@eudiplo/cli 9.1.0-main.f4735f2 → 9.1.0-main.f80d85e
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/config/portability/migrations.spec.js +2 -1
- package/dist/commands/config/portability/migrations.spec.js.map +1 -1
- package/dist/index.js +1378 -93
- package/package.json +1 -1
- package/templates/schemas/IssuanceConfig.schema.json +3 -8
- package/templates/schemas/IssuanceConfigFile.schema.json +814 -1
- package/templates/schemas/KeyChainConfigFile.schema.json +371 -1
- package/templates/schemas/KeyChainCreateDto.schema.json +1 -0
- package/templates/schemas/KeyChainDefaultsConfigFile.schema.json +58 -0
- package/templates/schemas/KeyChainImportDto.schema.json +1 -0
package/dist/index.js
CHANGED
|
@@ -21768,11 +21768,11 @@ var CONFIG_FORMATS = {
|
|
|
21768
21768
|
Tenant: { slug: "tenant", file: "TenantConfigFile", version: 4 },
|
|
21769
21769
|
Client: { slug: "client", file: "ClientConfigFile", version: 2 },
|
|
21770
21770
|
KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
|
|
21771
|
-
KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version:
|
|
21771
|
+
KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 4 },
|
|
21772
21772
|
KeyChainDefaults: {
|
|
21773
21773
|
slug: "key-chain-defaults",
|
|
21774
21774
|
file: "KeyChainDefaultsConfigFile",
|
|
21775
|
-
version:
|
|
21775
|
+
version: 2
|
|
21776
21776
|
},
|
|
21777
21777
|
RegistrarConfig: {
|
|
21778
21778
|
slug: "registrar-config",
|
|
@@ -21782,7 +21782,7 @@ var CONFIG_FORMATS = {
|
|
|
21782
21782
|
IssuanceConfig: {
|
|
21783
21783
|
slug: "issuance-config",
|
|
21784
21784
|
file: "IssuanceConfigFile",
|
|
21785
|
-
version:
|
|
21785
|
+
version: 6
|
|
21786
21786
|
},
|
|
21787
21787
|
CredentialConfig: {
|
|
21788
21788
|
slug: "credential-config",
|
|
@@ -21839,12 +21839,16 @@ function resourceId(input) {
|
|
|
21839
21839
|
}
|
|
21840
21840
|
function bareFileVersion(kind, spec) {
|
|
21841
21841
|
if (kind === "KeyChain") {
|
|
21842
|
+
if (spec.usageType === "accessToken")
|
|
21843
|
+
return 4;
|
|
21842
21844
|
if (spec.usageType === "federation")
|
|
21843
21845
|
return 3;
|
|
21844
21846
|
return "type" in spec ? 2 : 1;
|
|
21845
21847
|
}
|
|
21846
21848
|
if (kind === "RegistrarConfig")
|
|
21847
21849
|
return "relyingPartyContact" in spec ? 2 : 1;
|
|
21850
|
+
if (kind === "KeyChainDefaults")
|
|
21851
|
+
return "accessToken" in spec ? 2 : 1;
|
|
21848
21852
|
if (kind === "Tenant") {
|
|
21849
21853
|
if ("defaultKeyChains" in spec)
|
|
21850
21854
|
return 3;
|
|
@@ -21930,6 +21934,37 @@ var presentationConfigV1ToV2 = {
|
|
|
21930
21934
|
};
|
|
21931
21935
|
}
|
|
21932
21936
|
};
|
|
21937
|
+
var issuanceConfigV5ToV6 = {
|
|
21938
|
+
id: "issuance-config-v6-access-token-signing-key",
|
|
21939
|
+
kind: "IssuanceConfig",
|
|
21940
|
+
from: 5,
|
|
21941
|
+
to: 6,
|
|
21942
|
+
migrate(spec) {
|
|
21943
|
+
const issues = [];
|
|
21944
|
+
const { signingKeyId, ...rest } = spec;
|
|
21945
|
+
if (typeof signingKeyId === "string" && signingKeyId !== "") {
|
|
21946
|
+
issues.push({
|
|
21947
|
+
severity: "warning",
|
|
21948
|
+
code: "ISSUANCE_SIGNING_KEY_ID_REMOVED",
|
|
21949
|
+
path: "/spec/signingKeyId",
|
|
21950
|
+
message: `signingKeyId ${JSON.stringify(signingKeyId)} was removed. The built-in authorization server now signs access tokens with the tenant's access token key chain (usage type "accessToken"); to choose one, set token.signingKeyId of its entry.`
|
|
21951
|
+
});
|
|
21952
|
+
}
|
|
21953
|
+
const servers = Array.isArray(rest.authorizationServers) ? rest.authorizationServers : [];
|
|
21954
|
+
servers.forEach((server, index) => {
|
|
21955
|
+
const keyChainId = object(server) && object(server.token) ? server.token.signingKeyId : void 0;
|
|
21956
|
+
if (typeof keyChainId !== "string" || keyChainId === "")
|
|
21957
|
+
return;
|
|
21958
|
+
issues.push({
|
|
21959
|
+
severity: "warning",
|
|
21960
|
+
code: "ACCESS_TOKEN_KEY_CHAIN_REQUIRED",
|
|
21961
|
+
path: `/spec/authorizationServers/${index}/token/signingKeyId`,
|
|
21962
|
+
message: `token.signingKeyId ${JSON.stringify(keyChainId)} must name a key chain with usage type "accessToken" from now on, else the import is refused. Remove it to use the tenant's access token key chain, or point it to such a key chain.`
|
|
21963
|
+
});
|
|
21964
|
+
});
|
|
21965
|
+
return { spec: "signingKeyId" in spec ? rest : spec, issues };
|
|
21966
|
+
}
|
|
21967
|
+
};
|
|
21933
21968
|
var tenantConfigV3ToV4 = {
|
|
21934
21969
|
id: "tenant-v4-key-chain-defaults",
|
|
21935
21970
|
kind: "Tenant",
|
|
@@ -22017,6 +22052,7 @@ var CONFIG_MIGRATIONS = [
|
|
|
22017
22052
|
migrate: (spec) => ({ spec })
|
|
22018
22053
|
},
|
|
22019
22054
|
issuanceConfigV4ToV5,
|
|
22055
|
+
issuanceConfigV5ToV6,
|
|
22020
22056
|
{
|
|
22021
22057
|
id: "client-v2-read-and-status-roles",
|
|
22022
22058
|
kind: "Client",
|
|
@@ -22094,6 +22130,25 @@ var CONFIG_MIGRATIONS = [
|
|
|
22094
22130
|
// spec.
|
|
22095
22131
|
migrate: (spec) => ({ spec })
|
|
22096
22132
|
},
|
|
22133
|
+
{
|
|
22134
|
+
id: "key-chain-v4-access-token-usage",
|
|
22135
|
+
kind: "KeyChain",
|
|
22136
|
+
from: 3,
|
|
22137
|
+
to: 4,
|
|
22138
|
+
// v4 only adds the usage type `accessToken`: a v3 spec is a valid v4
|
|
22139
|
+
// spec.
