Authorized by a workload token exchanged under the - * {@code issuer-service.token-resource} mapping (the platform's {@code sudo}) for - * {@code issuer-admin-api:admin} — the scope the admin API accepts from a caller that is not one of - * its participants. + *
Authorized by a workload token exchanged under the {@code issuer-service.token-resource} + * mapping, which must be the issuer's participant context: the token's {@code sub} then owns the + * addressed context, so the holder scopes suffice and no {@code issuer-admin-api:admin} elevation is + * needed. The GET of the 409 merge needs {@code holders:read}, the POST and PUT {@code holders:write}. */ @Component public class IssuerServiceHolderRegistrationService implements HolderRegistrationService { - static final String SCOPE = "issuer-admin-api:admin"; + static final String SCOPE = "issuer-admin-api:holders:read issuer-admin-api:holders:write"; private static final Logger log = LoggerFactory.getLogger(IssuerServiceHolderRegistrationService.class); diff --git a/dx-onboarding-api/src/main/java/com/metaform/dxonboarding/config/IssuerServiceProperties.java b/dx-onboarding-api/src/main/java/com/metaform/dxonboarding/config/IssuerServiceProperties.java index 0989020..5ac2178 100644 --- a/dx-onboarding-api/src/main/java/com/metaform/dxonboarding/config/IssuerServiceProperties.java +++ b/dx-onboarding-api/src/main/java/com/metaform/dxonboarding/config/IssuerServiceProperties.java @@ -8,8 +8,9 @@ * * @param url the admin API's base URL (in-cluster: the issuer's admin port) * @param issuerContextId the issuer's participant context, which holds the credential definitions - * @param tokenResource the jwtlet mapping the workload token is exchanged under — it must - * grant {@code issuer-admin-api:admin} + * @param tokenResource the jwtlet mapping the workload token is exchanged under — the + * issuer's participant context, granting {@code issuer-admin-api:holders:read}, + * {@code :holders:write} and {@code :credentials:write} * @param credentialDefinitions the credential definitions a DECADE-X member is offered */ @ConfigurationProperties(prefix = "issuer-service") diff --git a/dx-onboarding-api/src/main/resources/application.yaml b/dx-onboarding-api/src/main/resources/application.yaml index 3df5c55..50e992f 100644 --- a/dx-onboarding-api/src/main/resources/application.yaml +++ b/dx-onboarding-api/src/main/resources/application.yaml @@ -23,12 +23,13 @@ spring: # The IssuerService an approved participant is registered with as credential holder, and offered # its DECADE-X credentials through. The admin API is called -# with a token exchanged under the token-resource jwtlet mapping, which must grant -# issuer-admin-api:admin (the chart's jwtlet seed registers it for this service's account). +# with a token exchanged under the token-resource jwtlet mapping: the issuer's participant context, +# granting issuer-admin-api:holders:read, :holders:write and :credentials:write (the chart's jwtlet +# seed registers it for this service's account). issuer-service: url: http://issuerservice.edc-v.svc.cluster.local:10013/api/admin # ISSUERSERVICE_URL issuer-context-id: issuer # ISSUERSERVICE_ISSUERCONTEXTID - token-resource: sudo # ISSUERSERVICE_TOKENRESOURCE + token-resource: issuer # ISSUERSERVICE_TOKENRESOURCE # Must exist at the issuer — the umbrella chart's DECADE-X issuer seed creates them; an unknown id # fails the whole offer. Every member is offered the Legal Entity VC; the Site VC only a member # that declared a business site (it is issued for the first one). diff --git a/dx-onboarding-api/src/test/java/com/metaform/dxonboarding/adapter/out/issuer/IssuerServiceAdaptersTest.java b/dx-onboarding-api/src/test/java/com/metaform/dxonboarding/adapter/out/issuer/IssuerServiceAdaptersTest.java index b943185..b361bfb 