@eudiplo/cli 9.1.0-main.f4735f2 → 9.1.0-main.f567faa
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/config/portability/migrations.spec.js +2 -1
- package/dist/commands/config/portability/migrations.spec.js.map +1 -1
- package/dist/commands/config/tenant/action.d.ts.map +1 -1
- package/dist/commands/config/tenant/action.js +2 -1
- package/dist/commands/config/tenant/action.js.map +1 -1
- package/dist/index.js +1380 -94
- package/package.json +1 -1
- package/templates/docker-compose.yml +2 -2
- package/templates/schemas/CreateTenantDto.schema.json +2 -2
- package/templates/schemas/IssuanceConfig.schema.json +3 -8
- package/templates/schemas/IssuanceConfigFile.schema.json +814 -1
- package/templates/schemas/KeyChainConfigFile.schema.json +371 -1
- package/templates/schemas/KeyChainCreateDto.schema.json +1 -0
- package/templates/schemas/KeyChainDefaultsConfigFile.schema.json +58 -0
- package/templates/schemas/KeyChainImportDto.schema.json +1 -0
package/dist/index.js
CHANGED
|
@@ -21768,11 +21768,11 @@ var CONFIG_FORMATS = {
|
|
|
21768
21768
|
Tenant: { slug: "tenant", file: "TenantConfigFile", version: 4 },
|
|
21769
21769
|
Client: { slug: "client", file: "ClientConfigFile", version: 2 },
|
|
21770
21770
|
KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
|
|
21771
|
-
KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version:
|
|
21771
|
+
KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 4 },
|
|
21772
21772
|
KeyChainDefaults: {
|
|
21773
21773
|
slug: "key-chain-defaults",
|
|
21774
21774
|
file: "KeyChainDefaultsConfigFile",
|
|
21775
|
-
version:
|
|
21775
|
+
version: 2
|
|
21776
21776
|
},
|
|
21777
21777
|
RegistrarConfig: {
|
|
21778
21778
|
slug: "registrar-config",
|
|
@@ -21782,7 +21782,7 @@ var CONFIG_FORMATS = {
|
|
|
21782
21782
|
IssuanceConfig: {
|
|
21783
21783
|
slug: "issuance-config",
|
|
21784
21784
|
file: "IssuanceConfigFile",
|
|
21785
|
-
version:
|
|
21785
|
+
version: 6
|
|
21786
21786
|
},
|
|
21787
21787
|
CredentialConfig: {
|
|
21788
21788
|
slug: "credential-config",
|
|
@@ -21839,12 +21839,16 @@ function resourceId(input) {
|
|
|
21839
21839
|
}
|
|
21840
21840
|
function bareFileVersion(kind, spec) {
|
|
21841
21841
|
if (kind === "KeyChain") {
|
|
21842
|
+
if (spec.usageType === "authorizationServer")
|
|
21843
|
+
return 4;
|
|
21842
21844
|
if (spec.usageType === "federation")
|
|
21843
21845
|
return 3;
|
|
21844
21846
|
return "type" in spec ? 2 : 1;
|
|
21845
21847
|
}
|
|
21846
21848
|
if (kind === "RegistrarConfig")
|
|
21847
21849
|
return "relyingPartyContact" in spec ? 2 : 1;
|
|
21850
|
+
if (kind === "KeyChainDefaults")
|
|
21851
|
+
return "authorizationServer" in spec ? 2 : 1;
|
|
21848
21852
|
if (kind === "Tenant") {
|
|
21849
21853
|
if ("defaultKeyChains" in spec)
|
|
21850
21854
|
return 3;
|
|
@@ -21881,6 +21885,7 @@ var issuanceConfigV4ToV5 = {
|
|
|
21881
21885
|
};
|
|
21882
21886
|
}
|
|
21883
21887
|
};
|
|
21888
|
+
var TENANT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,62}$/;
|
|
21884
21889
|
function federationEntityIdProblem(entityId, options) {
|
|
21885
21890
|
const value = `federation.entityId '${JSON.stringify(entityId).slice(1, -1)}'`;
|
|
21886
21891
|
if (/[\s\u0000-\u001f\u007f]/.test(entityId)) {
|
|
@@ -21930,6 +21935,37 @@ var presentationConfigV1ToV2 = {
|
|
|
21930
21935
|
};
|
|
21931
21936
|
}
|
|
21932
21937
|
};
|
|
21938
|
+
var issuanceConfigV5ToV6 = {
|
|
21939
|
+
id: "issuance-config-v6-access-token-signing-key",
|
|
21940
|
+
kind: "IssuanceConfig",
|
|
21941
|
+
from: 5,
|
|
21942
|
+
to: 6,
|
|
21943
|
+
migrate(spec) {
|
|
21944
|
+
const issues = [];
|
|
21945
|
+
const { signingKeyId, ...rest } = spec;
|
|
21946
|
+
if (typeof signingKeyId === "string" && signingKeyId !== "") {
|
|
21947
|
+
issues.push({
|
|
21948
|
+
severity: "warning",
|
|
21949
|
+
code: "ISSUANCE_SIGNING_KEY_ID_REMOVED",
|
|
21950
|
+
path: "/spec/signingKeyId",
|
|
21951
|
+
message: `signingKeyId ${JSON.stringify(signingKeyId)} was removed. The built-in authorization server now signs access tokens with the tenant's authorization server key chain (usage type "authorizationServer"); to choose one, set token.signingKeyId of its entry.`
|
|
21952
|
+
});
|
|
21953
|
+
}
|
|
21954
|
+
const servers = Array.isArray(rest.authorizationServers) ? rest.authorizationServers : [];
|
|
21955
|
+
servers.forEach((server, index) => {
|
|
21956
|
+
const keyChainId = object(server) && object(server.token) ? server.token.signingKeyId : void 0;
|
|
21957
|
+
if (typeof keyChainId !== "string" || keyChainId === "")
|
|
21958
|
+
return;
|
|
21959
|
+
issues.push({
|
|
21960
|
+
severity: "warning",
|
|
21961
|
+
code: "AUTHORIZATION_SERVER_KEY_CHAIN_REQUIRED",
|
|
21962
|
+
path: `/spec/authorizationServers/${index}/token/signingKeyId`,
|
|
21963
|
+
message: `token.signingKeyId ${JSON.stringify(keyChainId)} must name a key chain with usage type "authorizationServer" from now on, else the import is refused. Remove it to use the tenant's authorization server key chain, or point it to such a key chain.`
|
|
21964
|
+
});
|
|
21965
|
+
});
|
|
21966
|
+
return { spec: "signingKeyId" in spec ? rest : spec, issues };
|
|
21967
|
+
}
|
|
21968
|
+
};
|
|
21933
21969
|
var tenantConfigV3ToV4 = {
|
|
21934
21970
|
id: "tenant-v4-key-chain-defaults",
|
|
21935
21971
|
kind: "Tenant",
|
|
@@ -22017,6 +22053,7 @@ var CONFIG_MIGRATIONS = [
|
|
|
22017
22053
|
migrate: (spec) => ({ spec })
|
|
22018
22054
|
},
|
|
22019
22055
|
issuanceConfigV4ToV5,
|
|
22056
|
+
issuanceConfigV5ToV6,
|
|
22020
22057
|
{
|
|
22021
22058
|
id: "client-v2-read-and-status-roles",
|
|
22022
22059
|
kind: "Client",
|
|
@@ -22094,6 +22131,25 @@ var CONFIG_MIGRATIONS = [
|
|
|
22094
22131
|
// spec.
|
|
22095
22132
|
migrate: (spec) => ({ spec })
|
|
22096
22133
|
},
|
|
22134
|
+
{
|
|
22135
|
+
id: "key-chain-v4-authorization-server-usage",
|
|
22136
|
+
kind: "KeyChain",
|
|
22137
|
+
from: 3,
|
|
22138
|
+
to: 4,
|
|
22139
|
+
// v4 only adds the usage type `authorizationServer`: a v3 spec is a valid v4
|
|
22140
|
+
// spec.
|
|
22141
|
+
migrate: (spec) => ({ spec })
|
|
22142
|
+
},
|
|
22143
|
+
{
|
|
22144
|
+
id: "key-chain-defaults-v2-authorization-server",
|
|
22145
|
+
kind: "KeyChainDefaults",
|
|
22146
|
+
from: 1,
|
|
22147
|
+
to: 2,
|
|
22148
|
+
// v2 only adds the optional authorizationServer entry: a v1 spec is a valid
|
|
22149
|
+
// v2 spec, whose tenant keeps using its oldest authorization server key
|
|
22150
|
+
// chain.