|
|
22140
|
+
migrate: (spec) => ({ spec })
|
|
22141
|
+
},
|
|
22142
|
+
{
|
|
22143
|
+
id: "key-chain-defaults-v2-access-token",
|
|
22144
|
+
kind: "KeyChainDefaults",
|
|
22145
|
+
from: 1,
|
|
22146
|
+
to: 2,
|
|
22147
|
+
// v2 only adds the optional accessToken entry: a v1 spec is a valid
|
|
22148
|
+
// v2 spec, whose tenant keeps using its oldest access token key
|
|
22149
|
+
// chain.
|
|
22150
|
+
migrate: (spec) => ({ spec })
|
|
22151
|
+
},
|
|
22097
22152
|
{
|
|
22098
22153
|
id: "credential-config-v2-x509-trusted-authority",
|
|
22099
22154
|
kind: "CredentialConfig",
|
|
@@ -29343,6 +29398,59 @@ var CONFIG_SCHEMAS = [
|
|
|
29343
29398
|
],
|
|
29344
29399
|
"additionalProperties": false
|
|
29345
29400
|
},
|
|
29401
|
+
{
|
|
29402
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
29403
|
+
"$id": "https://eudiplo.dev/schemas/v2/KeyChainDefaultsConfigFile.schema.json",
|
|
29404
|
+
"title": "KeyChainDefaultsConfigFile",
|
|
29405
|
+
"type": "object",
|
|
29406
|
+
"properties": {
|
|
29407
|
+
"$schema": {
|
|
29408
|
+
"type": "string",
|
|
29409
|
+
"const": "https://eudiplo.dev/schemas/v2/KeyChainDefaultsConfigFile.schema.json"
|
|
29410
|
+
},
|
|
29411
|
+
"metadata": {
|
|
29412
|
+
"type": "object",
|
|
29413
|
+
"properties": {
|
|
29414
|
+
"generation": {
|
|
29415
|
+
"type": "integer",
|
|
29416
|
+
"minimum": 1,
|
|
29417
|
+
"maximum": 9007199254740991
|
|
29418
|
+
},
|
|
29419
|
+
"ownership": {
|
|
29420
|
+
"type": "string",
|
|
29421
|
+
"enum": [
|
|
29422
|
+
"unmanaged",
|
|
29423
|
+
"file-managed"
|
|
29424
|
+
]
|
|
29425
|
+
}
|
|
29426
|
+
},
|
|
29427
|
+
"additionalProperties": false
|
|
29428
|
+
},
|
|
29429
|
+
"spec": {
|
|
29430
|
+
"type": "object",
|
|
29431
|
+
"properties": {
|
|
29432
|
+
"access": {
|
|
29433
|
+
"description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
|
|
29434
|
+
"type": "string",
|
|
29435
|
+
"minLength": 1
|
|
29436
|
+
},
|
|
29437
|
+
"accessToken": {
|
|
29438
|
+
"description": "ID of the access token key chain (usage type accessToken) that signs the access tokens of authorization servers without token.signingKeyId and is published in their JWKS. Without it, EUDIPLO uses the tenant's oldest access token key chain and creates one with ID access-token when the tenant has none.",
|
|
29439
|
+
"type": "string",
|
|
29440
|
+
"minLength": 1
|
|
29441
|
+
}
|
|
29442
|
+
},
|
|
29443
|
+
"additionalProperties": false,
|
|
29444
|
+
"description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
|
|
29445
|
+
}
|
|
29446
|
+
},
|
|
29447
|
+
"required": [
|
|
29448
|
+
"$schema",
|
|
29449
|
+
"metadata",
|
|
29450
|
+
"spec"
|
|
29451
|
+
],
|
|
29452
|
+
"additionalProperties": false
|
|
29453
|
+
},
|
|
29346
29454
|
{
|
|
29347
29455
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
29348
29456
|
"$id": "https://eudiplo.dev/schemas/v2/KmsConfigFile.schema.json",
|
|
@@ -35245,13 +35353,13 @@ var CONFIG_SCHEMAS = [
|
|
|
35245
35353
|
},
|
|
35246
35354
|
{
|
|
35247
35355
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35248
|
-
"$id": "https://eudiplo.dev/schemas/v4/
|
|
35249
|
-
"title": "
|
|
35356
|
+
"$id": "https://eudiplo.dev/schemas/v4/KeyChainConfigFile.schema.json",
|
|
35357
|
+
"title": "KeyChainConfigFile",
|
|
35250
35358
|
"type": "object",
|
|
35251
35359
|
"properties": {
|
|
35252
35360
|
"$schema": {
|
|
35253
35361
|
"type": "string",
|
|
35254
|
-
"const": "https://eudiplo.dev/schemas/v4/
|
|
35362
|
+
"const": "https://eudiplo.dev/schemas/v4/KeyChainConfigFile.schema.json"
|
|
35255
35363
|
},
|
|
35256
35364
|
"metadata": {
|
|
35257
35365
|
"type": "object",
|
|
@@ -35274,110 +35382,1292 @@ var CONFIG_SCHEMAS = [
|
|
|
35274
35382
|
"spec": {
|
|
35275
35383
|
"type": "object",
|
|
35276
35384
|
"properties": {
|
|
35277
|
-
"
|
|
35278
|
-
"
|
|
35279
|
-
"description": "Display name of the tenant.",
|
|
35280
|
-
"type": "string",
|
|
35281
|
-
"minLength": 1
|
|
35385
|
+
"id": {
|
|
35386
|
+
"type": "string"
|
|
35282
35387
|
},
|
|
35283
35388
|
"description": {
|
|
35284
|
-
"
|
|
35389
|
+
"type": "string"
|
|
35390
|
+
},
|
|
35391
|
+
"usageType": {
|
|
35285
35392
|
"type": "string",
|
|
35286
|
-
"
|
|
35393
|
+
"enum": [
|
|
35394
|
+
"access",
|
|
35395
|
+
"accessToken",
|
|
35396
|
+
"attestation",
|
|
35397
|
+
"trustList",
|
|
35398
|
+
"statusList",
|
|
35399
|
+
"federation",
|
|
35400
|
+
"encrypt"
|
|
35401
|
+
]
|
|
35287
35402
|
},
|
|
35288
|
-
"
|
|
35289
|
-
"description": "
|
|
35290
|
-
"type": "
|
|
35291
|
-
"
|
|
35292
|
-
"
|
|
35293
|
-
|
|
35294
|
-
|
|
35295
|
-
"minimum": 60,
|
|
35296
|
-
"maximum": 9007199254740991
|
|
35297
|
-
},
|
|
35298
|
-
"cleanupMode": {
|
|
35299
|
-
"description": "Whether to fully delete or anonymize expired sessions.",
|
|
35300
|
-
"type": "string",
|
|
35301
|
-
"enum": [
|
|
35302
|
-
"full",
|
|
35303
|
-
"anonymize"
|
|
35304
|
-
]
|
|
35305
|
-
}
|
|
35306
|
-
},
|
|
35307
|
-
"additionalProperties": false
|
|
35403
|
+
"type": {
|
|
35404
|
+
"description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
|
|
35405
|
+
"type": "string",
|
|
35406
|
+
"enum": [
|
|
35407
|
+
"standalone",
|
|
35408
|
+
"internalChain"
|
|
35409
|
+
]
|
|
35308
35410
|
},
|
|
35309
|
-
"
|
|
35310
|
-
"
|
|
35311
|
-
|
|
35312
|
-
|
|
35313
|
-
|
|
35314
|
-
|
|
35315
|
-
|
|
35316
|
-
|
|
35317
|
-
"maximum": 9007199254740991
|
|
35318
|
-
},
|
|
35319
|
-
"bits": {
|
|
35320
|
-
"description": "Bits-per-status setting (1, 2, 4, or 8).",
|
|
35321
|
-
"anyOf": [
|
|
35322
|
-
{
|
|
35323
|
-
"type": "number",
|
|
35324
|
-
"const": 1
|
|
35325
|
-
},
|
|
35326
|
-
{
|
|
35327
|
-
"type": "number",
|
|
35328
|
-
"const": 2
|
|
35411
|
+
"keySource": {
|
|
35412
|
+
"oneOf": [
|
|
35413
|
+
{
|
|
35414
|
+
"type": "object",
|
|
35415
|
+
"properties": {
|
|
35416
|
+
"type": {
|
|
35417
|
+
"type": "string",
|
|
35418
|
+
"const": "private-jwk"
|
|
35329
35419
|
},
|
|
35330
|
-
{
|
|
35331
|
-
"type": "
|
|
35332
|
-
"
|
|
35420
|
+
"jwk": {
|
|
35421
|
+
"type": "object",
|
|
35422
|
+
"properties": {
|
|
35423
|
+
"kty": {
|
|
35424
|
+
"type": "string",
|
|
35425
|
+
"description": "Key type (for example EC)."