100644 --- a/dx-onboarding-api/src/test/java/com/metaform/dxonboarding/adapter/out/issuer/IssuerServiceAdaptersTest.java +++ b/dx-onboarding-api/src/test/java/com/metaform/dxonboarding/adapter/out/issuer/IssuerServiceAdaptersTest.java @@ -35,7 +35,7 @@ class IssuerServiceAdaptersTest { private final RestClient.Builder builder = RestClient.builder().baseUrl(API); private final MockRestServiceServer server = MockRestServiceServer.bindTo(builder).build(); private final RestClient restClient = builder.build(); - private final IssuerServiceProperties properties = new IssuerServiceProperties(API, "issuer", "sudo", + private final IssuerServiceProperties properties = new IssuerServiceProperties(API, "issuer", "issuer", new IssuerServiceProperties.CredentialDefinitions("dx-legal-entity-credential-def", "dx-site-credential-def")); private final IssuerServiceHolderRegistrationService holders = new IssuerServiceHolderRegistrationService( @@ -88,7 +88,7 @@ private static OnboardingRequestData withSites() { void registerHolder_registersTheDidWithItsLegalEntity() { server.expect(requestTo(API + "/v1/participants/issuer/holders")) .andExpect(method(HttpMethod.POST)) - .andExpect(header("Authorization", "Bearer token-for-sudo-issuer-admin-api:admin")) + .andExpect(header("Authorization", "Bearer token-for-issuer-issuer-admin-api:holders:read issuer-admin-api:holders:write")) .andExpect(content().json(""" {"holderId": "%s", "did": "%s", "name": "Acme Corp", "properties": {"id": "%s", "dxSubjectType": "dx:Wallet", "dxLegalEntity": %s}}""" @@ -174,7 +174,7 @@ void registerHolder_mergesIntoAHolderAnotherDataspaceRegistered() { void offerCredentials_offersBothCredentialsToAHolderWithASite() { server.expect(requestTo(API + "/v1/participants/issuer/credentials/offer")) .andExpect(method(HttpMethod.POST)) - .andExpect(header("Authorization", "Bearer token-for-sudo-issuer-admin-api:admin")) + .andExpect(header("Authorization", "Bearer token-for-issuer-issuer-admin-api:credentials:write")) .andExpect(content().json(""" {"holderId": "%s", "credentials": ["dx-legal-entity-credential-def", "dx-site-credential-def"]}""" .formatted(DID), true)) diff --git a/vendor-stack/chart/Chart.lock b/vendor-stack/chart/Chart.lock index bdaaccc..62a2ca6 100644 --- a/vendor-stack/chart/Chart.lock +++ b/vendor-stack/chart/Chart.lock @@ -1,12 +1,12 @@ dependencies: - name: core-platform-distribution repository: oci://ghcr.io/eclipse-cfm/charts - version: 0.0.38 + version: 0.0.41 - name: decadex-profile repository: file://../../charts/decadex-profile version: 0.1.0 - name: certo repository: oci://ghcr.io/metaform/charts version: 0.0.8 -digest: sha256:522471d02af7e32ef93bfa7ddd0a97d1d71f67759ac79acb60a343d1410d2c90 -generated: "2026-11-06T11:53:20.902352907Z" +digest: sha256:8637883c863e420a3560204e4bc3fb253d724b12a94d58abca913db0908f349f +generated: "2026-11-11T13:03:33.496487+01:00" diff --git a/vendor-stack/chart/Chart.yaml b/vendor-stack/chart/Chart.yaml index e61a989..1fe1dcd 100644 --- a/vendor-stack/chart/Chart.yaml +++ b/vendor-stack/chart/Chart.yaml @@ -20,7 +20,7 @@ dependencies: # infra (NATS/Vault/Postgres/telemetry) + generic platform seeding - name: core-platform-distribution repository: oci://ghcr.io/eclipse-cfm/charts - version: 0.0.38 + version: 0.0.41 # DECADE-X dataspace seeding from this repository: the EDC dataspace profile + DCP scope, and the # tenant-manager dataspace profile participant provisioning needs - name: decadex-profile diff --git a/vendor-stack/chart/values.yaml b/vendor-stack/chart/values.yaml index 0b6c155..e71bb75 100644 --- a/vendor-stack/chart/values.yaml +++ b/vendor-stack/chart/values.yaml @@ -170,7 +170,7 @@ certoAgent: replicas: 1 image: repository: ghcr.io/eclipse-cfm/cfm/certoagent - tag: 0.0.6 + tag: 0.0.8 pullPolicy: IfNotPresent resources: {} natsAuth: