vc/config.saml.example.yaml at main · SUNET/vc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
# SAML Configuration Example for VC Issuer
# This file demonstrates how to configure SAML authentication for credential issuance.
#
# SAML authentication requires two parts:
#   1. data_sources — which credentials use SAML and how (assertion, datastore, or external_api)
#   2. auth_providers.saml — the SAML SP configuration and attribute_mappings
#
# attribute_mappings is needed for SAML because SAML attribute OIDs
# (e.g. urn:oid:2.5.4.42) differ from credential claim names (given_name).

common:
  mongo:
    uri: mongodb://mongo:27017
  production: false

  credential_metadata:
    pid:
      vctm_file_path: "/metadata/vctm_pid.json"
      format: "dc+sd-jwt"
    diploma:
      vctm_file_path: "/metadata/vctm_diploma.json"
      format: "dc+sd-jwt"

issuer:
  issuer_url: "http://apigw.vc.docker:8080"
  api_server:
    addr: :8080
  grpc_server:
    addr: issuer.vc.docker:8090
  registry_client:
    addr: registry.vc.docker:8090
  key_config:
    private_key_path: "/pki/signing_ec_private.pem"
    chain_path: "/pki/signing_ec_chain.pem"
  jwt_attribute:
    issuer: https://issuer.sunet.se
    enable_not_before: true
    valid_duration: 3600
    verifiable_credential_type: "https://credential.sunet.se/identity_credential"

apigw:
  key_config:
    private_key_path: "/pki/signing_ec_private.pem"
    chain_path: "/pki/signing_ec_chain.pem"
  api_server:
    addr: :8080
  public_url: "http://apigw.vc.docker:8080"
  registry_public_url: "http://registry.vc.docker:8080"
  issuer_client:
    addr: issuer.vc.docker:8090
  registry_client:
    addr: registry.vc.docker:8090

  # ── Data sources ─────────────────────────────────────────────────
  # Each credential type goes under one of three data source categories.
  # All can use the same auth_provider (saml in this example).
  data_sources:
    # Assertion: credential data comes directly from the SAML response attributes.
    # No database or API call needed — the attributes ARE the credential claims.
    assertion:
      scopes:
        pid:
          auth_provider: saml
        diploma:
          auth_provider: saml

    # Datastore: credential data is pre-loaded in MongoDB by an authentic source.
    # SAML is used only to identify the user; auth_claims specify which SAML
    # attributes to use for the datastore lookup.
    datastore:
      scopes:
        ehic:
          auth_provider: saml
          auth_claims: ["given_name", "family_name", "birthdate"]
        pda1:
          auth_provider: saml
          auth_claims: ["given_name", "family_name", "birthdate"]

    # External API: credential data is fetched from a remote API at issuance time.
    # SAML identifies the user; the remote API provides the credential data.
    external_api:
      scopes:
        micro_credential:
          auth_provider: saml
          remote: ladok

  # Named remote connections (referenced by external_api credentials)
  remotes:
    ladok:
      type: eduapi
      base_url: "https://api.ladok.se/eduapi"
      token_url: "https://api.ladok.se/oauth2/token"
      client_id: "vc-ladok"
      scopes:
        - "https://purl.imsglobal.org/spec/or/v1p2/scope/roster-core.readonly"

  # ── Auth providers ───────────────────────────────────────────────
  auth_providers:
    saml:
      enable: true
      entity_id: "https://issuer.sunet.se/saml/sp"
      mdq_server: "https://mds.swamid.se/md"
      certificate_path: "/pki/saml_sp.crt"
      private_key_path: "/pki/saml_sp.key"
      acs_endpoint: "https://issuer.sunet.se/saml/acs"
      session_duration: 300
      metadata_cache_ttl: 86400

