rev: metadata endpoint

- use federation `entity_configuration_exp` instead mapping in credential_configurations
- rev mapping for get_credential_configurations_supported

(view: 444#discussion_r2152251070)

Author: saralongobardiacn

example/satosa/openid4vci_frontend.yaml

@@ -476,7 +476,6 @@ config:
   # this is the custom configuration for credential management.
   credential_configurations:
     lookup_source: openid4vci #this key is the same one found in `internal_attributes.yaml`, used for lookup filter for attributes
-    entity_configuration_exp: 800
     entity_default_sig_alg: *default_sig_alg
     credential_specification:
       mso_mdoc_mDL:

pyeudiw/openid4vci/endpoints/metadata_endpoint.py

@@ -22,15 +22,7 @@ def __init__(self, config: dict, internal_attributes: dict[str, dict[str, str |
         """
         super().__init__(config, internal_attributes, base_url, name)
         self.metadata_jwks = config.get("metadata_jwks", [])
-
-    @property
-    def authority_hints(self):
-        return (
-            self.config.get("trust", {})
-            .get("federation", {})
-            .get("config", {})
-            .get("authority_hints", [])
-        )
+        self.federation_config = self.config.get("trust", {}).get("federation", {}).get("config", {})
 
     def _ensure_credential_issuer(self, metadata: dict, metadata_key: str, issuer_key:str):
         metadata_val = metadata.get(metadata_key)
@@ -52,13 +44,13 @@ def metadata(self) -> dict:
     def entity_configuration_as_dict(self) -> dict:
         """Returns the entity configuration as a dictionary."""
         ec_payload = {
-            "exp": exp_from_now(minutes=self.credential_configuration.entity_configuration_exp),
+            "exp": exp_from_now(minutes=self.federation_config.get("entity_configuration_exp")),
             "iat": iat_now(),
             "iss": self.entity_id,
             "sub": self.entity_id,
             "jwks": {"keys": self.metadata_jwks},
             "metadata": self.metadata,
-            "authority_hints": self.authority_hints,
+            "authority_hints": self.federation_config.get("authority_hints", []),
         }
         return ec_payload
 
@@ -105,7 +97,6 @@ def _validate_configs(self):
             ])
         self._validate_required_configs([
             ("credential_configurations.entity_default_sig_alg", credential_configuration.entity_default_sig_alg),
-            ("credential_configurations.entity_configuration_exp", credential_configuration.entity_configuration_exp),
         ])
 
         self.credential_configuration = credential_configuration

pyeudiw/openid4vci/tools/config.py

@@ -46,7 +46,7 @@ def get_credential_configurations_supported(self) -> Dict[str, CredentialConfigu
         if not ccs:
             return None
         return {
-            k: CredentialConfiguration(id=k, format=v["format"], scope=v["scope"])
+            k: CredentialConfiguration.map(k, v)
             for k, v in ccs.items()
         }
 

pyeudiw/satosa/schemas/metadata.py

@@ -18,6 +18,16 @@ class CredentialConfiguration(BaseModel):
     id: str
     format: str
     scope: str
+    doctype: Optional[str] = None
+
+    @staticmethod
+    def map(id: str, config_dict: dict):
+        return CredentialConfiguration(
+            id=id,
+            format=config_dict["format"],
+            scope=config_dict["scope"],
+            doctype=config_dict.get("doctype"),
+        )
 
 class OpenidCredentialIssuerMetadata(BaseModel):
     credential_configurations_supported: Optional[dict] = None

pyeudiw/tests/openid4vci/endpoints/test_metadata_endpoint.py

@@ -67,8 +67,6 @@ def _mock_configurations(field: list[str] | str):
 @pytest.mark.parametrize("config, missing_fields", [
     (_mock_configurations("credential_configurations"), ["credential_configurations"]),
     (_mock_configurations("entity_default_sig_alg"), ["credential_configurations.entity_default_sig_alg"]),
-    (_mock_configurations("entity_configuration_exp"), ["credential_configurations.entity_configuration_exp"]),
-    (_mock_configurations(["entity_configuration_exp", "entity_default_sig_alg"]), ["credential_configurations.entity_default_sig_alg", "credential_configurations.entity_configuration_exp"])
 ])
 def test_missing_configurations(config, missing_fields):
     do_test_missing_configurations_raises(MetadataHandler, config, missing_fields)