|
|
35426
|
+
},
|
|
35427
|
+
"x": {
|
|
35428
|
+
"type": "string",
|
|
35429
|
+
"description": "Elliptic curve public x coordinate."
|
|
35430
|
+
},
|
|
35431
|
+
"y": {
|
|
35432
|
+
"type": "string",
|
|
35433
|
+
"description": "Elliptic curve public y coordinate."
|
|
35434
|
+
},
|
|
35435
|
+
"crv": {
|
|
35436
|
+
"type": "string",
|
|
35437
|
+
"description": "Elliptic curve name."
|
|
35438
|
+
},
|
|
35439
|
+
"d": {
|
|
35440
|
+
"type": "string",
|
|
35441
|
+
"description": "Private key value."
|
|
35442
|
+
},
|
|
35443
|
+
"alg": {
|
|
35444
|
+
"description": "Optional algorithm hint.",
|
|
35445
|
+
"type": "string"
|
|
35446
|
+
},
|
|
35447
|
+
"kid": {
|
|
35448
|
+
"description": "Optional key identifier.",
|
|
35449
|
+
"type": "string"
|
|
35450
|
+
}
|
|
35451
|
+
},
|
|
35452
|
+
"required": [
|
|
35453
|
+
"kty",
|
|
35454
|
+
"x",
|
|
35455
|
+
"y",
|
|
35456
|
+
"crv",
|
|
35457
|
+
"d"
|
|
35458
|
+
],
|
|
35459
|
+
"additionalProperties": false
|
|
35333
35460
|
},
|
|
35334
|
-
{
|
|
35335
|
-
"type": "
|
|
35336
|
-
"
|
|
35461
|
+
"activeJwk": {
|
|
35462
|
+
"type": "object",
|
|
35463
|
+
"properties": {
|
|
35464
|
+
"kty": {
|
|
35465
|
+
"type": "string",
|
|
35466
|
+
"description": "Key type (for example EC)."
|
|
35467
|
+
},
|
|
35468
|
+
"x": {
|
|
35469
|
+
"type": "string",
|
|
35470
|
+
"description": "Elliptic curve public x coordinate."
|
|
35471
|
+
},
|
|
35472
|
+
"y": {
|
|
35473
|
+
"type": "string",
|
|
35474
|
+
"description": "Elliptic curve public y coordinate."
|
|
35475
|
+
},
|
|
35476
|
+
"crv": {
|
|
35477
|
+
"type": "string",
|
|
35478
|
+
"description": "Elliptic curve name."
|
|
35479
|
+
},
|
|
35480
|
+
"d": {
|
|
35481
|
+
"type": "string",
|
|
35482
|
+
"description": "Private key value."
|
|
35483
|
+
},
|
|
35484
|
+
"alg": {
|
|
35485
|
+
"description": "Optional algorithm hint.",
|
|
35486
|
+
"type": "string"
|
|
35487
|
+
},
|
|
35488
|
+
"kid": {
|
|
35489
|
+
"description": "Optional key identifier.",
|
|
35490
|
+
"type": "string"
|
|
35491
|
+
}
|
|
35492
|
+
},
|
|
35493
|
+
"required": [
|
|
35494
|
+
"kty",
|
|
35495
|
+
"x",
|
|
35496
|
+
"y",
|
|
35497
|
+
"crv",
|
|
35498
|
+
"d"
|
|
35499
|
+
],
|
|
35500
|
+
"additionalProperties": false
|
|
35337
35501
|
}
|
|
35338
|
-
|
|
35339
|
-
|
|
35340
|
-
|
|
35341
|
-
|
|
35342
|
-
|
|
35343
|
-
"
|
|
35344
|
-
"maximum": 9007199254740991
|
|
35502
|
+
},
|
|
35503
|
+
"required": [
|
|
35504
|
+
"type",
|
|
35505
|
+
"jwk"
|
|
35506
|
+
],
|
|
35507
|
+
"additionalProperties": false
|
|
35345
35508
|
},
|
|
35346
|
-
|
|
35347
|
-
"
|
|
35509
|
+
{
|
|
35510
|
+
"type": "object",
|
|
35511
|
+
"properties": {
|
|
35512
|
+
"type": {
|
|
35513
|
+
"type": "string",
|
|
35514
|
+
"const": "external-reference"
|
|
35515
|
+
},
|
|
35516
|
+
"provider": {
|
|
35517
|
+
"type": "string"
|
|
35518
|
+
},
|
|
35519
|
+
"externalKeyId": {
|
|
35520
|
+
"type": "string"
|
|
35521
|
+
},
|
|
35522
|
+
"publicJwk": {
|
|
35523
|
+
"type": "object",
|
|
35524
|
+
"properties": {
|
|
35525
|
+
"kty": {
|
|
35526
|
+
"type": "string"
|
|
35527
|
+
},
|
|
35528
|
+
"x": {
|
|
35529
|
+
"type": "string"
|
|
35530
|
+
},
|
|
35531
|
+
"y": {
|
|
35532
|
+
"type": "string"
|
|
35533
|
+
},
|
|
35534
|
+
"crv": {
|
|
35535
|
+
"type": "string"
|
|
35536
|
+
},
|
|
35537
|
+
"alg": {
|
|
35538
|
+
"type": "string"
|
|
35539
|
+
},
|
|
35540
|
+
"kid": {
|
|
35541
|
+
"type": "string"
|
|
35542
|
+
}
|
|
35543
|
+
},
|
|
35544
|
+
"required": [
|
|
35545
|
+
"kty",
|
|
35546
|
+
"x",
|
|
35547
|
+
"y",
|
|
35548
|
+
"crv"
|
|
35549
|
+
],
|
|
35550
|
+
"additionalProperties": false
|
|
35551
|
+
},
|
|
35552
|
+
"activeExternalKeyId": {
|
|
35553
|
+
"type": "string"
|
|
35554
|
+
},
|
|
35555
|
+
"activePublicJwk": {
|
|
35556
|
+
"type": "object",
|
|
35557
|
+
"properties": {
|
|
35558
|
+
"kty": {
|
|
35559
|
+
"type": "string"
|
|
35560
|
+
},
|
|
35561
|
+
"x": {
|
|
35562
|
+
"type": "string"
|
|
35563
|
+
},
|
|
35564
|
+
"y": {
|
|
35565
|
+
"type": "string"
|
|
35566
|
+
},
|
|
35567
|
+
"crv": {
|
|
35568
|
+
"type": "string"
|
|
35569
|
+
},
|
|
35570
|
+
"alg": {
|
|
35571
|
+
"type": "string"
|
|
35572
|
+
},
|
|
35573
|
+
"kid": {
