Identity Hub - Initial Setup

[zeier]

Description

This feature covers an initial implementation of the Identity Hub and thus implements a subset of the Identity Hub Specification.

The goal of this feature is to provide an Identity Hub that is deployed as part of the connector (collocated test deployment) to the MVD and supports basic operations to interact with the Registry Service.

The Registration Service replaces the static membership configuration which is currently in place.

Deployment topology

In this feature the only supported deployment topology will be the collocated test deployment.

Participant Identity topology

In this feature, the Identity Hub needs to support a simple One Identifier - One Dataspace topology. Each participant will therefore have a single identity within the single MVD dataspace. This means that no namespacing is required at this point (a single "default" namespace can be used).

Operations

The following operations need to be supported for the MVD dataspace:

• Retrieving Verifiable Credentials in the authorization flow as described in the registration service specification
• Accepting Verifiable Credentials push by the certificate authority during participant onboarding as described in the registration service specification

This requires to implement the following DWN interfaces in the IdentityHubClient implementation:
- Collections Query to query Verifiable Credentials
- Collections Write to push Verifiable Credentials
- Feature Detection listing all the aforementioned operations as supported.

Auth

At this point the Identity Hub endpoints will be open. No participant authentication/authorization will be implemented (see agera-edc/MinimumViableDataspace#29)

Repository

The Identity Hub will receive its dedicated repository in the eclipse-dataspaceconnector org.

Note: Identity Hub code currently resides in the EDC Core repository. This code needs to be extracted and moved to a dedicated repository.

Acceptance Criteria

• Identity Hub is located in own repository
• Identity Hub is implemented taking the current prototype as a baseline and following the tech specs
• IdentityHub is covered by integration tests with a CI pipeline
• Identity Hub is integrated in the MVD and used to manage Verifiable Credentials
• Identity Hub follows the latest DWN spec for the supported operations

Out of Scope

The following aspects will be implemented in subsequent steps and are out of scope for this feature:

• Advanced Deployment topologies
• Advanced Participant Identity topologies
• Multiple Namespaces (only single default namespace)
• Full DWN implementation of the interfaces listed in the specification other than the ones listed in this feature
• Management API
• Events
• Participant authentication and authorization through Permissions (see Identity Hub - Permissions MinimumViableDataspace#29, currently not required for the MVD)

Stories

• IdentityHub - Get claims to apply policies ADR #23
• IdentityHub - HTTP Client #20
• Add checkstyle for MVD, Registration Service and Identity Service MinimumViableDataspace#6
• Identity Hub - Implement Verifiable Credential model #12
• Identity Hub - In-Memory Store #18
• Identity Hub - Implementation and Integration Tests #17
• Identity Hub - Repository Setup #16
• IdentityHub - Get and verify credentials #24
• Identity Hub - MVD integration #21
• IdentityHub - Command line client  #25
• Identity Hub - Remove Code from EDC Repo #22
• Identity Hub - Handle Base64Url decoding/encoding of the data field #14
• MVD - Adapt policy rules to verifiable credentials model #32
• Identity Hub: CredentialsVerifier failures on invalid Verifiable Credentials #47