[Extended Sync] allow VC based enforcement inside access policies

[lholthof]

Dear community,

to enable enforcement of FrameworkAgreements in a access policy, would a dataspace wide configuration of default-scopes be reasonable?
In case a provider adds a FrameworkAgreement into an access policy the consumer will never be able to retrieve such an offer unless he has configured the required FrameworkAgreement as default-scope.

Sample config:
tx.edc.iam.iatp.default-scopes.pcf.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.pcf.type=PcfCredentialCredential
tx.edc.iam.iatp.default-scopes.pcf.operation=read
tx.edc.iam.iatp.default-scopes.membership.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.membership.type=MembershipCredential
tx.edc.iam.iatp.default-scopes.membership.operation=read
tx.edc.iam.iatp.default-scopes.behavioral.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.behavioral.type=BehavioralTwinCredential
tx.edc.iam.iatp.default-scopes.behavioral.operation=read
tx.edc.iam.iatp.default-scopes.traceability.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.traceability.type=TraceabilityCredential
tx.edc.iam.iatp.default-scopes.traceability.operation=read
tx.edc.iam.iatp.default-scopes.dismantler.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.dismantler.type=DismantlerCredential
tx.edc.iam.iatp.default-scopes.dismantler.operation=read
tx.edc.iam.iatp.default-scopes.sustainability.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.sustainability.type=SustainabilityCredential
tx.edc.iam.iatp.default-scopes.sustainability.operation=read
tx.edc.iam.iatp.default-scopes.quality.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.quality.type=QualityCredential
tx.edc.iam.iatp.default-scopes.quality.operation=read
tx.edc.iam.iatp.default-scopes.resiliency.alias=org.eclipse.tractusx.vc.type
tx.edc.iam.iatp.default-scopes.resiliency.type=ResiliencyCredential
tx.edc.iam.iatp.default-scopes.resiliency.operation=read

Regards, Lukas

[paullatzelsperger]

is it possible? yes. Is it reasonable? I don't think so, because that would retrieve all the credentials you have listed on every DSP request, and not all participants may have all of them.

I think this is a bad solution because:

• every connector is leaking all the credentials to everyone all the time
• it would increase the message size needlessly
• in some implementations this may even cause errors on the client side, if credentials are requested, but not returned.
• in addition, this would render the entire presentation query situation obsolete, because the CredentialService could then simply provide all its credentials.

The best way to do this would be to solve it at the spec level (DSP), not circumvent selective disclosure or some hack-around.

[edit]: as an intermediate solution, we could add a parameter to the Management API Catalog Request to add the scope "on demand"