DO NOT MERGE: Project branch for Generic Functions

.github/workflows/build-images.yaml

@@ -5,11 +5,13 @@ on:
   push:
     branches:
       - master
+      - project-gf
     tags:
       - 'v*'
   pull_request:
     branches:
       - master
+      - project-gf
 
 # cancel build action if superseded by new commit on same branch
 concurrency:
@@ -51,7 +53,7 @@ jobs:
           images: nutsfoundation/nuts-node
           tags: |
             # generate 'master' tag for the master branch
-            type=ref,event=branch,enable={{is_default_branch}},prefix=
+            type=ref,event=branch,enable=true,prefix=
             # generate 5.2.1 tag
             type=semver,pattern={{version}}
           flavor: |

Dockerfile

@@ -17,7 +17,7 @@
 COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine
@@ -25,7 +25,10 @@
 RUN apk update \
   && apk add --no-cache \
              tzdata \
-             curl
+             curl \
+             ca-certificates
+COPY pki/cacerts/* /usr/local/share/ca-certificates/
+RUN update-ca-certificates
 COPY --from=builder /opt/nuts/nuts /usr/bin/nuts
 
 HEALTHCHECK --start-period=30s --timeout=5s --interval=10s \

LSPxNuts_README.md

@@ -0,0 +1,16 @@
+# LSPxNuts Proof of Concept
+
+This is a branch that for the Proof of Concept of the LSPxNuts project.
+
+It adds or alters the following functionality versus the mainstream Nuts node:
+
+- OAuth2 `vp_bearer` token exchange: read presentation definition from local definitions instead of fetching it from the remote authorization server.
+  LSP doesn't support presentation definitions, meaning that we need to look it up locally.
+- Add support for JWT bearer grant type. If the server supports this, it uses this grant type instead of the Nuts-specific vp_token-bearer grant type.
+- Add CA certificates of Sectigo (root CA, OV and EV intermediate CA) to Docker image's OS CA bundle, because they're used by AORTA-LSP.
+- Fix marshalling of Verifiable Presentations in JWT format; `type` was marshalled as JSON-LD (single-entry-array was replaced by string)
+- Add `policy_id` field to access token request to specify the Presentation Definition that should be used.
+  The `scope` can then be specified as whatever the use case requires (e.g. SMART on FHIR-esque scopes).
+- Relax `did:x509` key usage check: the certificate from UZI smart cards that is used to sign credentials, doesn't have `serverAuth` key usage, only `digitalSignature`.
+  This broke, since we didn't specify the key usage, but `x509.Verify()` expects key usage `serverAuth` to be present by default.
+- Add support for `RS256` (RSA 2048) signatures, since that's what UZI smart cards produce.

README.rst

@@ -217,14 +217,17 @@ The following options can be configured on the server:
     storage.session.redis.sentinel.username                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Username for authenticating to Redis Sentinels.
     storage.session.redis.tls.truststorefile                                                                                                                                                                                                                                                                                                                                                                                                                                                                               PEM file containing the trusted CA certificate(s) for authenticating remote Redis session servers. Can only be used when connecting over TLS (use 'rediss://' as scheme in address).
     storage.sql.connection                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 Connection string for the SQL database. If not set it, defaults to a SQLite database stored inside the configured data directory. Note: using SQLite is not recommended in production environments. If using SQLite anyways, remember to enable foreign keys ('_foreign_keys=on') and the write-ahead-log ('_journal_mode=WAL').
+    storage.sql.rdsiam.dbuser                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Database username for IAM authentication. If not specified, the username from the connection string will be used. The database user must be created with IAM authentication enabled.
     storage.sql.rdsiam.enabled                    false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Enable AWS RDS IAM authentication for the SQL database connection. When enabled, the node will use temporary IAM tokens instead of passwords. Requires the connection string to be a PostgreSQL or MySQL RDS endpoint without a password.
     storage.sql.rdsiam.region                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              AWS region where the RDS instance is located (e.g., 'us-east-1). Required when RDS IAM authentication is enabled.
-    storage.sql.rdsiam.dbuser                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Database username for IAM authentication. If not specified, the username from the connection string will be used. The database user must be created with IAM authentication enabled.
-    storage.sql.rdsiam.tokenrefreshinterval       14m0s                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Interval at which to refresh the IAM authentication token. RDS tokens are valid for 15 minutes, so the default is 14 minutes to ensure tokens are refreshed before expiry. Specified as Golang duration (e.g. 10m, 1h).
+    storage.sql.rdsiam.tokenrefreshinterval       14m0s                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Interval at which to refresh the IAM authentication token. RDS tokens are valid for 15 minutes, so set this to ensure tokens are refreshed before expiry. Specified as Golang duration (e.g. 10m, 1h).
     **Tracing**
     tracing.endpoint                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       OTLP collector endpoint for OpenTelemetry tracing (e.g., 'localhost:4318'). When empty, tracing is disabled.
     tracing.insecure                              false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Disable TLS for the OTLP connection.
     tracing.servicename                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Service name reported to the tracing backend. Defaults to 'nuts-node'.
+    **VCR**
+    vcr.dezi.allowedjku                           []                                                                                                                                                                                                                                                                                                                                                                                                                                                                       List of allowed JKU URLs for fetching Dezi attestation keys. If not set, defaults to production (https://auth.dezi.nl/dezi/jwks.json), and in non-strict mode also acceptance (https://acceptatie.auth.dezi.nl/dezi/jwks.json).
+    vcr.verifier.revocation.maxage                15m0s                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Max age of revocation information. If the revocation information is older than this, it will be refreshed from the issuer. If set to 0 or negative, revocation information will always be refreshed.
     **policy**
     policy.directory                              ./config/policy                                                                                                                                                                                                                                                                                                                                                                                                                                                          Directory to read policy files from. Policy files are JSON files that contain a scope to PresentationDefinition mapping.
     ========================================      ===================================================================================================================================================================================================================================================================================================================================================================================================================================================================      ============================================================================================================================================================================================================================================================================================================================================

auth/api/iam/api.go

@@ -29,14 +29,16 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/nuts-foundation/nuts-node/core/to"
 	"html/template"
 	"net/http"
 	"net/url"
 	"slices"
 	"strings"
 	"time"
 
+	"github.com/nuts-foundation/nuts-node/core/to"
+	"github.com/nuts-foundation/nuts-node/vcr/credential"
+
 	"github.com/labstack/echo/v4"
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/lestrrat-go/jwx/v2/jwt"
@@ -729,31 +731,48 @@ func (r Wrapper) RequestServiceAccessToken(ctx context.Context, request RequestS
 		return nil, err
 	}
 
-	tokenCache := r.accessTokenCache()
-	cacheKey := accessTokenRequestCacheKey(request)
-	if request.Params.CacheControl == nil || *request.Params.CacheControl != "no-cache" {
-		// try to retrieve token from cache
-		tokenCacheResult := new(TokenResponse)
-		err = tokenCache.Get(cacheKey, tokenCacheResult)
-		if err == nil {
-			// adjust tokenCacheResult.ExpiresIn to the remaining time
-			expiresAt := time.Unix(int64(*tokenCacheResult.ExpiresAt), 0)
-			tokenCacheResult.ExpiresIn = to.Ptr(int(time.Until(expiresAt).Seconds()))
-			return RequestServiceAccessToken200JSONResponse(*tokenCacheResult), nil
-		} else if !errors.Is(err, storage.ErrNotFound) {
-			// only log error, don't fail
-			log.Logger().WithError(err).Warnf("Failed to retrieve access token from cache: %s", err.Error())
-		}
-	}
+	// PROJECT-GF: Disabled for testing credential revocation
+	//tokenCache := r.accessTokenCache()
+	//cacheKey := accessTokenRequestCacheKey(request)
+	//if request.Params.CacheControl == nil || *request.Params.CacheControl != "no-cache" {
+	//	// try to retrieve token from cache
+	//	tokenCacheResult := new(TokenResponse)
+	//	err = tokenCache.Get(cacheKey, tokenCacheResult)
+	//	if err == nil {
+	//		// adjust tokenCacheResult.ExpiresIn to the remaining time
+	//		expiresAt := time.Unix(int64(*tokenCacheResult.ExpiresAt), 0)
+	//		tokenCacheResult.ExpiresIn = to.Ptr(int(time.Until(expiresAt).Seconds()))
+	//		return RequestServiceAccessToken200JSONResponse(*tokenCacheResult), nil
+	//	} else if !errors.Is(err, storage.ErrNotFound) {
+	//		// only log error, don't fail
+	//		log.Logger().WithError(err).Warnf("Failed to retrieve access token from cache: %s", err.Error())
+	//	}
+	//}
 