pyeudiw/tests/openid4vci/mock_openid4vci.py

@@ -93,7 +93,6 @@
 
 MOCK_CREDENTIAL_CONFIGURATIONS = {
     "lookup_source": "openid4vci",
-    "entity_configuration_exp": 800,
     "entity_default_sig_alg": "ES256",
     "credential_specification": {
         "dc_sd_jwt_mDL": {
@@ -115,6 +114,26 @@
                     !sd tax_id_code: "TINIT-{{fiscal_code}}"
                     !sd unique_id: "{{unique_id}}"
             """
+        },
+        "mso_mdoc_mDL": {
+            "template": """
+                holder_disclosed_claims:
+                    !sd given_name: "{{name}}"
+                    !sd family_name: "{{surname}}"
+                    !sd place_of_birth:
+                        country: "{{countyOfBirth}}"
+                        locality: "{{placeOfBirth}}"
+                key_binding: true
+                user_claims:
+                    !sd birthdate: "{{dateOfBirth}}"
+                    !sd family_name: "{{surname}}"
+                    !sd given_name: "{{name}}"
+                    !sd place_of_birth:
+                        country: "{{countyOfBirth}}"
+                        locality: "{{placeOfBirth}}"
+                    !sd tax_id_code: "TINIT-{{fiscal_code}}"
+                    !sd unique_id: "{{unique_id}}"
+            """
         }
     }
 }
@@ -131,6 +150,14 @@
             "cryptographic_binding_methods_supported": [
                 "jwk"
             ]
+        },
+        "mso_mdoc_mDL": {
+            "doctype": "org.iso.18013.5.1.mDL",
+            "format": "mso_mdoc",
+            "scope": "mDL",
+            "cryptographic_binding_methods_supported": [
+                "cose_key"
+            ]
         }
     },
     "authorization_servers": [],
@@ -190,7 +217,14 @@
     },
     "user_storage": MOCK_USER_STORAGE_CONFIG,
     "metadata_jwks": MOCK_METADATA_JWKS_CONFIG,
-    "credential_configurations": MOCK_CREDENTIAL_CONFIGURATIONS
+    "credential_configurations": MOCK_CREDENTIAL_CONFIGURATIONS,
+    "trust": {
+        "federation": {
+            "config":{
+                "entity_configuration_exp":600
+            }
+        }
+    }
 }
 
 MOCK_INTERNAL_ATTRIBUTES = {

pyeudiw/tests/openid4vci/tools/test_config.py

@@ -50,19 +50,24 @@ def test_get_openid_credential_issuer(config_utils):
             "cryptographic_binding_methods_supported": [
                 "jwk"
             ]
-        }
+        },
+        'mso_mdoc_mDL': {
+            'cryptographic_binding_methods_supported': ['cose_key'],
+            'format': 'mso_mdoc',
+            'scope': 'mDL'}
     }
 
 
 def test_get_credential_configurations_supported(config_utils):
     result = config_utils.get_credential_configurations_supported()
     assert isinstance(result, dict)
-    assert set(result.keys()) == {"dc_sd_jwt_EuropeanDisabilityCard", "dc_sd_jwt_mDL"}
+    assert set(result.keys()) == {'dc_sd_jwt_mDL', 'mso_mdoc_mDL', 'dc_sd_jwt_EuropeanDisabilityCard'}
     for k, v in result.items():
         assert isinstance(v, CredentialConfiguration)
         assert v.id == k
         assert v.scope is not None
         assert v.format is not None
+        assert v.doctype == ("org.iso.18013.5.1.mDL" if v.id == 'mso_mdoc_mDL' else None)
 
 
 def test_get_credential_configurations(config_utils):