International-Data-Spaces-Association / omejdn-daps

Open Source implementation of the Dynamic Attribute Provisioning Service based on http://github.com/Fraunhofer-AISEC/omejdn-server
Apache License 2.0
5 stars 10 forks source link

The DAT issued by DAPS Does Not Contain Expected Attributes. #38

Open Apostasi0225cuhksz opened 2 months ago

Apostasi0225cuhksz commented 2 months ago

The Problem

My Setup

Operating Ststem: wsl2-debian12

Ruby Version: ruby 3.1.2p20

__scope_mapping.yml:__

---
idsc:IDS_CONNECTOR_ATTRIBUTES_ALL:
- securityProfile
- referringConnector
- "@type"
- "@context"
- transportCertsSha256

the client in clients.yml:

- client_id: F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1:F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1
  client_name: consumer
  grant_types: client_credentials
  token_endpoint_auth_method: private_key_jwt
  scope: idsc:IDS_CONNECTOR_ATTRIBUTES_ALL
  attributes:
  - key: idsc
    value: IDS_CONNECTOR_ATTRIBUTES_ALL
  - key: securityProfile
    value: idsc:BASE_SECURITY_PROFILE
  - key: referringConnector
    value: http://consumer.demo
  - key: "@type"
    value: ids:DatPayload
  - key: "@context"
    value: https://w3id.org/idsa/contexts/context.jsonld
  - key: transportCertsSha256
    value: 6b6532b2f6b1b0a803851901d8a19fb4183f3e6e87c8acd75d32901e95b59e9a

What I have done up front

  1. Register the connector using the provided script:

    scripts/register_connector.sh NAME
  2. Start the service

    docker compose up
  3. Try to request the DAT

    scripts/test.sh NAME

What I expected to happen

The DAT should include the attributes defined in the scope_mapping.yml file (securityProfile, referringConnector, etc.). It should look something like:

... some irrelevent output ...

Requesting a DAT from the above token endpoint
Here is the DAT Header:
{
  "typ": "at+jwt",
  "kid": "71165b9e97993341191faa6919d0481779b647d4ae196fbf66d0c3b97e9ce7a8",
  "alg": "RS256"
}
Here is the DAT Body:
{
  "scope": "idsc:IDS_CONNECTOR_ATTRIBUTES_ALL",
  "aud": [
    "idsc:IDS_CONNECTORS_ALL"
  ],
  "iss": "http://localhost/auth",
  "sub": "F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1:F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1",
  "nbf": 1720673694,
  "iat": 1720673694,
  "jti": "0ff526e0-d9f4-4499-a0e0-e72da9a007b5",
  "exp": 1720677294,
  "client_id": "F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1:F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1",
  "securityProfile": "idsc:BASE_SECURITY_PROFILE",
  "referringConnector": "http://consumer.demo",
  "@type": "ids:DatPayload",
  "@context": "https://w3id.org/idsa/contexts/context.jsonld",
  "transportCertsSha256": "6b6532b2f6b1b0a803851901d8a19fb4183f3e6e87c8acd75d32901e95b59e9a"
}

What actually happened

After reqesting the DAT I get none of the attributes

... some irrelevent output ...

Requesting a DAT from the above token endpoint
Here is the DAT Header:
{
  "typ": "at+jwt",
  "kid": "71165b9e97993341191faa6919d0481779b647d4ae196fbf66d0c3b97e9ce7a8",
  "alg": "RS256"
}
Here is the DAT Body:
{
  "scope": "idsc:IDS_CONNECTOR_ATTRIBUTES_ALL",
  "aud": [
    "idsc:IDS_CONNECTORS_ALL"
  ],
  "iss": "http://localhost/auth",
  "sub": "F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1:F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1",
  "nbf": 1720673694,
  "iat": 1720673694,
  "jti": "0ff526e0-d9f4-4499-a0e0-e72da9a007b5",
  "exp": 1720677294,
  "client_id": "F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1:F0:48:B1:00:89:FD:50:D2:0D:0C:0F:9E:4F:89:B3:BC:E5:69:85:F1"
}

The quest of trying to solve it

What were the results of searching for the error on the internet?

I learned what the expected output should look like from [this issue](https://github.com/International-Data-Spaces-Association/omejdn-daps/issues/15#issuecomment-998708255)

What is your best guess as to what might have happened?

The issue mentioned above was from 2 years ago, and maybe it is not the correct expected output anymore. But in this case, I could not find any document about how to get the attributes from DAPS.

dhommen commented 2 weeks ago

Hello @Apostasi0225cuhksz I came across your issue and noticed we encountered the same problem. We resolved it by activating the token_user_attributes plugin. It looks like the version in this repo is older, but the plugin system is still available: Omejdn Server Plugins.

I suggest trying to load the claim_mapper plugin to address the issue.