 	var credentials []VerifiableCredential
 	if request.Body.Credentials != nil {
 		credentials = *request.Body.Credentials
 	}
+
+	idTokenCredentialIdx := -1
+	if request.Body.IdToken != nil {
+		idTokenCredential, err := credential.CreateDeziUserCredential(*request.Body.IdToken)
+		if err != nil {
+			return nil, core.InvalidInputError("failed to create id_token credential: %w", err)
+		}
+		credentials = append(credentials, *idTokenCredential)
+		idTokenCredentialIdx = len(credentials) - 1
+	}
+
 	// assert that self-asserted credentials do not contain an issuer or credentialSubject.id. These values must be set
 	// by the nuts-node to build the correct wallet for a DID. See https://github.com/nuts-foundation/nuts-node/issues/3696
-	// As a sideeffect it is no longer possible to pass signed credentials to this API.
-	for _, cred := range credentials {
+	// As a side effect it is no longer possible to pass signed credentials to this API.
+	for i, cred := range credentials {
+		// But not for id_token credentials, these are externally signed, meaning they have an issuer
+		if i == idTokenCredentialIdx {
+			continue
+		}
+
 		var credentialSubject []map[string]interface{}
 		if err := cred.UnmarshalCredentialSubject(&credentialSubject); err != nil {
 			// extremely unlikely
@@ -774,7 +793,11 @@ func (r Wrapper) RequestServiceAccessToken(ctx context.Context, request RequestS
 		useDPoP = false
 	}
 	clientID := r.subjectToBaseURL(request.SubjectID)
-	tokenResult, err := r.auth.IAMClient().RequestRFC021AccessToken(ctx, clientID.String(), request.SubjectID, request.Body.AuthorizationServer, request.Body.Scope, useDPoP, credentials)
+	var policyId string
+	if request.Body.PolicyId != nil {
+		policyId = *request.Body.PolicyId
+	}
+	tokenResult, err := r.auth.IAMClient().RequestRFC021AccessToken(ctx, clientID.String(), request.SubjectID, request.Body.AuthorizationServer, request.Body.Scope, policyId, useDPoP, credentials)
 	if err != nil {
 		// this can be an internal server error, a 400 oauth error or a 412 precondition failed if the wallet does not contain the required credentials
 		return nil, err
@@ -785,12 +808,13 @@ func (r Wrapper) RequestServiceAccessToken(ctx context.Context, request RequestS
 	}
 	tokenResult.ExpiresAt = to.Ptr(int(time.Now().Add(ttl).Unix()))
 	// we reduce the ttl by accessTokenCacheOffset to make sure the token is expired when the cache expires
-	ttl -= accessTokenCacheOffset
-	err = tokenCache.Put(cacheKey, tokenResult, storage.WithTTL(ttl))
-	if err != nil {
-		// only log error, don't fail
-		log.Logger().WithError(err).Warnf("Failed to cache access token: %s", err.Error())
-	}
+	// PROJECT-GF: Disabled for testing credential revocation
+	//ttl -= accessTokenCacheOffset
+	//err = tokenCache.Put(cacheKey, tokenResult, storage.WithTTL(ttl))
+	//if err != nil {
+	//	// only log error, don't fail
+	//	log.Logger().WithError(err).Warnf("Failed to cache access token: %s", err.Error())
+	//}
 	return RequestServiceAccessToken200JSONResponse(*tokenResult), nil
 }