|
|
35574
|
+
"type": "string"
|
|
35575
|
+
}
|
|
35576
|
+
},
|
|
35577
|
+
"required": [
|
|
35578
|
+
"kty",
|
|
35579
|
+
"x",
|
|
35580
|
+
"y",
|
|
35581
|
+
"crv"
|
|
35582
|
+
],
|
|
35583
|
+
"additionalProperties": false
|
|
35584
|
+
}
|
|
35585
|
+
},
|
|
35586
|
+
"required": [
|
|
35587
|
+
"type",
|
|
35588
|
+
"provider",
|
|
35589
|
+
"externalKeyId",
|
|
35590
|
+
"publicJwk"
|
|
35591
|
+
],
|
|
35592
|
+
"additionalProperties": false
|
|
35593
|
+
},
|
|
35594
|
+
{
|
|
35595
|
+
"type": "object",
|
|
35596
|
+
"properties": {
|
|
35597
|
+
"type": {
|
|
35598
|
+
"type": "string",
|
|
35599
|
+
"const": "required"
|
|
35600
|
+
},
|
|
35601
|
+
"publicJwk": {
|
|
35602
|
+
"type": "object",
|
|
35603
|
+
"properties": {
|
|
35604
|
+
"kty": {
|
|
35605
|
+
"type": "string"
|
|
35606
|
+
},
|
|
35607
|
+
"x": {
|
|
35608
|
+
"type": "string"
|
|
35609
|
+
},
|
|
35610
|
+
"y": {
|
|
35611
|
+
"type": "string"
|
|
35612
|
+
},
|
|
35613
|
+
"crv": {
|
|
35614
|
+
"type": "string"
|
|
35615
|
+
},
|
|
35616
|
+
"alg": {
|
|
35617
|
+
"type": "string"
|
|
35618
|
+
},
|
|
35619
|
+
"kid": {
|
|
35620
|
+
"type": "string"
|
|
35621
|
+
}
|
|
35622
|
+
},
|
|
35623
|
+
"required": [
|
|
35624
|
+
"kty",
|
|
35625
|
+
"x",
|
|
35626
|
+
"y",
|
|
35627
|
+
"crv"
|
|
35628
|
+
],
|
|
35629
|
+
"additionalProperties": false
|
|
35630
|
+
}
|
|
35631
|
+
},
|
|
35632
|
+
"required": [
|
|
35633
|
+
"type"
|
|
35634
|
+
],
|
|
35635
|
+
"additionalProperties": false
|
|
35636
|
+
},
|
|
35637
|
+
{
|
|
35638
|
+
"type": "object",
|
|
35639
|
+
"properties": {
|
|
35640
|
+
"type": {
|
|
35641
|
+
"type": "string",
|
|
35642
|
+
"const": "regenerate"
|
|
35643
|
+
},
|
|
35644
|
+
"keyChainType": {
|
|
35645
|
+
"type": "string",
|
|
35646
|
+
"enum": [
|
|
35647
|
+
"standalone",
|
|
35648
|
+
"internalChain"
|
|
35649
|
+
]
|
|
35650
|
+
}
|
|
35651
|
+
},
|
|
35652
|
+
"required": [
|
|
35653
|
+
"type"
|
|
35654
|
+
],
|
|
35655
|
+
"additionalProperties": false
|
|
35656
|
+
}
|
|
35657
|
+
]
|
|
35658
|
+
},
|
|
35659
|
+
"crt": {
|
|
35660
|
+
"type": "array",
|
|
35661
|
+
"items": {
|
|
35662
|
+
"type": "string"
|
|
35663
|
+
}
|
|
35664
|
+
},
|
|
35665
|
+
"activeCertificate": {
|
|
35666
|
+
"description": "Active certificate for an internal key chain.",
|
|
35667
|
+
"type": "string"
|
|
35668
|
+
},
|
|
35669
|
+
"kmsProvider": {
|
|
35670
|
+
"type": "string"
|
|
35671
|
+
},
|
|
35672
|
+
"rotationPolicy": {
|
|
35673
|
+
"type": "object",
|
|
35674
|
+
"properties": {
|
|
35675
|
+
"enabled": {
|
|
35348
35676
|
"type": "boolean"
|
|
35349
35677
|
},
|
|
35350
|
-
"
|
|
35351
|
-
"
|
|
35352
|
-
|
|
35678
|
+
"intervalDays": {
|
|
35679
|
+
"anyOf": [
|
|
35680
|
+
{
|
|
35681
|
+
"type": "number",
|
|
35682
|
+
"minimum": 1,
|
|
35683
|
+
"maximum": 3650
|
|
35684
|
+
},
|
|
35685
|
+
{
|
|
35686
|
+
"type": "null"
|
|
35687
|
+
}
|
|
35688
|
+
]
|
|
35689
|
+
},
|
|
35690
|
+
"certValidityDays": {
|
|
35691
|
+
"anyOf": [
|
|
35692
|
+
{
|
|
35693
|
+
"type": "number",
|
|
35694
|
+
"minimum": 1,
|
|
35695
|
+
"maximum": 3650
|
|
35696
|
+
},
|
|
35697
|
+
{
|
|
35698
|
+
"type": "null"
|
|
35699
|
+
}
|
|
35700
|
+
]
|
|
35701
|
+
}
|
|
35702
|
+
},
|
|
35703
|
+
"required": [
|
|
35704
|
+
"enabled"
|
|
35705
|
+
],
|
|
35706
|
+
"additionalProperties": false
|
|
35707
|
+
}
|
|
35708
|
+
},
|
|
35709
|
+
"required": [
|
|
35710
|
+
"usageType",
|
|
35711
|
+
"keySource"
|
|
35712
|
+
],
|
|
35713
|
+
"additionalProperties": false
|
|
35714
|
+
}
|
|
35715
|
+
},
|
|
35716
|
+
"required": [
|
|
35717
|
+
"$schema",
|
|
35718
|
+
"metadata",
|
|
35719
|
+
"spec"
|
|
35720
|
+
],
|
|
35721
|
+
"additionalProperties": false
|
|
35722
|
+
},
|
|
35723
|
+
{
|
|
35724
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35725
|
+
"$id": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json",
|
|
35726
|
+
"title": "TenantConfigFile",
|
|
35727
|
+
"type": "object",
|
|
35728
|
+
"properties": {
|
|
35729
|
+
"$schema": {
|
|
35730
|
+
"type": "string",
|
|
35731
|
+
"const": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json"
|
|
35732
|
+
},
|
|
35733
|
+
"metadata": {
|
|
35734
|
+
"type": "object",
|
|
35735
|
+
"properties": {
