howland <char@indicio.tech>

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

dbluhm · 2023-12-04T19:54:57Z

We'll have more developments on this plugin coming soon but this PR is ready for review!

WadeBarnes

@dbluhm, Have a look at the way we're updating the ACA-Py dependencies over here. I'd recommend updating before the PR is merged.

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

dbluhm · 2023-12-05T17:48:57Z

@dbluhm, Have a look at the way we're updating the ACA-Py dependencies over here. I'd recommend updating before the PR is merged.

Good point! Updates pushed implementing the ACA-Py as an optional dependency change adopted in other plugins.

esune

Looks good, thanks @dbluhm!
Just a comment on an outdated dependency: I realize it is "just" the demo, but having an old base image will likely trigger vulnerability alerts pretty quickly after the first scan.

oid4vci/demo/frontend/Dockerfile

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

dbluhm · 2023-12-05T19:43:42Z

Node version in the demo dockerfile updated. I attempted to bump it to 20 (latest LTS) but was having some weird issues. We're going to be working on the demo soon so I just bumped to 18, which worked fine on the first try, and we'll revisit when we come back around.

esune

👍🏻

dbluhm added a commit to dbluhm/aries-cloudagent-python that referenced this pull request Dec 1, 2023

feat: add did:jwk resolver

96e6dbf

This implements a did:jwk resolver. See openwallet-foundation/acapy-plugins#47 for context. Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

This was referenced Dec 1, 2023

feat: add did:jwk resolver openwallet-foundation/acapy#2645

Merged

Support verifying more JWT Signatures openwallet-foundation/acapy#2646

Open

jamshale reviewed Dec 1, 2023

View reviewed changes

oid4vci/pyproject.toml Outdated Show resolved Hide resolved

burdettadam and others added 22 commits December 4, 2023 14:48

feat: first of oid4vci plugin files

d3f492e

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

BUG: non working docker

7807042

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

BUG: non working docker

ef66f37

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: working docker img

01d1f5a

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: loading plugin with status points

e4e29c6

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: empty handlers

6ff0b83

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: some openapi schemas

f004899

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: add logic to get_cred_offer endpoint

e6f9977

Signed-off-by: Char Howland <char@indicio.tech>

feat: create CredentialOfferRecord

fd2687e

Signed-off-by: Char Howland <char@indicio.tech>

feat: no head allowed on get's

d2dfb90

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: check jwt token

70d3631

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: oid_cred_issuer logic (WIP)

ef939a3

Signed-off-by: Char Howland <char@indicio.tech>

feat: mostly copied routes.py

b900f5d

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: demo directory

fec69bc

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: demo frontend with docker compose

d37f70a

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: demo docker compose with less bugs

56ac10d

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: cred ex record management

8ba849a

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

chore: add pre-commit

2b1b3f6

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

refactor: remove unused record

ea0024e

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

refactor: models into model package

87ded51

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

refactor: minor tweaks to issuer meta endpoint

77411c9

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

refactor: move public routes to new module

68ce98a

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

dbluhm and others added 19 commits December 4, 2023 14:48

fix: save record state on offer created

f8b7a4e

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: failing tests, missing config

1c5bbcf

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: types checking, issues in int tests

5415ce7

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: signature is b64url encoded

f39fa3b

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

test: es256k pop

e106f50

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: small fixes

75af405

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

chore: bump askar, acapy versions

e6e2a8a

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: add registration admin page

40b6780

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

fix: remove credential page, fix get by id

794a135

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

fix: cleaner demo code with async

11461cf

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

fix: vars names

a0b3d22

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: better error reporting

a807f21

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: webpage name change

76f64de

Signed-off-by: Adam Burdett <burdettadam@gmail.com>

feat: update readme

68319b2

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: add readme arch image

5e16ca5

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

chore: rearrange int

07d3ecc

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: pytest opts to only run from tests dir

78f591a

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

chore: remove copy-paste error

4a738b3

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

fix: unit tests

1923a5e

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

dbluhm force-pushed the oid4vci branch from 494e706 to 1923a5e Compare December 4, 2023 19:48

WadeBarnes reviewed Dec 4, 2023

View reviewed changes

jamshale approved these changes Dec 5, 2023

View reviewed changes

feat: update aca-py as optional dep

7f3cefd

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

esune reviewed Dec 5, 2023

View reviewed changes

oid4vci/demo/frontend/Dockerfile Outdated Show resolved Hide resolved

chore: bump node version

a72a951

Signed-off-by: Daniel Bluhm <dbluhm@pm.me>

esune approved these changes Dec 5, 2023

View reviewed changes

dbluhm merged commit 2f5d32f into openwallet-foundation:main Dec 6, 2023
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenID4VCI Plugin #47

OpenID4VCI Plugin #47

dbluhm commented Dec 1, 2023 •

edited

Loading

dbluhm commented Dec 1, 2023

swcurran commented Dec 1, 2023

jamshale commented Dec 1, 2023

dbluhm commented Dec 1, 2023

dbluhm commented Dec 4, 2023

WadeBarnes left a comment

dbluhm commented Dec 5, 2023

esune left a comment

dbluhm commented Dec 5, 2023

esune left a comment

OpenID4VCI Plugin #47

OpenID4VCI Plugin #47

Conversation

dbluhm commented Dec 1, 2023 • edited Loading

dbluhm commented Dec 1, 2023

swcurran commented Dec 1, 2023

jamshale commented Dec 1, 2023

dbluhm commented Dec 1, 2023

dbluhm commented Dec 4, 2023

WadeBarnes left a comment

Choose a reason for hiding this comment

dbluhm commented Dec 5, 2023

esune left a comment

Choose a reason for hiding this comment

dbluhm commented Dec 5, 2023

esune left a comment

Choose a reason for hiding this comment

dbluhm commented Dec 1, 2023 •

edited

Loading