      # attribute_mapping normalizes SAML attribute OIDs to canonical claim names.
      # Applied to ALL attributes in the assertion — not per-credential.
      # Which normalized attributes are used depends on the data source:
      #   - assertion: VCTM determines which go into the credential
      #   - datastore: auth_claims determines which are used for DB identity lookup
      attribute_mapping:
        "urn:oid:2.5.4.42":  # givenName
          claim: "given_name"
        "urn:oid:2.5.4.4":   # surname
          claim: "family_name"
        "urn:oid:0.9.2342.19200300.100.1.3":  # mail
          claim: "email_address"
          transform: "lowercase"
        "urn:oid:1.2.752.29.4.13":  # Swedish personnummer
          claim: "personal_administrative_number"
        "urn:oid:2.5.4.6":   # country
          claim: "nationalities"
          transform: "country_alpha2"
          as_array: true
        "urn:oid:1.3.6.1.5.5.7.9.1":  # dateOfBirth
          claim: "birth_date"
        "urn:oid:1.3.6.1.4.1.5923.1.1.1.1":  # eduPersonAffiliation
          claim: "affiliation"
        "urn:oid:1.3.6.1.4.1.5923.1.1.1.6":  # eduPersonPrincipalName
          claim: "principal_name"
        "urn:oid:2.5.4.10":  # organizationName
          claim: "institution"

  # ── Delivery ─────────────────────────────────────────────────────
  delivery:
    openid4vci:
      token_endpoint: "http://apigw.vc.docker:8080/token"
      clients:
        "1003":
          type: "public"
          redirect_uri: "https://dev.wallet.sunet.se"
          scopes:
            - "pid"
            - "diploma"

# Common SAML Attribute OIDs Reference:
# ------------------------------------------
# Identity Attributes:
#   urn:oid:2.5.4.42                      - givenName
#   urn:oid:2.5.4.4                       - surname (sn)
#   urn:oid:2.5.4.3                       - commonName (cn)
#   urn:oid:0.9.2342.19200300.100.1.3     - mail
#   urn:oid:2.16.840.1.113730.3.1.241     - displayName
#
# Organization Attributes:
#   urn:oid:2.5.4.10                      - organizationName (o)
#   urn:oid:2.5.4.11                      - organizationalUnitName (ou)
#
# eduPerson Attributes (SAML for education):
#   urn:oid:1.3.6.1.4.1.5923.1.1.1.1      - eduPersonAffiliation
#   urn:oid:1.3.6.1.4.1.5923.1.1.1.6      - eduPersonPrincipalName
#   urn:oid:1.3.6.1.4.1.5923.1.1.1.9      - eduPersonScopedAffiliation
#   urn:oid:1.3.6.1.4.1.5923.1.1.1.10     - eduPersonTargetedID
#
# SCHAC Attributes (European academic attributes):
#   urn:oid:1.3.6.1.4.1.25178.1.2.9       - schacHomeOrganization
#   urn:oid:1.3.6.1.4.1.25178.1.2.14      - schacPersonalUniqueCode
#
# Swedish Attributes:
#   urn:oid:1.2.752.29.4.13               - personalIdentityNumber (Swedish personnummer)
#   urn:oid:1.2.752.201.3.4               - norEduPersonNIN (Nordic personal identity number)
#
# Employment Attributes:
#   urn:oid:2.16.840.1.113730.3.1.3       - employeeNumber
#   urn:oid:2.16.840.1.113730.3.1.4       - employeeType
#
# MDQ Server Examples:
# ------------------------------------------
# - SWAMID (Swedish academic identity federation): https://mds.swamid.se/md
# - eduGAIN (Global academic identity federation): https://mdq.edugain.org
# - InCommon (US education/research): https://mdq.incommon.org

# Testing with TestShib:
# ------------------------------------------
# For testing, you can use TestShib (https://www.testshib.org):
#   entity_id: "https://your-issuer.example.com/saml/sp"
#   mdq_server: Leave empty or use local metadata file
#   IdP Entity ID: "https://idp.testshib.org/idp/shibboleth"
#
# Download TestShib IdP metadata from:
#   https://www.testshib.org/metadata/testshib-providers.xml