|
|
35736
|
+
"generation": {
|
|
35737
|
+
"type": "integer",
|
|
35738
|
+
"minimum": 1,
|
|
35739
|
+
"maximum": 9007199254740991
|
|
35740
|
+
},
|
|
35741
|
+
"ownership": {
|
|
35742
|
+
"type": "string",
|
|
35743
|
+
"enum": [
|
|
35744
|
+
"unmanaged",
|
|
35745
|
+
"file-managed"
|
|
35746
|
+
]
|
|
35747
|
+
}
|
|
35748
|
+
},
|
|
35749
|
+
"additionalProperties": false
|
|
35750
|
+
},
|
|
35751
|
+
"spec": {
|
|
35752
|
+
"type": "object",
|
|
35753
|
+
"properties": {
|
|
35754
|
+
"name": {
|
|
35755
|
+
"default": "EUDIPLO",
|
|
35756
|
+
"description": "Display name of the tenant.",
|
|
35757
|
+
"type": "string",
|
|
35758
|
+
"minLength": 1
|
|
35759
|
+
},
|
|
35760
|
+
"description": {
|
|
35761
|
+
"description": "Optional tenant description.",
|
|
35762
|
+
"type": "string",
|
|
35763
|
+
"minLength": 1
|
|
35764
|
+
},
|
|
35765
|
+
"sessionConfig": {
|
|
35766
|
+
"description": "Optional tenant-specific session storage configuration.",
|
|
35767
|
+
"type": "object",
|
|
35768
|
+
"properties": {
|
|
35769
|
+
"ttlSeconds": {
|
|
35770
|
+
"description": "Session time-to-live in seconds.",
|
|
35771
|
+
"type": "integer",
|
|
35772
|
+
"minimum": 60,
|
|
35773
|
+
"maximum": 9007199254740991
|
|
35774
|
+
},
|
|
35775
|
+
"cleanupMode": {
|
|
35776
|
+
"description": "Whether to fully delete or anonymize expired sessions.",
|
|
35777
|
+
"type": "string",
|
|
35778
|
+
"enum": [
|
|
35779
|
+
"full",
|
|
35780
|
+
"anonymize"
|
|
35781
|
+
]
|
|
35782
|
+
}
|
|
35783
|
+
},
|
|
35784
|
+
"additionalProperties": false
|
|
35785
|
+
},
|
|
35786
|
+
"statusListConfig": {
|
|
35787
|
+
"description": "Optional tenant-specific status list defaults.",
|
|
35788
|
+
"type": "object",
|
|
35789
|
+
"properties": {
|
|
35790
|
+
"capacity": {
|
|
35791
|
+
"description": "Default status list capacity.",
|
|
35792
|
+
"type": "integer",
|
|
35793
|
+
"minimum": 100,
|
|
35794
|
+
"maximum": 9007199254740991
|
|
35795
|
+
},
|
|
35796
|
+
"bits": {
|
|
35797
|
+
"description": "Bits-per-status setting (1, 2, 4, or 8).",
|
|
35798
|
+
"anyOf": [
|
|
35799
|
+
{
|
|
35800
|
+
"type": "number",
|
|
35801
|
+
"const": 1
|
|
35802
|
+
},
|
|
35803
|
+
{
|
|
35804
|
+
"type": "number",
|
|
35805
|
+
"const": 2
|
|
35806
|
+
},
|
|
35807
|
+
{
|
|
35808
|
+
"type": "number",
|
|
35809
|
+
"const": 4
|
|
35810
|
+
},
|
|
35811
|
+
{
|
|
35812
|
+
"type": "number",
|
|
35813
|
+
"const": 8
|
|
35814
|
+
}
|
|
35815
|
+
]
|
|
35816
|
+
},
|
|
35817
|
+
"ttl": {
|
|
35818
|
+
"description": "JWT TTL for status list tokens in seconds.",
|
|
35819
|
+
"type": "integer",
|
|
35820
|
+
"minimum": 60,
|
|
35821
|
+
"maximum": 9007199254740991
|
|
35822
|
+
},
|
|
35823
|
+
"immediateUpdate": {
|
|
35824
|
+
"description": "Regenerate status list JWTs immediately after status updates.",
|
|
35825
|
+
"type": "boolean"
|
|
35826
|
+
},
|
|
35827
|
+
"enableAggregation": {
|
|
35828
|
+
"description": "Include aggregation_uri in generated status list JWTs.",
|
|
35829
|
+
"type": "boolean"
|
|
35830
|
+
}
|
|
35831
|
+
},
|
|
35832
|
+
"additionalProperties": false
|
|
35833
|
+
}
|
|
35834
|
+
},
|
|
35835
|
+
"required": [
|
|
35836
|
+
"name"
|
|
35837
|
+
],
|
|
35838
|
+
"additionalProperties": false,
|
|
35839
|
+
"description": "Payload used when importing tenant metadata from config files."
|
|
35840
|
+
}
|
|
35841
|
+
},
|
|
35842
|
+
"required": [
|
|
35843
|
+
"$schema",
|
|
35844
|
+
"metadata",
|
|
35845
|
+
"spec"
|
|
35846
|
+
],
|
|
35847
|
+
"additionalProperties": false
|
|
35848
|
+
},
|
|
35849
|
+
{
|
|
35850
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35851
|
+
"$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
|
|
35852
|
+
"title": "IssuanceConfigFile",
|
|
35853
|
+
"type": "object",
|
|
35854
|
+
"properties": {
|
|
35855
|
+
"$schema": {
|
|
35856
|
+
"type": "string",
|
|
35857
|
+
"const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
|
|
35858
|
+
},
|
|
35859
|
+
"metadata": {
|
|
35860
|
+
"type": "object",
|
|
35861
|
+
"properties": {
|
|
35862
|
+
"generation": {
|
|
35863
|
+
"type": "integer",
|
|
35864
|
+
"minimum": 1,
|
|
35865
|
+
"description": "Monotonically increasing configuration generation."