|
|
22151
|
+
migrate: (spec) => ({ spec })
|
|
22152
|
+
},
|
|
22097
22153
|
{
|
|
22098
22154
|
id: "credential-config-v2-x509-trusted-authority",
|
|
22099
22155
|
kind: "CredentialConfig",
|
|
@@ -29343,6 +29399,59 @@ var CONFIG_SCHEMAS = [
|
|
|
29343
29399
|
],
|
|
29344
29400
|
"additionalProperties": false
|
|
29345
29401
|
},
|
|
29402
|
+
{
|
|
29403
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
29404
|
+
"$id": "https://eudiplo.dev/schemas/v2/KeyChainDefaultsConfigFile.schema.json",
|
|
29405
|
+
"title": "KeyChainDefaultsConfigFile",
|
|
29406
|
+
"type": "object",
|
|
29407
|
+
"properties": {
|
|
29408
|
+
"$schema": {
|
|
29409
|
+
"type": "string",
|
|
29410
|
+
"const": "https://eudiplo.dev/schemas/v2/KeyChainDefaultsConfigFile.schema.json"
|
|
29411
|
+
},
|
|
29412
|
+
"metadata": {
|
|
29413
|
+
"type": "object",
|
|
29414
|
+
"properties": {
|
|
29415
|
+
"generation": {
|
|
29416
|
+
"type": "integer",
|
|
29417
|
+
"minimum": 1,
|
|
29418
|
+
"maximum": 9007199254740991
|
|
29419
|
+
},
|
|
29420
|
+
"ownership": {
|
|
29421
|
+
"type": "string",
|
|
29422
|
+
"enum": [
|
|
29423
|
+
"unmanaged",
|
|
29424
|
+
"file-managed"
|
|
29425
|
+
]
|
|
29426
|
+
}
|
|
29427
|
+
},
|
|
29428
|
+
"additionalProperties": false
|
|
29429
|
+
},
|
|
29430
|
+
"spec": {
|
|
29431
|
+
"type": "object",
|
|
29432
|
+
"properties": {
|
|
29433
|
+
"access": {
|
|
29434
|
+
"description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
|
|
29435
|
+
"type": "string",
|
|
29436
|
+
"minLength": 1
|
|
29437
|
+
},
|
|
29438
|
+
"authorizationServer": {
|
|
29439
|
+
"description": "ID of the authorization server key chain (usage type authorizationServer) that signs the access tokens of authorization servers without token.signingKeyId and is published in their JWKS. Without it, EUDIPLO uses the tenant's oldest authorization server key chain and creates one with ID authorization-server when the tenant has none.",
|
|
29440
|
+
"type": "string",
|
|
29441
|
+
"minLength": 1
|
|
29442
|
+
}
|
|
29443
|
+
},
|
|
29444
|
+
"additionalProperties": false,
|
|
29445
|
+
"description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
|
|
29446
|
+
}
|
|
29447
|
+
},
|
|
29448
|
+
"required": [
|
|
29449
|
+
"$schema",
|
|
29450
|
+
"metadata",
|
|
29451
|
+
"spec"
|
|
29452
|
+
],
|
|
29453
|
+
"additionalProperties": false
|
|
29454
|
+
},
|
|
29346
29455
|
{
|
|
29347
29456
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
29348
29457
|
"$id": "https://eudiplo.dev/schemas/v2/KmsConfigFile.schema.json",
|
|
@@ -35245,13 +35354,13 @@ var CONFIG_SCHEMAS = [
|
|
|
35245
35354
|
},
|
|
35246
35355
|
{
|
|
35247
35356
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35248
|
-
"$id": "https://eudiplo.dev/schemas/v4/
|
|
35249
|
-
"title": "
|
|
35357
|
+
"$id": "https://eudiplo.dev/schemas/v4/KeyChainConfigFile.schema.json",
|
|
35358
|
+
"title": "KeyChainConfigFile",
|
|
35250
35359
|
"type": "object",
|
|
35251
35360
|
"properties": {
|
|
35252
35361
|
"$schema": {
|
|
35253
35362
|
"type": "string",
|
|
35254
|
-
"const": "https://eudiplo.dev/schemas/v4/
|
|
35363
|
+
"const": "https://eudiplo.dev/schemas/v4/KeyChainConfigFile.schema.json"
|
|
35255
35364
|
},
|
|
35256
35365
|
"metadata": {
|
|
35257
35366
|
"type": "object",
|
|
@@ -35274,110 +35383,1292 @@ var CONFIG_SCHEMAS = [
|
|
|
35274
35383
|
"spec": {
|
|
35275
35384
|
"type": "object",
|
|
35276
35385
|
"properties": {
|
|
35277
|
-
"
|
|
35278
|
-
"
|
|
35279
|
-
"description": "Display name of the tenant.",
|
|
35280
|
-
"type": "string",
|
|
35281
|
-
"minLength": 1
|
|
35386
|
+
"id": {
|
|
35387
|
+
"type": "string"
|
|
35282
35388
|
},
|
|
35283
35389
|
"description": {
|
|
35284
|
-
"
|
|
35390
|
+
"type": "string"
|
|
35391
|
+
},
|
|
35392
|
+
"usageType": {
|
|
35285
35393
|
"type": "string",
|
|
35286
|
-
"
|
|
35394
|
+
"enum": [
|
|
35395
|
+
"access",
|
|
35396
|
+
"authorizationServer",
|
|
35397
|
+
"attestation",
|
|
35398
|
+
"trustList",
|
|
35399
|
+
"statusList",
|
|
35400
|
+
"federation",
|
|
35401
|
+
"encrypt"
|
|
35402
|
+
]
|
|
35287
35403
|
},
|
|
35288
|
-
"
|
|
35289
|
-
"description": "
|
|
35290
|
-
"type": "
|
|
35291
|
-
"
|
|
35292
|
-
"
|
|
35293
|
-
|
|
35294
|
-
|
|
35295
|
-
"minimum": 60,
|
|
35296
|
-
"maximum": 9007199254740991
|
|
35297
|
-
},
|
|
35298
|
-
"cleanupMode": {
|
|
35299
|
-
"description": "Whether to fully delete or anonymize expired sessions.",
|
|
35300
|
-
"type": "string",
|
|
35301
|
-
"enum": [
|
|
35302
|
-
"full",
|
|
35303
|
-
"anonymize"
|
|
35304
|
-
]
|
|
35305
|
-
}
|
|
35306
|
-
},
|
|
35307
|
-
"additionalProperties": false
|
|
35404
|
+
"type": {
|
|
35405
|
+
"description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
|
|
35406
|
+
"type": "string",
|
|
35407
|
+
"enum": [
|
|
35408
|
+
"standalone",
|
|
35409
|
+
"internalChain"
|
|
35410
|
+
]
|
|
35308
35411
|
},
|
|
35309
|
-
"
|
|
35310
|
-
"
|
|
35311
|
-
|
|
35312
|
-
|
|
35313
|
-
|
|
35314
|
-
|
|
35315
|
-
|
|
35316
|
-
|
|
35317
|
-
"maximum": 9007199254740991
|
|
35318
|
-
},
|
|
35319
|
-
"bits": {
|
|
35320
|
-
"description": "Bits-per-status setting (1, 2, 4, or 8).",
|
|
35321
|
-
"anyOf": [
|
|
35322
|
-
{
|
|
35323
|
-
"type": "number",
|
|
35324
|
-
"const": 1
|
|
35325
|
-
},
|
|
35326
|
-
{
|
|
35327
|
-
"type": "number",
|
|
35328
|
-
"const": 2
|
|
35412
|
+
"keySource": {
|
|
35413
|
+
"oneOf": [
|
|
35414
|
+
{
|
|
35415
|
+
"type": "object",
|
|
35416
|
+
"properties": {
|
|
35417
|
+
"type": {
|
|
35418
|
+
"type": "string",
|
|
35419
|
+
"const": "private-jwk"
|
|
35329
35420
|
},
|
|
35330
|
-
{
|
|
35331
|
-
"type": "
|
|
35332
|
-
"
|
|
35421
|
+
"jwk": {
|
|
35422
|
+
"type": "object",
|
|
35423
|
+
"properties": {
|
|
35424
|
+
"kty": {
|
|
35425
|
+
"type": "string",
|
|
35426
|
+
"description": "Key type (for example EC)."
|
|
35427
|
+
},
|
|
35428
|
+
"x": {
|
|
35429
|
+
"type": "string",
|
|
35430
|
+
"description": "Elliptic curve public x coordinate."
|
|
35431
|
+
},
|
|
35432
|
+
"y": {
|
|
35433
|
+
"type": "string",
|
|
35434
|
+
"description": "Elliptic curve public y coordinate."
|
|
35435
|
+
},
|
|
35436
|
+
"crv": {
|
|
35437
|
+
"type": "string",
|
|
35438
|
+
"description": "Elliptic curve name."
|
|
35439
|
+
},
|
|
35440
|
+
"d": {
|
|
35441
|
+
"type": "string",
|
|
35442
|
+
"description": "Private key value."
|
|
35443
|
+
},
|
|
35444
|
+
"alg": {
|
|
35445
|
+
"description": "Optional algorithm hint.",
|
|
35446
|
+
"type": "string"
|
|
35447
|
+
},
|
|
35448
|
+
"kid": {
|
|
35449
|
+
"description": "Optional key identifier.",
|
|
35450
|
+
"type": "string"
|
|
35451
|
+
}
|
|
35452
|
+
},
|
|
35453
|
+
"required": [
|
|
35454
|
+
"kty",
|
|
35455
|
+
"x",
|
|
35456
|
+
"y",
|
|
35457
|
+
"crv",
|
|
35458
|
+
"d"
|
|
35459
|
+
],
|
|
35460
|
+
"additionalProperties": false
|
|
35333
35461
|
},
|
|
35334
|
-
{
|
|
35335
|
-
"type": "
|
|
35336
|
-
"
|
|
35462
|
+
"activeJwk": {
|
|
35463
|
+
"type": "object",
|
|
35464
|
+
"properties": {
|
|
35465
|
+
"kty": {
|
|
35466
|
+
"type": "string",
|
|
35467
|
+
"description": "Key type (for example EC)."
|
|
35468
|
+
},
|
|
35469
|
+
"x": {
|
|
35470
|
+
"type": "string",
|
|
35471
|
+
"description": "Elliptic curve public x coordinate."
