forked from eclipse-tractusx/tutorial-resources
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Alice now uses a standalone STS
- Loading branch information
1 parent
60b0e71
commit e82f6aa
Showing
23 changed files
with
815 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
31 changes: 31 additions & 0 deletions
31
...-identityhub-sts/src/main/java/org/eclipse/edc/identityhub/demo/IdentityHubExtension.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| /* | ||
| * Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.identityhub.demo; | ||
|
|
||
| import org.eclipse.edc.identityhub.spi.ScopeToCriterionTransformer; | ||
| import org.eclipse.edc.runtime.metamodel.annotation.Extension; | ||
| import org.eclipse.edc.runtime.metamodel.annotation.Provider; | ||
| import org.eclipse.edc.spi.system.ServiceExtension; | ||
|
|
||
|
|
||
| @Extension("DCP Demo: Core Extension for IdentityHub") | ||
| public class IdentityHubExtension implements ServiceExtension { | ||
|
|
||
| @Provider | ||
| public ScopeToCriterionTransformer createScopeTransformer() { | ||
| return new TxScopeToCriterionTransformer(); | ||
| } | ||
|
|
||
| } |
64 changes: 64 additions & 0 deletions
64
...hub-sts/src/main/java/org/eclipse/edc/identityhub/demo/TxScopeToCriterionTransformer.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| /* | ||
| * Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.identityhub.demo; | ||
|
|
||
| import org.eclipse.edc.identityhub.spi.ScopeToCriterionTransformer; | ||
| import org.eclipse.edc.spi.query.Criterion; | ||
| import org.eclipse.edc.spi.result.Result; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| import static org.eclipse.edc.spi.result.Result.failure; | ||
| import static org.eclipse.edc.spi.result.Result.success; | ||
|
|
||
| /** | ||
| * Implementation of {@link ScopeToCriterionTransformer} similar to the upstream one that maps tx scopes | ||
| * to {@link Criterion} for querying the credentials (Just for testing) | ||
| */ | ||
| public class TxScopeToCriterionTransformer implements ScopeToCriterionTransformer { | ||
|
|
||
| public static final String TYPE_OPERAND = "verifiableCredential.credential.type"; | ||
| public static final String ALIAS_LITERAL = "org.eclipse.tractusx.vc.type"; | ||
| public static final String CONTAINS_OPERATOR = "contains"; | ||
| private static final String SCOPE_SEPARATOR = ":"; | ||
| private final List<String> allowedOperations = List.of("read", "*", "all"); | ||
|
|
||
| @Override | ||
| public Result<Criterion> transform(String scope) { | ||
| var tokens = tokenize(scope); | ||
| if (tokens.failed()) { | ||
| return failure("Scope string cannot be converted: %s".formatted(tokens.getFailureDetail())); | ||
| } | ||
| var credentialType = tokens.getContent()[1]; | ||
| return success(new Criterion(TYPE_OPERAND, CONTAINS_OPERATOR, credentialType)); | ||
| } | ||
|
|
||
| protected Result<String[]> tokenize(String scope) { | ||
| if (scope == null) return failure("Scope was null"); | ||
|
|
||
| var tokens = scope.split(SCOPE_SEPARATOR); | ||
| if (tokens.length != 3) { | ||
| return failure("Scope string has invalid format."); | ||
| } | ||
| if (!ALIAS_LITERAL.equalsIgnoreCase(tokens[0])) { | ||
| return failure("Scope alias MUST be %s but was %s".formatted(ALIAS_LITERAL, tokens[0])); | ||
| } | ||
| if (!allowedOperations.contains(tokens[2])) { | ||
| return failure("Invalid scope operation: " + tokens[2]); | ||
| } | ||
|
|
||
| return success(tokens); | ||
| } | ||
| } |
99 changes: 99 additions & 0 deletions
99
...dentityhub-sts/src/main/java/org/eclipse/edc/identityhub/seed/SuperUserSeedExtension.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| /* | ||
| * Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.identityhub.seed; | ||
|
|
||
| import org.eclipse.edc.identityhub.spi.authentication.ServicePrincipal; | ||
| import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService; | ||
| import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor; | ||
| import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantManifest; | ||
| import org.eclipse.edc.runtime.metamodel.annotation.Inject; | ||
| import org.eclipse.edc.runtime.metamodel.annotation.Setting; | ||
| import org.eclipse.edc.spi.EdcException; | ||
| import org.eclipse.edc.spi.monitor.Monitor; | ||