|
|
35866
|
+
},
|
|
35867
|
+
"ownership": {
|
|
35868
|
+
"type": "string",
|
|
35869
|
+
"enum": [
|
|
35870
|
+
"unmanaged",
|
|
35871
|
+
"file-managed"
|
|
35872
|
+
],
|
|
35873
|
+
"description": "Requested ownership recorded when the document is applied."
|
|
35874
|
+
}
|
|
35875
|
+
},
|
|
35876
|
+
"additionalProperties": false
|
|
35877
|
+
},
|
|
35878
|
+
"spec": {
|
|
35879
|
+
"$ref": "#/$defs/IssuanceConfig"
|
|
35880
|
+
}
|
|
35881
|
+
},
|
|
35882
|
+
"required": [
|
|
35883
|
+
"$schema",
|
|
35884
|
+
"spec"
|
|
35885
|
+
],
|
|
35886
|
+
"additionalProperties": false,
|
|
35887
|
+
"$defs": {
|
|
35888
|
+
"IssuanceConfig": {
|
|
35889
|
+
"type": "object",
|
|
35890
|
+
"properties": {
|
|
35891
|
+
"batchSize": {
|
|
35892
|
+
"description": "Optional issuance batch size.",
|
|
35893
|
+
"type": "integer",
|
|
35894
|
+
"minimum": 1,
|
|
35895
|
+
"maximum": 9007199254740991
|
|
35896
|
+
},
|
|
35897
|
+
"dPopRequired": {
|
|
35898
|
+
"description": "Require DPoP proofs for issuance endpoints.",
|
|
35899
|
+
"type": "boolean"
|
|
35900
|
+
},
|
|
35901
|
+
"walletAttestationRequired": {
|
|
35902
|
+
"description": "Default wallet attestation requirement for managed authorization servers.",
|
|
35903
|
+
"type": "boolean"
|
|
35904
|
+
},
|
|
35905
|
+
"walletProviderTrustLists": {
|
|
35906
|
+
"description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
|
|
35907
|
+
"type": "array",
|
|
35908
|
+
"items": {
|
|
35909
|
+
"type": "object",
|
|
35910
|
+
"properties": {
|
|
35911
|
+
"trustListId": {
|
|
35912
|
+
"type": "string",
|
|
35913
|
+
"minLength": 1
|
|
35914
|
+
},
|
|
35915
|
+
"url": {
|
|
35916
|
+
"description": "URL of the wallet provider trust list.",
|
|
35917
|
+
"type": "string",
|
|
35918
|
+
"format": "uri"
|
|
35919
|
+
},
|
|
35920
|
+
"verifierKey": {
|
|
35921
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
35922
|
+
"type": "object",
|
|
35923
|
+
"propertyNames": {
|
|
35924
|
+
"type": "string"
|
|
35925
|
+
},
|
|
35926
|
+
"additionalProperties": {}
|
|
35927
|
+
},
|
|
35928
|
+
"verifierKeyPem": {
|
|
35929
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
35930
|
+
"type": "string",
|
|
35931
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
35932
|
+
},
|
|
35933
|
+
"verifierX509Der": {
|
|
35934
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
35935
|
+
"type": "string"
|
|
35936
|
+
}
|
|
35937
|
+
},
|
|
35938
|
+
"additionalProperties": false
|
|
35939
|
+
}
|
|
35940
|
+
},
|
|
35941
|
+
"walletAttestationStatusCheckMode": {
|
|
35942
|
+
"description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
|
|
35943
|
+
"anyOf": [
|
|
35944
|
+
{
|
|
35945
|
+
"type": "string",
|
|
35946
|
+
"enum": [
|
|
35947
|
+
"strict",
|
|
35948
|
+
"best_effort",
|
|
35949
|
+
"disabled"
|
|
35950
|
+
]
|
|
35951
|
+
},
|
|
35952
|
+
{
|
|
35953
|
+
"type": "null"
|
|
35954
|
+
}
|
|
35955
|
+
]
|
|
35956
|
+
},
|
|
35957
|
+
"signingKeyId": {
|
|
35958
|
+
"description": "Default signing key chain id for credential issuance.",
|
|
35959
|
+
"type": "string",
|
|
35960
|
+
"minLength": 1
|
|
35961
|
+
},
|
|
35962
|
+
"authorizationServers": {
|
|
35963
|
+
"minItems": 1,
|
|
35964
|
+
"type": "array",
|
|
35965
|
+
"items": {
|
|
35966
|
+
"oneOf": [
|
|
35967
|
+
{
|
|
35968
|
+
"type": "object",
|
|
35969
|
+
"properties": {
|
|
35970
|
+
"type": {
|
|
35971
|
+
"type": "string",
|
|
35972
|
+
"const": "external",
|
|
35973
|
+
"description": "Use an externally managed authorization server."
|
|
35974
|
+
},
|
|
35975
|
+
"id": {
|
|
35976
|
+
"type": "string",
|
|
35977
|
+
"minLength": 1,
|
|
35978
|
+
"description": "Authorization server identifier."
|
|
35979
|
+
},
|
|
35980
|
+
"issuer": {
|
|
35981
|
+
"type": "string",
|
|
35982
|
+
"format": "uri",
|
|
35983
|
+
"description": "Issuer URL for the external authorization server."
|
|
35984
|
+
},
|
|
35985
|
+
"sessionBinding": {
|
|
35986
|
+
"description": "Explicit mapping from an external access-token claim to an existing issuance session.",
|
|
35987
|
+
"type": "object",
|
|
35988
|
+
"properties": {
|
|
35989
|
+
"method": {
|
|
35990
|
+
"type": "string",
|
|
35991
|
+
"const": "access_token_claim",
|
|
35992
|
+
"description": "Read the correlation value from a configured access-token claim."
|
|
35993
|
+
},
|
|
35994
|
+
"claim": {
|
|
35995
|
+
"type": "string",
|
|
35996
|
+
"minLength": 1,
|
|
35997
|
+
"description": "Claim name that contains the issuance-session correlation value."
|
|
35998
|
+
}
|
|
35999
|
+
},
|
|
36000
|
+
"required": [
|
|
36001
|
+
"method",
|
|
36002
|
+
"claim"
|
|
36003
|
+
],
|
|
36004
|
+
"additionalProperties": false
|
|
36005
|
+
},
|
|
36006
|
+
"label": {
|
|
36007
|
+
"description": "Optional display label for UI selection.",
|
|
36008
|
+
"type": "string"
|
|
36009
|
+
},
|
|
36010
|
+
"enabled": {
|
|
36011
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36012
|
+
"type": "boolean"
|
|
36013
|
+
}
|
|
36014
|
+
},
|
|
36015
|
+
"required": [
|
|
36016
|
+
"type",
|
|
36017
|
+
"id",
|
|
36018
|
+
"issuer"
|
|
36019
|
+
],
|
|
36020
|
+
"additionalProperties": false
|
|
36021
|
+
},
|
|
36022
|
+
{
|
|
36023
|
+
"type": "object",
|
|
36024
|
+
"properties": {
|
|
36025
|
+
"type": {
|
|
36026
|
+
"type": "string",
|
|
36027
|
+
"const": "oid4vp",
|
|
36028
|
+
"description": "Use OID4VP-based authorization server chaining."