|
|
35472
|
+
},
|
|
35473
|
+
"y": {
|
|
35474
|
+
"type": "string",
|
|
35475
|
+
"description": "Elliptic curve public y coordinate."
|
|
35476
|
+
},
|
|
35477
|
+
"crv": {
|
|
35478
|
+
"type": "string",
|
|
35479
|
+
"description": "Elliptic curve name."
|
|
35480
|
+
},
|
|
35481
|
+
"d": {
|
|
35482
|
+
"type": "string",
|
|
35483
|
+
"description": "Private key value."
|
|
35484
|
+
},
|
|
35485
|
+
"alg": {
|
|
35486
|
+
"description": "Optional algorithm hint.",
|
|
35487
|
+
"type": "string"
|
|
35488
|
+
},
|
|
35489
|
+
"kid": {
|
|
35490
|
+
"description": "Optional key identifier.",
|
|
35491
|
+
"type": "string"
|
|
35492
|
+
}
|
|
35493
|
+
},
|
|
35494
|
+
"required": [
|
|
35495
|
+
"kty",
|
|
35496
|
+
"x",
|
|
35497
|
+
"y",
|
|
35498
|
+
"crv",
|
|
35499
|
+
"d"
|
|
35500
|
+
],
|
|
35501
|
+
"additionalProperties": false
|
|
35337
35502
|
}
|
|
35338
|
-
|
|
35339
|
-
|
|
35340
|
-
|
|
35341
|
-
|
|
35342
|
-
|
|
35343
|
-
"
|
|
35344
|
-
"maximum": 9007199254740991
|
|
35503
|
+
},
|
|
35504
|
+
"required": [
|
|
35505
|
+
"type",
|
|
35506
|
+
"jwk"
|
|
35507
|
+
],
|
|
35508
|
+
"additionalProperties": false
|
|
35345
35509
|
},
|
|
35346
|
-
|
|
35347
|
-
"
|
|
35510
|
+
{
|
|
35511
|
+
"type": "object",
|
|
35512
|
+
"properties": {
|
|
35513
|
+
"type": {
|
|
35514
|
+
"type": "string",
|
|
35515
|
+
"const": "external-reference"
|
|
35516
|
+
},
|
|
35517
|
+
"provider": {
|
|
35518
|
+
"type": "string"
|
|
35519
|
+
},
|
|
35520
|
+
"externalKeyId": {
|
|
35521
|
+
"type": "string"
|
|
35522
|
+
},
|
|
35523
|
+
"publicJwk": {
|
|
35524
|
+
"type": "object",
|
|
35525
|
+
"properties": {
|
|
35526
|
+
"kty": {
|
|
35527
|
+
"type": "string"
|
|
35528
|
+
},
|
|
35529
|
+
"x": {
|
|
35530
|
+
"type": "string"
|
|
35531
|
+
},
|
|
35532
|
+
"y": {
|
|
35533
|
+
"type": "string"
|
|
35534
|
+
},
|
|
35535
|
+
"crv": {
|
|
35536
|
+
"type": "string"
|
|
35537
|
+
},
|
|
35538
|
+
"alg": {
|
|
35539
|
+
"type": "string"
|
|
35540
|
+
},
|
|
35541
|
+
"kid": {
|
|
35542
|
+
"type": "string"
|
|
35543
|
+
}
|
|
35544
|
+
},
|
|
35545
|
+
"required": [
|
|
35546
|
+
"kty",
|
|
35547
|
+
"x",
|
|
35548
|
+
"y",
|
|
35549
|
+
"crv"
|
|
35550
|
+
],
|
|
35551
|
+
"additionalProperties": false
|
|
35552
|
+
},
|
|
35553
|
+
"activeExternalKeyId": {
|
|
35554
|
+
"type": "string"
|
|
35555
|
+
},
|
|
35556
|
+
"activePublicJwk": {
|
|
35557
|
+
"type": "object",
|
|
35558
|
+
"properties": {
|
|
35559
|
+
"kty": {
|
|
35560
|
+
"type": "string"
|
|
35561
|
+
},
|
|
35562
|
+
"x": {
|
|
35563
|
+
"type": "string"
|
|
35564
|
+
},
|
|
35565
|
+
"y": {
|
|
35566
|
+
"type": "string"
|
|
35567
|
+
},
|
|
35568
|
+
"crv": {
|
|
35569
|
+
"type": "string"
|
|
35570
|
+
},
|
|
35571
|
+
"alg": {
|
|
35572
|
+
"type": "string"
|
|
35573
|
+
},
|
|
35574
|
+
"kid": {
|
|
35575
|
+
"type": "string"
|
|
35576
|
+
}
|
|
35577
|
+
},
|
|
35578
|
+
"required": [
|
|
35579
|
+
"kty",
|
|
35580
|
+
"x",
|
|
35581
|
+
"y",
|
|
35582
|
+
"crv"
|
|
35583
|
+
],
|
|
35584
|
+
"additionalProperties": false
|
|
35585
|
+
}
|
|
35586
|
+
},
|
|
35587
|
+
"required": [
|
|
35588
|
+
"type",
|
|
35589
|
+
"provider",
|
|
35590
|
+
"externalKeyId",
|
|
35591
|
+
"publicJwk"
|
|
35592
|
+
],
|
|
35593
|
+
"additionalProperties": false
|
|
35594
|
+
},
|
|
35595
|
+
{
|
|
35596
|
+
"type": "object",
|
|
35597
|
+
"properties": {
|
|
35598
|
+
"type": {
|
|
35599
|
+
"type": "string",
|
|
35600
|
+
"const": "required"
|
|
35601
|
+
},
|
|
35602
|
+
"publicJwk": {
|
|
35603
|
+
"type": "object",
|
|
35604
|
+
"properties": {
|
|
35605
|
+
"kty": {
|
|
35606
|
+
"type": "string"
|
|
35607
|
+
},
|
|
35608
|
+
"x": {
|
|
35609
|
+
"type": "string"
|
|
35610
|
+
},
|
|
35611
|
+
"y": {
|
|
35612
|
+
"type": "string"
|
|
35613
|
+
},
|
|
35614
|
+
"crv": {
|
|
35615
|
+
"type": "string"
|
|
35616
|
+
},
|
|
35617
|
+
"alg": {
|
|
35618
|
+
"type": "string"
|
|
35619
|
+
},
|
|
35620
|
+
"kid": {
|
|
35621
|
+
"type": "string"
|
|
35622
|
+
}
|
|
35623
|
+
},
|
|
35624
|
+
"required": [
|
|
35625
|
+
"kty",
|
|
35626
|
+
"x",
|
|
35627
|
+
"y",
|
|
35628
|
+
"crv"
|
|
35629
|
+
],
|
|
35630
|
+
"additionalProperties": false
|
|
35631
|
+
}
|
|
35632
|
+
},
|
|
35633
|
+
"required": [
|
|
35634
|
+
"type"
|
|
35635
|
+
],
|
|
35636
|
+
"additionalProperties": false
|
|
35637
|
+
},
|
|
35638
|
+
{
|
|
35639
|
+
"type": "object",
|
|
35640
|
+
"properties": {
|
|
35641
|
+
"type": {
|
|
35642
|
+
"type": "string",
|
|
35643
|
+
"const": "regenerate"
|
|
35644
|
+
},
|
|
35645
|
+
"keyChainType": {
|
|
35646
|
+
"type": "string",
|
|
35647
|
+
"enum": [
|
|
35648
|
+
"standalone",
|
|
35649
|
+
"internalChain"
|
|
35650
|
+
]
|
|
35651
|
+
}
|
|
35652
|
+
},
|
|
35653
|
+
"required": [
|
|
35654
|
+
"type"
|
|
35655
|
+
],
|
|
35656
|
+
"additionalProperties": false
|
|
35657
|
+
}
|
|
35658
|
+
]
|
|
35659
|
+
},
|
|
35660
|
+
"crt": {
|
|
35661
|
+
"type": "array",
|
|
35662
|
+
"items": {
|
|
35663
|
+
"type": "string"
|
|
35664
|
+
}
|
|
35665
|
+
},
|
|
35666
|
+
"activeCertificate": {
|
|
35667
|
+
"description": "Active certificate for an internal key chain.",
|
|
35668
|
+
"type": "string"
|
|
35669
|
+
},
|
|
35670
|
+
"kmsProvider": {
|
|
35671
|
+
"type": "string"
|
|
35672
|
+
},
|
|
35673
|
+
"rotationPolicy": {
|
|
35674
|
+
"type": "object",
|
|
35675
|
+
"properties": {
|
|
35676
|
+
"enabled": {
|
|
35348
35677
|
"type": "boolean"
|
|
35349
35678
|
},
|
|
35350
|
-
"
|
|
35351
|
-
"
|
|
35352
|
-
|
|
35679
|
+
"intervalDays": {
|
|
35680
|
+
"anyOf": [
|
|
35681
|
+
{
|
|
35682
|
+
"type": "number",
|
|
35683
|
+
"minimum": 1,
|
|
35684
|
+
"maximum": 3650
|
|
35685
|
+
},
|
|
35686
|
+
{
|
|
35687
|
+
"type": "null"
|
|
35688
|
+
}
|
|
35689
|
+
]
|
|
35690
|
+
},
|
|
35691
|
