ICC OIDC Bridge

This repository contains Python/Django code for an implementation of Indy verifiable credential-based authentication using OpenID Connect

The project is a rewrite of VC-AuthN OIDC that is written in .Net as we needed the implementation to be done in Python. We have tried to mimic the vc-authn-oidc workflows and endpoints so it can be used as replacement of the .Net project in their Demo

Dependencies

The project depends on a PostgreSQL database and a running instance of ACA-PY. Both are included in the docker-compose file found in the repository.

Running the project

Docker and docker-compose is used to start the project. The .env_example file has defaults for your project. Copy it to a .env file so they are used by the docker-compose. Review them to match your environment, but it should work as-is for a local test

$ cp .env_example .env
$ docker-compose up -d

Non-interactive auth (for mobile)

Non-interactive authentication (from user perspective) can be achieved by adding prompt=none in the initial call to /vc/connect/authorize. This will return a JSON object instead of a website. The returned object definition is as follows:

{
  "url": short_url,
  "b64_presentation": b64_presentation,
  "poll_interval": settings.POLL_INTERVAL,
  "poll_max_tries": settings.POLL_MAX_TRIES,
  "poll_url": f"{settings.SITE_URL}/vc/connect/poll?pid={pres_req}",
  "resolution_url": f"{settings.SITE_URL}/vc/connect/callback?pid={pres_req}",
}

As this is an asyncronous authentication, the client (relying party) should be polling periodically /vc/connect/callback (the URL is returned in resolution_url in the JSON payload). A 403 HTTP error means the request has not been yet fullfilled. Any other 4XX error means a real problem so polling can stop. On success, a redirect will be returned with the code to obtain the token.

Running the demo

To be able to use this project in the vc-authn-demo Demo we need to follow this steps.

Important You should run the demo in a workstation with direct access from Internet, using a cloud provider or ngrok

Start the agent

docker-compose up -d

Set superadmin password to be able to configure the bridge

 docker-compose exec oidc-django bash
 
 code$ python manage.py createsuperuser

Connect to the admin console: http://localhost:8084/admin
Add the following key in the model RSAKey so it matches the variable JWT_KEY_KID in oidc_controller/settings/local.py

If you need to generate your own key, you can use the following command:

code$ python manage.py creatersakey
RSA key successfully created with kid: 525786059b724b15b2d23033664342ff

And update the local.py with the new key

Head to http://localhost:8084/admin/ and login with the superuser you just created

Create a presentation configuration using the admin interface. Example:

id: verified-email

subject identifier: email

configuration:

{"name": "Basic Proof", "version": "1.0", "requested_attributes": [{"name": "email", "restrictions": []}], "requested_predicates": []}

Create a client with the admin: check Add Client. When creating the client ensure that the client has the following parameters:
- Name: Testing
- Client Type: Public
- Response types: code(Authorization Code Flow)
- Redirect Uris: http://localhost:8084/oidc/auth/cb/ (This URL should match what it comes from the RP in the demo)
Note the client ID which was generated
Generate the QR Code
- Alternative A: run the vc-authn-oidc demo with instructions from the following repository
```
git clone https://github.com/bcgov/vc-authn-oidc.git
```
  - After creating the client in the step above, get the client ID and update the manage and modify the variable OIDC_RP_CLIENT_ID
- Alternative B: open link in browser
  - invoke the following URL, replacing the IP address, the redirect URI and the client_id
```
 http://localhost:5000/vc/connect/authorize?pres_req_conf_id=verified-email&scope=openid+profile+vc_authn&response_type=code&client_id=310090&redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Foidc%2Fauth%2Fcb%2F&state=O8ALJmGFm5ByvYMyWhT7vkzdc3dc5Yds&nonce=
```

UN-ICC/icc-oidc-bridge

ICC OIDC Bridge

Dependencies

Running the project

Non-interactive auth (for mobile)

Running the demo