|
|
36029
|
+
},
|
|
36030
|
+
"id": {
|
|
36031
|
+
"type": "string",
|
|
36032
|
+
"minLength": 1,
|
|
36033
|
+
"description": "Authorization server identifier."
|
|
36034
|
+
},
|
|
36035
|
+
"presentationConfigId": {
|
|
36036
|
+
"type": "string",
|
|
36037
|
+
"minLength": 1,
|
|
36038
|
+
"description": "Presentation configuration id used during authorization."
|
|
36039
|
+
},
|
|
36040
|
+
"immediateWalletRedirect": {
|
|
36041
|
+
"description": "Redirect wallets immediately after authorization response creation.",
|
|
36042
|
+
"type": "boolean"
|
|
36043
|
+
},
|
|
36044
|
+
"token": {
|
|
36045
|
+
"description": "Optional token issuance settings.",
|
|
36046
|
+
"type": "object",
|
|
36047
|
+
"properties": {
|
|
36048
|
+
"lifetimeSeconds": {
|
|
36049
|
+
"description": "Access token lifetime in seconds.",
|
|
36050
|
+
"type": "number",
|
|
36051
|
+
"minimum": 60
|
|
36052
|
+
},
|
|
36053
|
+
"signingKeyId": {
|
|
36054
|
+
"description": "Optional key chain id used to sign issued tokens.",
|
|
36055
|
+
"type": "string",
|
|
36056
|
+
"minLength": 1
|
|
36057
|
+
},
|
|
36058
|
+
"refreshTokenEnabled": {
|
|
36059
|
+
"description": "Enable issuing refresh tokens.",
|
|
36060
|
+
"type": "boolean"
|
|
36061
|
+
},
|
|
36062
|
+
"refreshTokenExpiresInSeconds": {
|
|
36063
|
+
"description": "Refresh token lifetime in seconds.",
|
|
36064
|
+
"type": "number",
|
|
36065
|
+
"minimum": 60
|
|
36066
|
+
}
|
|
36067
|
+
},
|
|
36068
|
+
"additionalProperties": false
|
|
36069
|
+
},
|
|
36070
|
+
"requireDPoP": {
|
|
36071
|
+
"description": "Require DPoP proofs for token/credential requests.",
|
|
36072
|
+
"type": "boolean"
|
|
36073
|
+
},
|
|
36074
|
+
"walletAttestationRequired": {
|
|
36075
|
+
"description": "Require wallet attestation for this authorization server.",
|
|
36076
|
+
"type": "boolean"
|
|
36077
|
+
},
|
|
36078
|
+
"walletProviderTrustLists": {
|
|
36079
|
+
"description": "Optional wallet provider trust list references for this authorization server.",
|
|
36080
|
+
"type": "array",
|
|
36081
|
+
"items": {
|
|
36082
|
+
"type": "object",
|
|
36083
|
+
"properties": {
|
|
36084
|
+
"trustListId": {
|
|
36085
|
+
"type": "string",
|
|
36086
|
+
"minLength": 1
|
|
36087
|
+
},
|
|
36088
|
+
"url": {
|
|
36089
|
+
"description": "URL of the wallet provider trust list.",
|
|
36090
|
+
"type": "string",
|
|
36091
|
+
"format": "uri"
|
|
36092
|
+
},
|
|
36093
|
+
"verifierKey": {
|
|
36094
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
36095
|
+
"type": "object",
|
|
36096
|
+
"propertyNames": {
|
|
36097
|
+
"type": "string"
|
|
36098
|
+
},
|
|
36099
|
+
"additionalProperties": {}
|
|
36100
|
+
},
|
|
36101
|
+
"verifierKeyPem": {
|
|
36102
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
36103
|
+
"type": "string",
|
|
36104
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
36105
|
+
},
|
|
36106
|
+
"verifierX509Der": {
|
|
36107
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
36108
|
+
"type": "string"
|
|
36109
|
+
}
|
|
36110
|
+
},
|
|
36111
|
+
"additionalProperties": false
|
|
36112
|
+
}
|
|
36113
|
+
},
|
|
36114
|
+
"walletAttestationStatusCheckMode": {
|
|
36115
|
+
"description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
|
|
36116
|
+
"type": "string",
|
|
36117
|
+
"enum": [
|
|
36118
|
+
"strict",
|
|
36119
|
+
"best_effort",
|
|
36120
|
+
"disabled"
|
|
36121
|
+
]
|
|
36122
|
+
},
|
|
36123
|
+
"label": {
|
|
36124
|
+
"description": "Optional display label for UI selection.",
|
|
36125
|
+
"type": "string"
|
|
36126
|
+
},
|
|
36127
|
+
"enabled": {
|
|
36128
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36129
|
+
"type": "boolean"
|
|
36130
|
+
}
|
|
36131
|
+
},
|
|
36132
|
+
"required": [
|
|
36133
|
+
"type",
|
|
36134
|
+
"id",
|
|
36135
|
+
"presentationConfigId"
|
|
36136
|
+
],
|
|
36137
|
+
"additionalProperties": false
|
|
36138
|
+
},
|
|
36139
|
+
{
|
|
36140
|
+
"type": "object",
|
|
36141
|
+
"properties": {
|
|
36142
|
+
"type": {
|
|
36143
|
+
"type": "string",
|
|
36144
|
+
"const": "chained",
|
|
36145
|
+
"description": "Use upstream OIDC as authorization source."
|
|
36146
|
+
},
|
|
36147
|
+
"id": {
|
|
36148
|
+
"type": "string",
|
|
36149
|
+
"minLength": 1,
|
|
36150
|
+
"description": "Authorization server identifier."
|
|
36151
|
+
},
|
|
36152
|
+
"upstream": {
|
|
36153
|
+
"type": "object",
|
|
36154
|
+
"properties": {
|
|
36155
|
+
"issuer": {
|
|
36156
|
+
"type": "string",
|
|
36157
|
+
"format": "uri",
|
|
36158
|
+
"description": "Upstream OIDC issuer URL."
|
|
36159
|
+
},
|
|
36160
|
+
"clientId": {
|
|
36161
|
+
"type": "string",
|
|
36162
|
+
"minLength": 1,
|
|
36163
|
+
"description": "Client id for upstream OIDC authentication."