+
"certValidityDays": {
|
|
35692
|
+
"anyOf": [
|
|
35693
|
+
{
|
|
35694
|
+
"type": "number",
|
|
35695
|
+
"minimum": 1,
|
|
35696
|
+
"maximum": 3650
|
|
35697
|
+
},
|
|
35698
|
+
{
|
|
35699
|
+
"type": "null"
|
|
35700
|
+
}
|
|
35701
|
+
]
|
|
35702
|
+
}
|
|
35703
|
+
},
|
|
35704
|
+
"required": [
|
|
35705
|
+
"enabled"
|
|
35706
|
+
],
|
|
35707
|
+
"additionalProperties": false
|
|
35708
|
+
}
|
|
35709
|
+
},
|
|
35710
|
+
"required": [
|
|
35711
|
+
"usageType",
|
|
35712
|
+
"keySource"
|
|
35713
|
+
],
|
|
35714
|
+
"additionalProperties": false
|
|
35715
|
+
}
|
|
35716
|
+
},
|
|
35717
|
+
"required": [
|
|
35718
|
+
"$schema",
|
|
35719
|
+
"metadata",
|
|
35720
|
+
"spec"
|
|
35721
|
+
],
|
|
35722
|
+
"additionalProperties": false
|
|
35723
|
+
},
|
|
35724
|
+
{
|
|
35725
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35726
|
+
"$id": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json",
|
|
35727
|
+
"title": "TenantConfigFile",
|
|
35728
|
+
"type": "object",
|
|
35729
|
+
"properties": {
|
|
35730
|
+
"$schema": {
|
|
35731
|
+
"type": "string",
|
|
35732
|
+
"const": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json"
|
|
35733
|
+
},
|
|
35734
|
+
"metadata": {
|
|
35735
|
+
"type": "object",
|
|
35736
|
+
"properties": {
|
|
35737
|
+
"generation": {
|
|
35738
|
+
"type": "integer",
|
|
35739
|
+
"minimum": 1,
|
|
35740
|
+
"maximum": 9007199254740991
|
|
35741
|
+
},
|
|
35742
|
+
"ownership": {
|
|
35743
|
+
"type": "string",
|
|
35744
|
+
"enum": [
|
|
35745
|
+
"unmanaged",
|
|
35746
|
+
"file-managed"
|
|
35747
|
+
]
|
|
35748
|
+
}
|
|
35749
|
+
},
|
|
35750
|
+
"additionalProperties": false
|
|
35751
|
+
},
|
|
35752
|
+
"spec": {
|
|
35753
|
+
"type": "object",
|
|
35754
|
+
"properties": {
|
|
35755
|
+
"name": {
|
|
35756
|
+
"default": "EUDIPLO",
|
|
35757
|
+
"description": "Display name of the tenant.",
|
|
35758
|
+
"type": "string",
|
|
35759
|
+
"minLength": 1
|
|
35760
|
+
},
|
|
35761
|
+
"description": {
|
|
35762
|
+
"description": "Optional tenant description.",
|
|
35763
|
+
"type": "string",
|
|
35764
|
+
"minLength": 1
|
|
35765
|
+
},
|
|
35766
|
+
"sessionConfig": {
|
|
35767
|
+
"description": "Optional tenant-specific session storage configuration.",
|
|
35768
|
+
"type": "object",
|
|
35769
|
+
"properties": {
|
|
35770
|
+
"ttlSeconds": {
|
|
35771
|
+
"description": "Session time-to-live in seconds.",
|
|
35772
|
+
"type": "integer",
|
|
35773
|
+
"minimum": 60,
|
|
35774
|
+
"maximum": 9007199254740991
|
|
35775
|
+
},
|
|
35776
|
+
"cleanupMode": {
|
|
35777
|
+
"description": "Whether to fully delete or anonymize expired sessions.",
|
|
35778
|
+
"type": "string",
|
|
35779
|
+
"enum": [
|
|
35780
|
+
"full",
|
|
35781
|
+
"anonymize"
|
|
35782
|
+
]
|
|
35783
|
+
}
|
|
35784
|
+
},
|
|
35785
|
+
"additionalProperties": false
|
|
35786
|
+
},
|
|
35787
|
+
"statusListConfig": {
|
|
35788
|
+
"description": "Optional tenant-specific status list defaults.",
|
|
35789
|
+
"type": "object",
|
|
35790
|
+
"properties": {
|
|
35791
|
+
"capacity": {
|
|
35792
|
+
"description": "Default status list capacity.",
|
|
35793
|
+
"type": "integer",
|
|
35794
|
+
"minimum": 100,
|
|
35795
|
+
"maximum": 9007199254740991
|
|
35796
|
+
},
|
|
35797
|
+
"bits": {
|
|
35798
|
+
"description": "Bits-per-status setting (1, 2, 4, or 8).",
|
|
35799
|
+
"anyOf": [
|
|
35800
|
+
{
|
|
35801
|
+
"type": "number",
|
|
35802
|
+
"const": 1
|
|
35803
|
+
},
|
|
35804
|
+
{
|
|
35805
|
+
"type": "number",
|
|
35806
|
+
"const": 2
|
|
35807
|
+
},
|
|
35808
|
+
{
|
|
35809
|
+
"type": "number",
|
|
35810
|
+
"const": 4
|
|
35811
|
+
},
|
|
35812
|
+
{
|
|
35813
|
+
"type": "number",
|
|
35814
|
+
"const": 8
|
|
35815
|
+
}
|
|
35816
|
+
]
|
|
35817
|
+
},
|
|
35818
|
+
"ttl": {
|
|
35819
|
+
"description": "JWT TTL for status list tokens in seconds.",
|
|
35820
|
+
"type": "integer",
|
|
35821
|
+
"minimum": 60,
|
|
35822
|
+
"maximum": 9007199254740991
|
|
35823
|
+
},
|
|
35824
|
+
"immediateUpdate": {
|
|
35825
|
+
"description": "Regenerate status list JWTs immediately after status updates.",
|
|
35826
|
+
"type": "boolean"
|
|
35827
|
+
},
|
|
35828
|
+
"enableAggregation": {
|
|
35829
|
+
"description": "Include aggregation_uri in generated status list JWTs.",
|
|
35830
|
+
"type": "boolean"
|
|
35831
|
+
}
|
|
35832
|
+
},
|
|
35833
|
+
"additionalProperties": false
|
|
35834
|
+
}
|
|
35835
|
+
},
|
|
35836
|
+
"required": [
|
|
35837
|
+
"name"
|
|
35838
|
+
],
|
|
35839
|
+
"additionalProperties": false,
|
|
35840
|
+
"description": "Payload used when importing tenant metadata from config files."
|
|
35841
|
+
}
|
|
35842
|
+
},
|
|
35843
|
+
"required": [
|
|
35844
|
+
"$schema",
|
|
35845
|
+
"metadata",
|
|
35846
|
+
"spec"
|
|
35847
|
+
],
|
|
35848
|
+
"additionalProperties": false
|
|
35849
|
+
},
|
|
35850
|
+
{
|
|
35851
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35852
|
+
"$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
|
|
35853
|
+
"title": "IssuanceConfigFile",
|
|
35854
|
+
"type": "object",
|
|
35855
|
+
"properties": {
|
|
35856
|
+
"$schema": {
|
|
35857
|
+
"type": "string",
|
|
35858
|
+
"const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
|
|
35859
|
+
},
|
|
35860
|
+
"metadata": {
|
|
35861
|
+
"type": "object",
|
|
35862
|
+
"properties": {
|
|
35863
|
+
"generation": {
|
|
35864
|
+
"type": "integer",
|
|
35865
|
+
"minimum": 1,
|
|
35866
|
+
"description": "Monotonically increasing configuration generation."
|
|
35867
|
+
},
|
|
35868
|
+
"ownership": {
|
|
35869
|
+
"type": "string",
|
|
35870
|
+
"enum": [
|
|
35871
|
+
"unmanaged",
|
|
35872
|
+
"file-managed"
|
|
35873
|
+
],
|
|
35874
|
+
"description": "Requested ownership recorded when the document is applied."