| import org.eclipse.edc.spi.security.Vault; | ||
| import org.eclipse.edc.spi.system.ServiceExtension; | ||
| import org.eclipse.edc.spi.system.ServiceExtensionContext; | ||
|
|
||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import static java.util.Optional.ofNullable; | ||
|
|
||
| public class SuperUserSeedExtension implements ServiceExtension { | ||
| public static final String NAME = "MVD ParticipantContext Seed Extension"; | ||
| public static final String DEFAULT_SUPER_USER_PARTICIPANT_ID = "super-user"; | ||
|
|
||
| @Setting(value = "Explicitly set the initial API key for the Super-User") | ||
| public static final String SUPERUSER_APIKEY_PROPERTY = "edc.ih.api.superuser.key"; | ||
|
|
||
| @Setting(value = "Config value to set the super-user's participant ID.", defaultValue = DEFAULT_SUPER_USER_PARTICIPANT_ID) | ||
| public static final String SUPERUSER_PARTICIPANT_ID_PROPERTY = "edc.ih.api.superuser.id"; | ||
| private String superUserParticipantId; | ||
| private String superUserApiKey; | ||
| private Monitor monitor; | ||
| @Inject | ||
| private ParticipantContextService participantContextService; | ||
| @Inject | ||
| private Vault vault; | ||
|
|
||
| @Override | ||
| public String name() { | ||
| return NAME; | ||
| } | ||
|
|
||
| @Override | ||
| public void initialize(ServiceExtensionContext context) { | ||
| superUserParticipantId = context.getSetting(SUPERUSER_PARTICIPANT_ID_PROPERTY, DEFAULT_SUPER_USER_PARTICIPANT_ID); | ||
| superUserApiKey = context.getSetting(SUPERUSER_APIKEY_PROPERTY, null); | ||
| monitor = context.getMonitor(); | ||
| } | ||
|
|
||
| @Override | ||
| public void start() { | ||
| // create super-user | ||
| if (participantContextService.getParticipantContext(superUserParticipantId).succeeded()) { // already exists | ||
| monitor.debug("super-user already exists with ID '%s', will not re-create".formatted(superUserParticipantId)); | ||
| return; | ||
| } | ||
| participantContextService.createParticipantContext(ParticipantManifest.Builder.newInstance() | ||
| .participantId(superUserParticipantId) | ||
| .did("did:web:%s".formatted(superUserParticipantId)) // doesn't matter, not intended for resolution | ||
| .active(true) | ||
| .key(KeyDescriptor.Builder.newInstance() | ||
| .keyGeneratorParams(Map.of("algorithm", "EdDSA", "curve", "Ed25519")) | ||
| .keyId("%s-key".formatted(superUserParticipantId)) | ||
| .privateKeyAlias("%s-alias".formatted(superUserParticipantId)) | ||
| .build()) | ||
| .roles(List.of(ServicePrincipal.ROLE_ADMIN)) | ||
| .build()) | ||
| .onSuccess(generatedKey -> { | ||
| var apiKey = ofNullable(superUserApiKey) | ||
| .map(key -> { | ||
| if (!key.contains(".")) { | ||
| monitor.warning("Super-user key override: this key appears to have an invalid format, you may be unable to access some APIs. It must follow the structure: 'base64(<participantId>).<random-string>'"); | ||
| } | ||
| participantContextService.getParticipantContext(superUserParticipantId) | ||
| .onSuccess(pc -> vault.storeSecret(pc.getApiTokenAlias(), key) | ||
| .onSuccess(u -> monitor.debug("Super-user key override successful")) | ||
| .onFailure(f -> monitor.warning("Error storing API key in vault: %s".formatted(f.getFailureDetail())))) | ||
| .onFailure(f -> monitor.warning("Error overriding API key for '%s': %s".formatted(superUserParticipantId, f.getFailureDetail()))); | ||
| return key; | ||
| }) | ||
| .orElse(generatedKey.get("apiKey").toString()); | ||
| monitor.info("Created user 'super-user'. Please take note of the API Key: %s".formatted(apiKey)); | ||
| }) | ||
| .orElseThrow(f -> new EdcException("Error creating Super-User: " + f.getFailureDetail())); | ||
| } | ||
| } |
16 changes: 16 additions & 0 deletions
16
...yhub-sts/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # | ||
| # Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| # | ||
| # This program and the accompanying materials are made available under the | ||
| # terms of the Apache License, Version 2.0 which is available at | ||
| # https://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
| # Contributors: | ||
| # Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| # | ||
| # | ||
|
|
||
| org.eclipse.edc.identityhub.demo.IdentityHubExtension | ||
| org.eclipse.edc.identityhub.seed.SuperUserSeedExtension |
Oops, something went wrong.