search

SovereignCloudStack / gx-credential-generator

Tools for creating Gaia-X Credentials (OpenStack, k8s, ...)
https://scs.community/
Eclipse Public License 2.0
7 stars 4 forks source link

LegalParticipant credential type should be LegalPerson instead #120

Open markus-hentsch opened 2 hours ago

markus-hentsch commented 2 hours ago

The current implementation creates a credential of type gx:LegalParticipant^1 but calls it "Legal Person". The Gaia-X schema does not define a gx:LegalParticipant class, only gx:LegalPerson^2.

The Gaia-X Trust Framework defines Legal Person to be an instance of the abstract parent class Legal Participant^3. Furthemore it states:

Instances of a Participant neither being a legal nor a natural person are prohibited.

From this I conclude that plain usage of gx:LegalParticipant as type of Gaia-X Credentials is prohibited. The implementation should be changed to generate a gx:LegalPerson type credential instead.

markus-hentsch commented 2 hours ago

Most likely we were mislead by the gaia-x-101 workshop example from Gaia-X which does the same: https://gitlab.com/gaia-x/lab/workshops/gaia-x-101/-/blob/e0b01980eead64c0a20fec4643659b4c9d9f3331/templates/participant.j2#L15

markus-hentsch commented 2 hours ago

Now that I did a quick test with some local examples, I noticed that the Compliance API does not accept gx:LegalPerson:

{"message":"VerifiableCrdential contains a shape that is not defined in registry shapes",
"error":"Conflict","statusCode":409}

(note: the typo in "VerifiableCrdential" is verbatim from the API response)

Looking at the shape registry^1 included in the @context for the VC, there is no gx:LegalPerson, only gx:LegalParticipant which is the exact opposite to our gx_schema.py^2 and my interpretation of the statement "Instances of a Participant neither being a legal nor a natural person are prohibited."^3