|
|
35875
|
+
}
|
|
35876
|
+
},
|
|
35877
|
+
"additionalProperties": false
|
|
35878
|
+
},
|
|
35879
|
+
"spec": {
|
|
35880
|
+
"$ref": "#/$defs/IssuanceConfig"
|
|
35881
|
+
}
|
|
35882
|
+
},
|
|
35883
|
+
"required": [
|
|
35884
|
+
"$schema",
|
|
35885
|
+
"spec"
|
|
35886
|
+
],
|
|
35887
|
+
"additionalProperties": false,
|
|
35888
|
+
"$defs": {
|
|
35889
|
+
"IssuanceConfig": {
|
|
35890
|
+
"type": "object",
|
|
35891
|
+
"properties": {
|
|
35892
|
+
"batchSize": {
|
|
35893
|
+
"description": "Optional issuance batch size.",
|
|
35894
|
+
"type": "integer",
|
|
35895
|
+
"minimum": 1,
|
|
35896
|
+
"maximum": 9007199254740991
|
|
35897
|
+
},
|
|
35898
|
+
"dPopRequired": {
|
|
35899
|
+
"description": "Require DPoP proofs for issuance endpoints.",
|
|
35900
|
+
"type": "boolean"
|
|
35901
|
+
},
|
|
35902
|
+
"walletAttestationRequired": {
|
|
35903
|
+
"description": "Default wallet attestation requirement for managed authorization servers.",
|
|
35904
|
+
"type": "boolean"
|
|
35905
|
+
},
|
|
35906
|
+
"walletProviderTrustLists": {
|
|
35907
|
+
"description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
|
|
35908
|
+
"type": "array",
|
|
35909
|
+
"items": {
|
|
35910
|
+
"type": "object",
|
|
35911
|
+
"properties": {
|
|
35912
|
+
"trustListId": {
|
|
35913
|
+
"type": "string",
|
|
35914
|
+
"minLength": 1
|
|
35915
|
+
},
|
|
35916
|
+
"url": {
|
|
35917
|
+
"description": "URL of the wallet provider trust list.",
|
|
35918
|
+
"type": "string",
|
|
35919
|
+
"format": "uri"
|
|
35920
|
+
},
|
|
35921
|
+
"verifierKey": {
|
|
35922
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
35923
|
+
"type": "object",
|
|
35924
|
+
"propertyNames": {
|
|
35925
|
+
"type": "string"
|
|
35926
|
+
},
|
|
35927
|
+
"additionalProperties": {}
|
|
35928
|
+
},
|
|
35929
|
+
"verifierKeyPem": {
|
|
35930
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
35931
|
+
"type": "string",
|
|
35932
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
35933
|
+
},
|
|
35934
|
+
"verifierX509Der": {
|
|
35935
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
35936
|
+
"type": "string"
|
|
35937
|
+
}
|
|
35938
|
+
},
|
|
35939
|
+
"additionalProperties": false
|
|
35940
|
+
}
|
|
35941
|
+
},
|
|
35942
|
+
"walletAttestationStatusCheckMode": {
|
|
35943
|
+
"description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
|
|
35944
|
+
"anyOf": [
|
|
35945
|
+
{
|
|
35946
|
+
"type": "string",
|
|
35947
|
+
"enum": [
|
|
35948
|
+
"strict",
|
|
35949
|
+
"best_effort",
|
|
35950
|
+
"disabled"
|
|
35951
|
+
]
|
|
35952
|
+
},
|
|
35953
|
+
{
|
|
35954
|
+
"type": "null"
|
|
35955
|
+
}
|
|
35956
|
+
]
|
|
35957
|
+
},
|
|
35958
|
+
"signingKeyId": {
|
|
35959
|
+
"description": "Default signing key chain id for credential issuance.",
|
|
35960
|
+
"type": "string",
|
|
35961
|
+
"minLength": 1
|
|
35962
|
+
},
|
|
35963
|
+
"authorizationServers": {
|
|
35964
|
+
"minItems": 1,
|
|
35965
|
+
"type": "array",
|
|
35966
|
+
"items": {
|
|
35967
|
+
"oneOf": [
|
|
35968
|
+
{
|
|
35969
|
+
"type": "object",
|
|
35970
|
+
"properties": {
|
|
35971
|
+
"type": {
|
|
35972
|
+
"type": "string",
|
|
35973
|
+
"const": "external",
|
|
35974
|
+
"description": "Use an externally managed authorization server."
|
|
35975
|
+
},
|
|
35976
|
+
"id": {
|
|
35977
|
+
"type": "string",
|
|
35978
|
+
"minLength": 1,
|
|
35979
|
+
"description": "Authorization server identifier."
|
|
35980
|
+
},
|
|
35981
|
+
"issuer": {
|
|
35982
|
+
"type": "string",
|
|
35983
|
+
"format": "uri",
|
|
35984
|
+
"description": "Issuer URL for the external authorization server."
|
|
35985
|
+
},
|
|
35986
|
+
"sessionBinding": {
|
|
35987
|
+
"description": "Explicit mapping from an external access-token claim to an existing issuance session.",
|
|
35988
|
+
"type": "object",
|
|
35989
|
+
"properties": {
|
|
35990
|
+
"method": {
|
|
35991
|
+
"type": "string",
|
|
35992
|
+
"const": "access_token_claim",
|
|
35993
|
+
"description": "Read the correlation value from a configured access-token claim."
|
|
35994
|
+
},
|
|
35995
|
+
"claim": {
|
|
35996
|
+
"type": "string",
|
|
35997
|
+
"minLength": 1,
|
|
35998
|
+
"description": "Claim name that contains the issuance-session correlation value."
|
|
35999
|
+
}
|
|
36000
|
+
},
|
|
36001
|
+
"required": [
|
|
36002
|
+
"method",
|
|
36003
|
+
"claim"
|
|
36004
|
+
],
|
|
36005
|
+
"additionalProperties": false
|
|
36006
|
+
},
|
|
36007
|
+
"label": {
|
|
36008
|
+
"description": "Optional display label for UI selection.",
|
|
36009
|
+
"type": "string"
|
|
36010
|
+
},
|
|
36011
|
+
"enabled": {
|
|
36012
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36013
|
+
"type": "boolean"
|
|
36014
|
+
}
|
|
36015
|
+
},
|
|
36016
|
+
"required": [
|
|
36017
|
+
"type",
|
|
36018
|
+
"id",
|
|
36019
|
+
"issuer"
|
|
36020
|
+
],
|
|
36021
|
+
"additionalProperties": false
|
|
36022
|
+
},
|
|
36023
|
+
{
|
|
36024
|
+
"type": "object",
|
|
36025
|
+
"properties": {
|
|
36026
|
+
"type": {
|
|
36027
|
+
"type": "string",
|
|
36028
|
+
"const": "oid4vp",
|
|
36029
|
+
"description": "Use OID4VP-based authorization server chaining."
|
|
36030
|
+
},
|
|
36031
|
+
"id": {
|
|
36032
|
+
"type": "string",
|
|
36033
|
+
"minLength": 1,
|
|
36034
|
+
"description": "Authorization server identifier."
|
|
36035
|
+
},
|
|
36036
|
+
"presentationConfigId": {
|
|
36037
|
+
"type": "string",
|
|
36038
|
+
"minLength": 1,
|
|
36039
|
+
"description": "Presentation configuration id used during authorization."
|
|
36040
|
+
},
|
|
36041
|
+
"immediateWalletRedirect": {
|
|
36042
|
+
"description": "Redirect wallets immediately after authorization response creation.",
|
|
36043
|
+
"type": "boolean"
|
|
36044
|
+
},
|
|
36045
|
+
"token": {
|
|
36046
|
+
"description": "Optional token issuance settings.",
|
|
36047
|
+
"type": "object",
|
|
36048
|
+
"properties": {
|
|
36049
|
+
"lifetimeSeconds": {
|
|
36050
|
+
"description": "Access token lifetime in seconds.",
|
|
36051
|
+
"type": "number",
|
|
36052
|
+
"minimum": 60
|
|
36053
|
+
},
|
|
36054
|
+
"signingKeyId": {
|
|
36055
|
+
"description": "Optional key chain id used to sign issued tokens.",
|
|
36056
|
+
"type": "string",
|
|
36057
|
+
"minLength": 1
|
|
36058
|
+
},
|
|
36059
|
+
"refreshTokenEnabled": {
|
|
36060
|
+
"description": "Enable issuing refresh tokens.",
|
|
36061
|
+
"type": "boolean"
|
|
36062
|
+
},
|
|
36063
|
+
"refreshTokenExpiresInSeconds": {
|
|
36064
|
+
"description": "Refresh token lifetime in seconds.",
|
|
36065
|
+
"type": "number",
|
|
36066
|
+
"minimum": 60
|
|
36067
|
+
}
|
|
36068
|
+
},
|
|
36069
|
+
"additionalProperties": false
|
|
36070
|
+
},
|
|
36071
|
+
"requireDPoP": {
|
|
36072
|
+
"description": "Require DPoP proofs for token/credential requests.",
|
|
36073
|
+
"type": "boolean"
|
|
36074
|
+
},
|
|
36075
|
+
"walletAttestationRequired": {
|
|
36076
|
+
"description": "Require wallet attestation for this authorization server.",
|
|
36077
|
+
"type": "boolean"
|
|
36078
|
+
},
|
|
36079
|
+
"walletProviderTrustLists": {
|
|
36080
|
+
"description": "Optional wallet provider trust list references for this authorization server.",
|
|
36081
|
+
"type": "array",
|
|
36082
|
+
"items": {
|
|
36083
|
+
"type": "object",
|
|
36084
|
+
"properties": {
|
|
36085
|
+
"trustListId": {
|
|
36086
|
+
"type": "string",
|
|
36087
|
+
"minLength": 1
|
|
36088
|
+
},
|
|
36089
|
+
"url": {
|
|
36090
|
+
"description": "URL of the wallet provider trust list.",
|
|
36091
|
+
"type": "string",
|
|
36092
|
+
"format": "uri"
|
|
36093
|
+
},
|
|
36094
|
+
"verifierKey": {
|
|
36095
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
36096
|
+
"type": "object",
|
|
36097
|
+
"propertyNames": {
|
|
36098
|
+
"type": "string"
|
|
36099
|
+
},
|
|
36100
|
+
"additionalProperties": {}
|
|
36101
|
+
},
|
|
36102
|
+
"verifierKeyPem": {
|
|
36103
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
36104
|
+
"type": "string",
|
|
36105
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
36106
|
+
},
|
|
36107
|
+
"verifierX509Der": {
|
|
36108
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
36109
|
+
"type": "string"
|
|
36110
|
+
}
|
|
36111
|
+
},
|
|
36112
|
+
"additionalProperties": false
|
|
36113
|
+
}
|
|
36114
|
+
},
|
|
36115
|
+
"walletAttestationStatusCheckMode": {
|
|
36116
|
+
"description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
|
|
36117
|
+
"type": "string",
|
|
36118
|
+
"enum": [
|
|
36119
|
+
"strict",
|
|
36120
|
+
"best_effort",
|
|
36121
|
+
"disabled"
|
|
36122
|
+
]
|
|
36123
|
+
},
|
|
36124
|
+
"label": {
|
|
36125
|
+
"description": "Optional display label for UI selection.",
|
|
36126
|
+
"type": "string"
|
|
36127
|
+
},
|
|
36128
|
+
"enabled": {
|
|
36129
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36130
|
+
"type": "boolean"
|
|
36131
|
+
}
|
|
36132
|
+
},
|
|
36133
|
+
"required": [
|
|
36134
|
+
"type",
|
|
36135
|
+
"id",
|
|
36136
|
+
"presentationConfigId"
|
|
36137
|
+
],
|
|
36138
|
+
"additionalProperties": false
|
|
36139
|
+
},
|
|
36140
|
+
{
|
|
36141
|
+
"type": "object",
|
|
36142
|
+
"properties": {
|
|
36143
|
+
"type": {
|
|
36144
|
+
"type": "string",
|
|
36145
|
+
"const": "chained",
|
|
36146
|
+
"description": "Use upstream OIDC as authorization source."
