ICC OIDC Bridge

This repository contains Python/Django code for an implementation of Indy verifiable credential-based authentication using OpenID Connect

The project is a rewrite of VC-AuthN OIDC that is written in .Net as we needed the implementation to be done in Python. We have tried to mimic the vc-authn-oidc workflows and endpoints so it can be used as replacement of the .Net project in their Demo

Dependencies

The project depends on a PostgreSQL database and a running instance of ACA-PY. Both are included in the docker-compose file found in the repository.

Running the project

With the bash script manager we can start/stop the project with docker. Docker and docker-compose is needed for the script to work. The manage script exports several environment variables that are used by the docker-compose. Review them to match your environment, but it should work as-is for a local test

$ ./manage
./manage start | stop

Running the demo

To be able to use this project in the vc-authn-demo Demo we need to follow this steps.

Important You should run the demo in a workstation with direct access from Internet, using a cloud provider or ngrok

Start the agent

 ./manage start

Set superadmin password to be able to configure the bridge

 docker exec -it oidc-bridge_oidc-django_1 bash
 
 code$ python manage.py createsuperuser

Connect to the admin console: http://loccalhost:5000/admin
Add the following key in the model RSAKey so it matches the variable JWT_KEY_KID in oidc_controller/settings/local.py

If you need to generate your own key, you can use the following command:

code$ python manage.py creatersakey
RSA key successfully created with kid: 3fd0079d2f87421708864ee9c84c8d4d

And update the local.py with the new key

Head to http://localhost:5000/admin/ and login with the superuser you just created

Create a presentation configuration using the admin interface. Example:

id: verified-email

subject identifier: email

configuration:

{"name": "Basic Proof", "version": "1.0", "requested_attributes": [{"name": "email", "restrictions": []}], "requested_predicates": []}

Create a client with the admin: check Add Client. When creating the client ensure that the client has the following parameters:
- Name: Testing
- Client Type: Public
- Response types: code(Authorization Code Flow)
- Redirect Uris: http://localhost:5000/oidc/auth/cb/ (This URL should match what it comes from the RP in the demo)
Note the client ID which was generated
Generate the QR Code
- Alternative A: run the vc-authn-oidc demo with instructions from the following repository
```
git clone https://github.com/bcgov/vc-authn-oidc.git
```
  - After creating the client in the step above, get the client ID and update the manage and modify the variable OIDC_RP_CLIENT_ID
- Alternative B: open link in browser
  - invoke the following URL, replacing the IP address, the redirect URI and the client_id
```
 http://localhost:5000/vc/connect/authorize?pres_req_conf_id=verified-email&scope=openid+profile+vc_authn&response_type=code&client_id=310090&redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Foidc%2Fauth%2Fcb%2F&state=O8ALJmGFm5ByvYMyWhT7vkzdc3dc5Yds&nonce=
```

briscula/icc-oidc-bridge

ICC OIDC Bridge

Dependencies

Running the project

Running the demo