eclipse-edc / eclipse-edc/TrustFrameworkAdoption
Use Gaia-X compliance credentials in policy enforcement
- Dominant language
- Java
- Stars
- 6
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
# Feature Request
Participants should be able to use Gaia-x compliance credentials as policy enforcement for contract negotiation or access control.
This should apply to compliance credentials regardless of the credential subject type (participant or service).
In order to identify these credentials the property `credentialSubject.type` can be used with the value `gx:compliance`
As prerequisite, an integrity verification should also be performed in order to know if the subject Verifiable credential (the vc which have been certified as compliant) have been changed or not, which can be done as follows:
- Resolve the id the credential subject, canonize it using the _JSON Canonicalization Scheme_ described here: [RFC8785](https://www.rfc-editor.org/rfc/rfc8785)
- Perform a hash on the result using the algorithm provided in the credential subject in the verifiable credential `credentialSubject.integrity`, a sha256 at this time
- Compare the result from above with the value of the integrity present in the credential
An example of a compliance credential subject:
` "credentialSubject": [
{
"type": "gx:compliance",
"id": "did:web:wizard.lab.gaia-x.eu:development:api:credentials:2d37wbGvQzbAQ84yRouh2m2",
"integrity": "sha256-00c7d91bf67242164d72656e1036361f5b9833e3a06fceeea9a1c058ea139777"
}
]`
A complete VC can be found [here](https://wizard.lab.gaia-x.eu/development/api/credentials/2d37wbGvQzbAQ84yRouh2m2vBKkN8s5AfH9Q75HZRCUQmJW7yAVSNKzjJj6gcjE2mDNDUHCichXWdMH3S2c8AaDLm3kXmf5R8D7pyLfHhZjYtnZDC56ASyVeknkDrxpsCgwmHknPobj9KvpgcHLyes2vogimeLC6mg6ELTRuzz5Yq4wkWEon94HXNUDCujg5eJPoGXjpYLPp3cuijtoxHXxceHG7BB1kxXm1wnofJgnQ2C4MqHbUvK1hqc4wGJizSvbYSrHtQni9bLK5sANswciQEA4eKXbzzEYMy72GdHTAEuPJ9e5cJ5sH2kQnMhBgxQe36oZhck13VdoFM1eJiB42VzufpdtYySRD5TjT7GTPnp19pbMmGhnHGw6vLoFfKwNwoMueDKqBsWnhovVaNGwjjx9LxkgwuWVpQFwrm22Symxmx3pcqMaYDVNzA5NDNEDXLWHf2MZV8EjVL7miHhuGhAine5gFVJJUTjKQTZprD37tZzMkdi85qJhVvxwHPsRLBZTELrJg4cH2WCP1EFrykLQ8Li2KMsJRs9cnpjgT6G3YSRYHDbGouuskFTG1Cn1dCQUkNmJewzNjwLbHT6zCcKbeuh3Aj3pmuDN?vcid=34d61ca1-aaad-4a12-9b71-c793632d42da)
## Which Areas Would Be Affected?
For the integrity verification:
- Create a new credential verifier in the identity hub
For the verification of the presence of the credential or not:
- Create a constraint function in this repository (eclipse-edc/TrustFrameworkAdoption)
## Why Is the Feature Desired?
To make it easier for participant in a dataspace to only communicate with gaia-x compliant credential holders
## Solution Proposal
A Pull request is already available for the constraint function part.
## Type of Issue
New feature
Contributor guide
Research direction
Start by reviewing the constraint function requested in eclipse-edc/TrustFrameworkAdoption and the new credential verifier required in the identity hub. Use the supplied Gaia-X compliance credential example to understand the credentialSubject.type and integrity fields; done means compliance credentials can enforce policy and their referenced subject integrity is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100