|
|
36147
|
+
},
|
|
36148
|
+
"id": {
|
|
36149
|
+
"type": "string",
|
|
36150
|
+
"minLength": 1,
|
|
36151
|
+
"description": "Authorization server identifier."
|
|
36152
|
+
},
|
|
36153
|
+
"upstream": {
|
|
36154
|
+
"type": "object",
|
|
36155
|
+
"properties": {
|
|
36156
|
+
"issuer": {
|
|
36157
|
+
"type": "string",
|
|
36158
|
+
"format": "uri",
|
|
36159
|
+
"description": "Upstream OIDC issuer URL."
|
|
36160
|
+
},
|
|
36161
|
+
"clientId": {
|
|
36162
|
+
"type": "string",
|
|
36163
|
+
"minLength": 1,
|
|
36164
|
+
"description": "Client id for upstream OIDC authentication."
|
|
36165
|
+
},
|
|
36166
|
+
"clientSecret": {
|
|
36167
|
+
"description": "Optional client secret for upstream OIDC authentication.",
|
|
36168
|
+
"type": "string",
|
|
36169
|
+
"minLength": 1
|
|
36170
|
+
},
|
|
36171
|
+
"scopes": {
|
|
36172
|
+
"description": "Optional scopes requested from the upstream issuer.",
|
|
36173
|
+
"type": "array",
|
|
36174
|
+
"items": {
|
|
36175
|
+
"type": "string",
|
|
36176
|
+
"minLength": 1
|
|
36177
|
+
}
|
|
36178
|
+
}
|
|
36179
|
+
},
|
|
36180
|
+
"required": [
|
|
36181
|
+
"issuer",
|
|
36182
|
+
"clientId"
|
|
36183
|
+
],
|
|
36184
|
+
"additionalProperties": false,
|
|
36185
|
+
"description": "Upstream OIDC connection settings."
|
|
36186
|
+
},
|
|
36187
|
+
"token": {
|
|
36188
|
+
"description": "Optional token issuance settings.",
|
|
36189
|
+
"type": "object",
|
|
36190
|
+
"properties": {
|
|
36191
|
+
"lifetimeSeconds": {
|
|
36192
|
+
"description": "Access token lifetime in seconds.",
|
|
36193
|
+
"type": "number",
|
|
36194
|
+
"minimum": 60
|
|
36195
|
+
},
|
|
36196
|
+
"signingKeyId": {
|
|
36197
|
+
"description": "Optional key chain id used to sign issued tokens.",
|
|
36198
|
+
"type": "string",
|
|
36199
|
+
"minLength": 1
|
|
36200
|
+
},
|
|
36201
|
+
"refreshTokenEnabled": {
|
|
36202
|
+
"description": "Enable issuing refresh tokens.",
|
|
36203
|
+
"type": "boolean"
|
|
36204
|
+
},
|
|
36205
|
+
"refreshTokenExpiresInSeconds": {
|
|
36206
|
+
"description": "Refresh token lifetime in seconds.",
|
|
36207
|
+
"type": "number",
|
|
36208
|
+
"minimum": 60
|
|
36209
|
+
}
|
|
36210
|
+
},
|
|
36211
|
+
"additionalProperties": false
|
|
36212
|
+
},
|
|
36213
|
+
"requireDPoP": {
|
|
36214
|
+
"description": "Require DPoP proofs for token/credential requests.",
|
|
36215
|
+
"type": "boolean"
|
|
36216
|
+
},
|
|
36217
|
+
"walletAttestationRequired": {
|
|
36218
|
+
"description": "Require wallet attestation for this authorization server.",
|
|
36219
|
+
"type": "boolean"
|
|
36220
|
+
},
|
|
36221
|
+
"walletProviderTrustLists": {
|
|
36222
|
+
"description": "Optional wallet provider trust list references for this authorization server.",
|
|
36223
|
+
"type": "array",
|
|
36224
|
+
"items": {
|
|
36225
|
+
"type": "object",
|
|
36226
|
+
"properties": {
|
|
36227
|
+
"trustListId": {
|
|
36228
|
+
"type": "string",
|
|
36229
|
+
"minLength": 1
|
|
36230
|
+
},
|
|
36231
|
+
"url": {
|
|
36232
|
+
"description": "URL of the wallet provider trust list.",
|
|
36233
|
+
"type": "string",
|
|
36234
|
+
"format": "uri"
|
|
36235
|
+
},
|
|
36236
|
+
"verifierKey": {
|
|
36237
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
36238
|
+
"type": "object",
|
|
36239
|
+
"propertyNames": {
|
|
36240
|
+
"type": "string"
|
|
36241
|
+
},
|
|
36242
|
+
"additionalProperties": {}
|
|
36243
|
+
},
|
|
36244
|
+
"verifierKeyPem": {
|
|
36245
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
36246
|
+
"type": "string",
|
|
36247
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
36248
|
+
},
|
|
36249
|
+
"verifierX509Der": {
|
|
36250
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
36251
|
+
"type": "string"
|
|
36252
|
+
}
|
|
36253
|
+
},
|
|
36254
|
+
"additionalProperties": false
|
|
36255
|
+
}
|
|
36256
|
+
},
|
|
36257
|
+
"walletAttestationStatusCheckMode": {
|
|
36258
|
+
"description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
|
|
36259
|
+
"type": "string",
|
|
36260
|
+
"enum": [
|
|
36261
|
+
"strict",
|
|
36262
|
+
"best_effort",
|
|
36263
|
+
"disabled"
|
|
36264
|
+
]
|
|
36265
|
+
},
|
|
36266
|
+
"label": {
|
|
36267
|
+
"description": "Optional display label for UI selection.",
|
|
36268
|
+
"type": "string"
|
|
36269
|
+
},
|
|
36270
|
+
"enabled": {
|
|
36271
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36272
|
+
"type": "boolean"
|
|
36273
|
+
}
|
|
36274
|
+
},
|
|
36275
|
+
"required": [
|
|
36276
|
+
"type",
|
|
36277
|
+
"id",
|
|
36278
|
+
"upstream"
|
|
36279
|
+
],
|
|
36280
|
+
"additionalProperties": false
|
|
36281
|
+
},
|
|
36282
|
+
{
|
|
36283
|
+
"type": "object",
|
|
36284
|
+
"properties": {
|
|
36285
|
+
"type": {
|
|
36286
|
+
"type": "string",
|
|
36287
|
+
"const": "built-in",
|
|
36288
|
+
"description": "Use EUDIPLO built-in authorization server."
|
|
36289
|
+
},
|
|
36290
|
+
"id": {
|
|
36291
|
+
"type": "string",
|
|
36292
|
+
"minLength": 1,
|
|
36293
|
+
"description": "Authorization server identifier."
|
|
36294
|
+
},
|
|
36295
|
+
"token": {
|
|
36296
|
+
"description": "Optional token issuance settings.",
|
|
36297
|
+
"type": "object",
|
|
36298
|
+
"properties": {
|
|
36299
|
+
"lifetimeSeconds": {
|
|
36300
|
+
"description": "Access token lifetime in seconds.",
|
|
36301
|
+
"type": "number",
|
|
36302
|
+
"minimum": 60
|
|
36303
|
+
},
|
|
36304
|
+
"signingKeyId": {
|
|
36305
|
+
"description": "Optional key chain id used to sign issued tokens.",
|
|
36306
|
+
"type": "string",
|
|
36307
|
+
"minLength": 1
|
|
36308
|
+
},
|
|
36309
|
+
"refreshTokenEnabled": {
|
|
36310
|
+
"description": "Enable issuing refresh tokens.",
|
|
36311
|
+
"type": "boolean"
|
|
36312
|
+
},
|
|
36313
|
+
"refreshTokenExpiresInSeconds": {
|
|
36314
|
+
"description": "Refresh token lifetime in seconds.",
|
|
36315
|
+
"type": "number",
|
|
36316
|
+
"minimum": 60
|
|
36317
|
+
}
|
|
36318
|
+
},
|
|
36319
|
+
"additionalProperties": false
|
|
36320
|
+
},
|
|
36321
|
+
"requireDPoP": {
|
|
36322
|
+
"description": "Require DPoP proofs for token/credential requests.",
|
|
36323
|
+
"type": "boolean"
|
|
36324
|
+
},
|
|
36325
|
+
"walletAttestationRequired": {
|
|
36326
|
+
"description": "Require wallet attestation for this authorization server.",
|
|
36327
|
+
"type": "boolean"
|
|
36328
|
+
},
|
|
36329
|
+
"walletProviderTrustLists": {
|
|
36330
|
+
"description": "Optional wallet provider trust list references for this authorization server.",
|
|
36331
|
+
"type": "array",
|
|
36332
|
+
"items": {
|
|
36333
|
+
"type": "object",
|
|
36334
|
+
"properties": {
|
|
36335
|
+
"trustListId": {
|
|
36336
|
+
"type": "string",
|
|
36337
|
+
"minLength": 1
|
|
36338
|
+
},
|
|
36339
|
+
"url": {
|
|
36340
|
+
"description": "URL of the wallet provider trust list.",
|
|
36341
|
+
"type": "string",
|
|
36342
|
+
"format": "uri"
|
|
36343
|
+
},
|
|
36344
|
+
"verifierKey": {
|
|
36345
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
36346
|
+
"type": "object",
|
|
36347
|
+
"propertyNames": {
|
|
36348
|
+
"type": "string"
|
|
36349
|
+
},
|
|
36350
|
+
"additionalProperties": {}
|
|
36351
|
+
},
|
|
36352
|
+
"verifierKeyPem": {
|
|
36353
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
36354
|
+
"type": "string",
|
|
36355
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
36356
|
+
},
|
|
36357
|
+
"verifierX509Der": {
|
|
36358
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
36359
|
+
"type": "string"
|
|
36360
|
+
}
|
|
36361
|
+
},
|
|
36362
|
+
"additionalProperties": false
|
|
36363
|
+
}
|
|
36364
|
+
},
|
|
36365
|
+
"walletAttestationStatusCheckMode": {
|
|
36366
|
+
"description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
|
|
36367
|
+
"type": "string",
|
|
36368
|
+
"enum": [
|
|
36369
|
+
"strict",
|
|
36370
|
+
"best_effort",
|
|
36371
|
+
"disabled"
|
|
36372
|
+
]
|
|
36373
|
+
},
|
|
36374
|
+
"label": {
|
|
36375
|
+
"description": "Optional display label for UI selection.",
|
|
36376
|
+
"type": "string"
|
|
36377
|
+
},
|
|
36378
|
+
"enabled": {
|
|
36379
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36380
|
+
"type": "boolean"
|
|
36381
|
+
}
|
|
36382
|
+
},
|
|
36383
|
+
"required": [
|
|
36384
|
+
"type",
|
|
36385
|
+
"id"
|
|
36386
|
+
],
|
|
36387
|
+
"additionalProperties": false
|
|
36388
|
+
}
|
|
36389
|
+
],
|
|
36390
|
+
"description": "Supported authorization server configurations."
|
|
36391
|
+
},
|
|
36392
|
+
"description": "Configured authorization server entries."
|
|
36393
|
+
},
|
|
36394
|
+
"federation": {
|
|
36395
|
+
"description": "Optional OpenID Federation settings.",
|
|
36396
|
+
"anyOf": [
|
|
36397
|
+
{
|
|
36398
|
+
"type": "object",
|
|
36399
|
+
"properties": {
|
|
36400
|
+
"role": {
|
|
36401
|
+
"description": "Federation role for this issuer.",
|
|
36402
|
+
"type": "string",
|
|
36403
|
+
"enum": [
|
|
36404
|
+
"trust_anchor",
|
|
36405
|
+
"intermediate",
|
|
36406
|
+
"leaf"
|
|
36407
|
+
]
|
|
36408
|
+
},
|
|
36409
|
+
"mode": {
|
|
36410
|
+
"description": "Federation operation mode.",
|
|
36411
|
+
"type": "string",
|
|
36412
|
+
"enum": [
|
|
36413
|
+
"federation-only",
|
|
36414
|
+
"hybrid"
|
|
36415
|
+
]
|
|
36416
|
+
},
|
|
36417
|
+
"entityId": {
|
|
36418
|
+
"description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
|
|
36419
|
+
"type": "string",
|
|
36420
|
+
"pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
|
|
36421
|
+
},
|
|
36422
|
+
"enforceSigningPolicy": {
|
|
36423
|
+
"description": "Enforce strict signing policy checks.",
|
|
36424
|
+
"type": "boolean"
|
|
36425
|
+
},
|
|
36426
|
+
"cacheTtlSeconds": {
|
|
36427
|
+
"description": "Cache time-to-live for federation metadata in seconds.",
|
|
36428
|
+
"type": "integer",
|
|
36429
|
+
"minimum": 1,
|
|
36430
|
+
"maximum": 9007199254740991
|
|
36431
|
+
},
|
|
36432
|
+
"trustAnchors": {
|
|
36433
|
+
"type": "array",
|
|
36434
|
+
"items": {
|
|
36435
|
+
"type": "object",
|
|
36436
|
+
"properties": {
|
|
36437
|
+
"entityId": {
|
|
36438
|
+
"type": "string",
|
|
36439
|
+
"minLength": 1,
|
|
36440
|
+
"description": "Federation trust anchor entity id."
|
|
36441
|
+
},
|
|
36442
|
+
"entityConfigurationUri": {
|
|
36443
|
+
"type": "string",
|
|
36444
|
+
"format": "uri",
|
|
36445
|
+
"description": "Entity configuration URI for the trust anchor."
|
|
36446
|
+
}
|
|
36447
|
+
},
|
|
36448
|
+
"required": [
|
|
36449
|
+
"entityId",
|
|
36450
|
+
"entityConfigurationUri"
|
|
36451
|
+
],
|
|
36452
|
+
"additionalProperties": false
|
|
36453
|
+
},
|
|
36454
|
+
"description": "Federation trust anchors."
|
|
36455
|
+
},
|
|
36456
|
+
"entityTypes": {
|
|
36457
|
+
"description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
|
|
36458
|
+
"minItems": 1,
|
|
36459
|
+
"type": "array",
|
|
36460
|
+
"items": {
|
|
36461
|
+
"type": "string",
|
|
36462
|
+
"enum": [
|
|
36463
|
+
"openid_credential_issuer",
|
|
36464
|
+
"openid_credential_verifier"
|
|
36465
|
+
]
|
|
36466
|
+
}
|
|
36467
|
+
},
|
|
36468
|
+
"authorityHints": {
|
|
36469
|
+
"description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
|
|
36470
|
+
"type": "array",
|
|
36471
|
+
"items": {
|
|
36472
|
+
"type": "string",
|
|
36473
|
+
"format": "uri"
|
|
36474
|
+
}
|
|
36475
|
+
},
|
|
36476
|
+
"entityKeyChainId": {
|
|
36477
|
+
"description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
|
|
36478
|
+
"type": "string",
|
|
36479
|
+
"minLength": 1
|
|
36480
|
+
},
|
|
36481
|
+
"entityConfigurationLifetimeSeconds": {
|
|
36482
|
+
"description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
|
|
36483
|
+
"type": "integer",
|
|
36484
|
+
"minimum": 60,
|
|
36485
|
+
"maximum": 31536e3
|
|
36486
|
+
},
|
|
36487
|
+
"trustMarks": {
|
|
36488
|
+
"description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
|
|
36489
|
+
"type": "array",
|
|
36490
|
+
"items": {
|
|
36491
|
+
"type": "string",
|
|
36492
|
+
"minLength": 1
|
|
36493
|
+
}
|
|
36494
|
+
},
|
|
36495
|
+
"entityMetadata": {
|
|
36496
|
+
"description": "Informational federation_entity metadata of the entity configuration.",
|
|
36497
|
+
"type": "object",
|
|
36498
|
+
"properties": {
|
|
36499
|
+
"organization_name": {
|
|
36500
|
+
"type": "string",
|
|
36501
|
+
"minLength": 1
|
|
36502
|
+
},
|
|
36503
|
+
"contacts": {
|
|
36504
|
+
"minItems": 1,
|
|
36505
|
+
"type": "array",
|
|
36506
|
+
"items": {
|
|
36507
|
+
"type": "string",
|
|
36508
|
+
"minLength": 1
|
|
36509
|
+
}
|
|
36510
|
+
},
|
|
36511
|
+
"logo_uri": {
|
|
36512
|
+
"type": "string",
|
|
36513
|
+
"format": "uri"
|
|
36514
|
+
},
|
|
36515
|
+
"policy_uri": {
|
|
36516
|
+
"type": "string",
|
|
36517
|
+
"format": "uri"
|
|
36518
|
+
},
|
|
36519
|
+
"homepage_uri": {
|
|
36520
|
+
"type": "string",
|
|
36521
|
+
"format": "uri"
|
|
36522
|
+
}
|
|
36523
|
+
},
|
|
36524
|
+
"additionalProperties": false
|
|
36525
|
+
},
|
|
36526
|
+
"includeTrustChain": {
|
|
36527
|
+
"description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
|
|
36528
|
+
"type": "boolean"
|
|
36529
|
+
}
|
|
36530
|
+
},
|
|
36531
|
+
"required": [
|
|
36532
|
+
"trustAnchors"
|
|
36533
|
+
],
|
|
36534
|
+
"additionalProperties": false
|
|
36535
|
+
},
|
|
36536
|
+
{
|
|
36537
|
+
"type": "null"
|
|
35353
36538
|
}
|
|
35354
|
-
|
|
35355
|
-
|
|
36539
|
+
]
|
|
36540
|
+
},
|
|
36541
|
+
"registrationCertificate": {
|
|
36542
|
+
"description": "Optional registration certificate settings.",
|
|
36543
|
+
"anyOf": [
|
|
36544
|
+
{
|
|
36545
|
+
"type": "object",
|
|
36546
|
+
"properties": {
|
|
36547
|
+
"enabled": {
|
|
36548
|
+
"description": "Enable issuer registration certificate support.",
|
|
36549
|
+
"type": "boolean"
|
|
36550
|
+
},
|
|
36551
|
+
"mode": {
|
|
36552
|
+
"description": "How registration certificate data is provided.",
|
|
36553
|
+
"type": "string",
|
|
36554
|
+
"enum": [
|
|
36555
|
+
"import",
|
|
36556
|
+
"generate"
|
|
36557
|
+
]
|
|
36558
|
+
},
|
|
36559
|
+
"jwt": {
|
|
36560
|
+
"description": "Optional registration certificate JWT when using import mode.",
|
|
36561
|
+
"type": "string"
|
|
36562
|
+
},
|
|
36563
|
+
"privacyPolicy": {
|
|
36564
|
+
"description": "Optional privacy policy URI.",
|
|
36565
|
+
"type": "string"
|
|
36566
|
+
},
|
|
36567
|
+
"supportUri": {
|
|
36568
|
+
"description": "Optional support URI.",
|
|
36569
|
+
"type": "string"
|
|
36570
|
+
}
|
|
36571
|
+
},
|
|
36572
|
+
"additionalProperties": false
|
|
36573
|
+
},
|
|
36574
|
+
{
|
|
36575
|
+
"type": "null"
|
|
36576
|
+
}
|
|
36577
|
+
]
|
|
36578
|
+
},
|
|
36579
|
+
"display": {
|
|
36580
|
+
"description": "Localized issuer metadata shown to wallets.",
|
|
36581
|
+
"type": "array",
|
|
36582
|
+
"items": {
|
|
36583
|
+
"type": "object",
|
|
36584
|
+
"properties": {
|
|
36585
|
+
"name": {
|
|
36586
|
+
"description": "Issuer display name.",
|
|
36587
|
+
"type": "string"
|
|
36588
|
+
},
|
|
36589
|
+
"locale": {
|
|
36590
|
+
"description": "Locale tag for this display entry.",
|
|
36591
|
+
"type": "string"
|
|
36592
|
+
},
|
|
36593
|
+
"logo": {
|
|
36594
|
+
"description": "Optional issuer logo metadata.",
|
|
36595
|
+
"type": "object",
|
|
36596
|
+
"properties": {
|
|
36597
|
+
"uri": {
|
|
36598
|
+
"type": "string",
|
|
36599
|
+
"minLength": 1,
|
|
36600
|
+
"description": "Logo URI."
|
|
36601
|
+
},
|
|
36602
|
+
"alt_text": {
|
|
36603
|
+
"description": "Optional localized alternative text.",
|
|
36604
|
+
"type": "string"
|
|
36605
|
+
}
|
|
36606
|
+
},
|
|
36607
|
+
"required": [
|
|
36608
|
+
"uri"
|
|
36609
|
+
],
|
|
36610
|
+
"additionalProperties": {}
|
|
36611
|
+
}
|
|
36612
|
+
},
|
|
36613
|
+
"additionalProperties": {}
|
|
36614
|
+
}
|
|
36615
|
+
},
|
|
36616
|
+
"notificationEndpointEnabled": {
|
|
36617
|
+
"description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
|
|
36618
|
+
"type": "boolean"
|
|
36619
|
+
},
|
|
36620
|
+
"credentialResponseEncryption": {
|
|
36621
|
+
"description": "Enable encrypted credential responses.",
|
|
36622
|
+
"type": "boolean"
|
|
36623
|
+
},
|
|
36624
|
+
"credentialRequestEncryption": {
|
|
36625
|
+
"description": "Require encrypted credential requests.",
|
|
36626
|
+
"type": "boolean"
|
|
36627
|
+
},
|
|
36628
|
+
"txCodeMaxAttempts": {
|
|
36629
|
+
"description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
|
|
36630
|
+
"anyOf": [
|
|
36631
|
+
{
|
|
36632
|
+
"type": "integer",
|
|
36633
|
+
"minimum": 1,
|
|
36634
|
+
"maximum": 9007199254740991
|
|
36635
|
+
},
|
|
36636
|
+
{
|
|
36637
|
+
"type": "null"
|
|
36638
|
+
}
|
|
36639
|
+
]
|
|
36640
|
+
},
|
|
36641
|
+
"offerLifetimeSeconds": {
|
|
36642
|
+
"description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
|
|
36643
|
+
"anyOf": [
|
|
36644
|
+
{
|
|
36645
|
+
"type": "integer",
|
|
36646
|
+
"minimum": 1,
|
|
36647
|
+
"maximum": 9007199254740991
|
|
36648
|
+
},
|
|
36649
|
+
{
|
|
36650
|
+
"type": "null"
|
|
36651
|
+
}
|
|
36652
|
+
]
|
|
35356
36653
|
}
|
|
35357
36654
|
},
|
|
35358
36655
|
"required": [
|
|
35359
|
-
"
|
|
36656
|
+
"authorizationServers"
|
|
35360
36657
|
],
|
|
35361
36658
|
"additionalProperties": false,
|
|
35362
|
-
"
|
|
36659
|
+
"title": "IssuanceConfig"
|
|
35363
36660
|
}
|
|
35364
|
-
}
|
|
35365
|
-
"required": [
|
|
35366
|
-
"$schema",
|
|
35367
|
-
"metadata",
|
|
35368
|
-
"spec"
|
|
35369
|
-
],
|
|
35370
|
-
"additionalProperties": false
|
|
36661
|
+
}
|
|
35371
36662
|
},
|
|
35372
36663
|
{
|
|
35373
36664
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35374
|
-
"$id": "https://eudiplo.dev/schemas/
|
|
36665
|
+
"$id": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json",
|
|
35375
36666
|
"title": "IssuanceConfigFile",
|
|
35376
36667
|
"type": "object",
|
|
35377
36668
|
"properties": {
|
|
35378
36669
|
"$schema": {
|
|
35379
36670
|
"type": "string",
|
|
35380
|
-
"const": "https://eudiplo.dev/schemas/
|
|
36671
|
+
"const": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json"
|
|
35381
36672
|
},
|
|
35382
36673
|
"metadata": {
|
|
35383
36674
|
"type": "object",
|
|
@@ -35477,11 +36768,6 @@ var CONFIG_SCHEMAS = [
|
|
|
35477
36768
|
}
|
|
35478
36769
|
]
|
|
35479
36770
|
},
|
|
35480
|
-
"signingKeyId": {
|
|
35481
|
-
"description": "Default signing key chain id for credential issuance.",
|
|
35482
|
-
"type": "string",
|
|
35483
|
-
"minLength": 1
|
|
35484
|
-
},
|
|
35485
36771
|
"authorizationServers": {
|
|
35486
36772
|
"minItems": 1,
|
|
35487
36773
|
"type": "array",
|
|
@@ -35574,7 +36860,7 @@ var CONFIG_SCHEMAS = [
|
|
|
35574
36860
|
"minimum": 60
|
|
35575
36861
|
},
|
|
35576
36862
|
"signingKeyId": {
|
|
35577
|
-
"description":
|
|
36863
|
+
"description": `ID of a key chain with usage type "authorizationServer" that signs the issued access tokens. Without it, the tenant's authorization server key chain signs them.`,
|
|
35578
36864
|
"type": "string",
|
|
35579
36865
|
"minLength": 1
|
|
35580
36866
|
},
|
|
@@ -35716,7 +37002,7 @@ var CONFIG_SCHEMAS = [
|
|
|
35716
37002
|
"minimum": 60
|
|
35717
37003
|
},
|
|
35718
37004
|
"signingKeyId": {
|
|
35719
|
-
"description":
|
|
37005
|
+
"description": `ID of a key chain with usage type "authorizationServer" that signs the issued access tokens. Without it, the tenant's authorization server key chain signs them.`,
|
|
35720
37006
|
"type": "string",
|
|
35721
37007
|
"minLength": 1
|
|
35722
37008
|
},
|
|
@@ -35824,7 +37110,7 @@ var CONFIG_SCHEMAS = [
|
|
|
35824
37110
|
"minimum": 60
|
|
35825
37111
|
},
|
|
35826
37112
|
"signingKeyId": {
|
|
35827
|
-
"description":
|
|
37113
|
+
"description": `ID of a key chain with usage type "authorizationServer" that signs the issued access tokens. Without it, the tenant's authorization server key chain signs them.`,
|
|
35828
37114
|
"type": "string",
|
|
35829
37115
|
"minLength": 1
|
|
35830
37116
|
},
|
|
@@ -37571,7 +38857,7 @@ async function assertTenantTargetIsEmpty(tenantPath) {
|
|
|
37571
38857
|
}
|
|
37572
38858
|
}
|
|
37573
38859
|
function validateTenantId(tenantId) {
|
|
37574
|
-
if (
|
|
38860
|
+
if (!TENANT_ID_PATTERN.test(tenantId)) {
|
|
37575
38861
|
throw new Error(
|
|
37576
38862
|
"Tenant ID must use lowercase letters, numbers, hyphens, or underscores and be at most 63 characters."
|
|
37577
38863
|
);
|
|
@@ -38957,7 +40243,7 @@ function createDeploymentCommands(context, setExitCode) {
|
|
|
38957
40243
|
// package.json
|
|
38958
40244
|
var package_default = {
|
|
38959
40245
|
name: "@eudiplo/cli",
|
|
38960
|
-
version: "9.1.0-main.
|
|
40246
|
+
version: "9.1.0-main.f567faa",
|
|
38961
40247
|
description: "Deployment-aware command line tools for EUDIPLO",
|
|
38962
40248
|
private: false,
|
|
38963
40249
|
type: "module",
|