|
|
36164
|
+
},
|
|
36165
|
+
"clientSecret": {
|
|
36166
|
+
"description": "Optional client secret for upstream OIDC authentication.",
|
|
36167
|
+
"type": "string",
|
|
36168
|
+
"minLength": 1
|
|
36169
|
+
},
|
|
36170
|
+
"scopes": {
|
|
36171
|
+
"description": "Optional scopes requested from the upstream issuer.",
|
|
36172
|
+
"type": "array",
|
|
36173
|
+
"items": {
|
|
36174
|
+
"type": "string",
|
|
36175
|
+
"minLength": 1
|
|
36176
|
+
}
|
|
36177
|
+
}
|
|
36178
|
+
},
|
|
36179
|
+
"required": [
|
|
36180
|
+
"issuer",
|
|
36181
|
+
"clientId"
|
|
36182
|
+
],
|
|
36183
|
+
"additionalProperties": false,
|
|
36184
|
+
"description": "Upstream OIDC connection settings."
|
|
36185
|
+
},
|
|
36186
|
+
"token": {
|
|
36187
|
+
"description": "Optional token issuance settings.",
|
|
36188
|
+
"type": "object",
|
|
36189
|
+
"properties": {
|
|
36190
|
+
"lifetimeSeconds": {
|
|
36191
|
+
"description": "Access token lifetime in seconds.",
|
|
36192
|
+
"type": "number",
|
|
36193
|
+
"minimum": 60
|
|
36194
|
+
},
|
|
36195
|
+
"signingKeyId": {
|
|
36196
|
+
"description": "Optional key chain id used to sign issued tokens.",
|
|
36197
|
+
"type": "string",
|
|
36198
|
+
"minLength": 1
|
|
36199
|
+
},
|
|
36200
|
+
"refreshTokenEnabled": {
|
|
36201
|
+
"description": "Enable issuing refresh tokens.",
|
|
36202
|
+
"type": "boolean"
|
|
36203
|
+
},
|
|
36204
|
+
"refreshTokenExpiresInSeconds": {
|
|
36205
|
+
"description": "Refresh token lifetime in seconds.",
|
|
36206
|
+
"type": "number",
|
|
36207
|
+
"minimum": 60
|
|
36208
|
+
}
|
|
36209
|
+
},
|
|
36210
|
+
"additionalProperties": false
|
|
36211
|
+
},
|
|
36212
|
+
"requireDPoP": {
|
|
36213
|
+
"description": "Require DPoP proofs for token/credential requests.",
|
|
36214
|
+
"type": "boolean"
|
|
36215
|
+
},
|
|
36216
|
+
"walletAttestationRequired": {
|
|
36217
|
+
"description": "Require wallet attestation for this authorization server.",
|
|
36218
|
+
"type": "boolean"
|
|
36219
|
+
},
|
|
36220
|
+
"walletProviderTrustLists": {
|
|
36221
|
+
"description": "Optional wallet provider trust list references for this authorization server.",
|
|
36222
|
+
"type": "array",
|
|
36223
|
+
"items": {
|
|
36224
|
+
"type": "object",
|
|
36225
|
+
"properties": {
|
|
36226
|
+
"trustListId": {
|
|
36227
|
+
"type": "string",
|
|
36228
|
+
"minLength": 1
|
|
36229
|
+
},
|
|
36230
|
+
"url": {
|
|
36231
|
+
"description": "URL of the wallet provider trust list.",
|
|
36232
|
+
"type": "string",
|
|
36233
|
+
"format": "uri"
|
|
36234
|
+
},
|
|
36235
|
+
"verifierKey": {
|
|
36236
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
36237
|
+
"type": "object",
|
|
36238
|
+
"propertyNames": {
|
|
36239
|
+
"type": "string"
|
|
36240
|
+
},
|
|
36241
|
+
"additionalProperties": {}
|
|
36242
|
+
},
|
|
36243
|
+
"verifierKeyPem": {
|
|
36244
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
36245
|
+
"type": "string",
|
|
36246
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
36247
|
+
},
|
|
36248
|
+
"verifierX509Der": {
|
|
36249
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
36250
|
+
"type": "string"
|
|
36251
|
+
}
|
|
36252
|
+
},
|
|
36253
|
+
"additionalProperties": false
|
|
36254
|
+
}
|
|
36255
|
+
},
|
|
36256
|
+
"walletAttestationStatusCheckMode": {
|
|
36257
|
+
"description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
|
|
36258
|
+
"type": "string",
|
|
36259
|
+
"enum": [
|
|
36260
|
+
"strict",
|
|
36261
|
+
"best_effort",
|
|
36262
|
+
"disabled"
|
|
36263
|
+
]
|
|
36264
|
+
},
|
|
36265
|
+
"label": {
|
|
36266
|
+
"description": "Optional display label for UI selection.",
|
|
36267
|
+
"type": "string"
|
|
36268
|
+
},
|
|
36269
|
+
"enabled": {
|
|
36270
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36271
|
+
"type": "boolean"
|
|
36272
|
+
}
|
|
36273
|
+
},
|
|
36274
|
+
"required": [
|
|
36275
|
+
"type",
|
|
36276
|
+
"id",
|
|
36277
|
+
"upstream"
|
|
36278
|
+
],
|
|
36279
|
+
"additionalProperties": false
|
|
36280
|
+
},
|
|
36281
|
+
{
|
|
36282
|
+
"type": "object",
|
|
36283
|
+
"properties": {
|
|
36284
|
+
"type": {
|
|
36285
|
+
"type": "string",
|
|
36286
|
+
"const": "built-in",
|
|
36287
|
+
"description": "Use EUDIPLO built-in authorization server."
|
|
36288
|
+
},
|
|
36289
|
+
"id": {
|
|
36290
|
+
"type": "string",
|
|
36291
|
+
"minLength": 1,
|
|
36292
|
+
"description": "Authorization server identifier."
|
|
36293
|
+
},
|
|
36294
|
+
"token": {
|
|
36295
|
+
"description": "Optional token issuance settings.",
|
|
36296
|
+
"type": "object",
|
|
36297
|
+
"properties": {
|
|
36298
|
+
"lifetimeSeconds": {
|
|
36299
|
+
"description": "Access token lifetime in seconds.",
|
|
36300
|
+
"type": "number",
|
|
36301
|
+
"minimum": 60
|
|
36302
|
+
},
|
|
36303
|
+
"signingKeyId": {
|
|
36304
|
+
"description": "Optional key chain id used to sign issued tokens.",
|
|
36305
|
+
"type": "string",
|
|
36306
|
+
"minLength": 1
|
|
36307
|
+
},
|
|
36308
|
+
"refreshTokenEnabled": {
|
|
36309
|
+
"description": "Enable issuing refresh tokens.",
|
|
36310
|
+
"type": "boolean"
|
|
36311
|
+
},
|
|
36312
|
+
"refreshTokenExpiresInSeconds": {
|
|
36313
|
+
"description": "Refresh token lifetime in seconds.",
|
|
36314
|
+
"type": "number",
|
|
36315
|
+
"minimum": 60
|
|
36316
|
+
}
|
|
36317
|
+
},
|
|
36318
|
+
"additionalProperties": false
|
|
36319
|
+
},
|
|
36320
|
+
"requireDPoP": {
|
|
36321
|
+
"description": "Require DPoP proofs for token/credential requests.",
|
|
36322
|
+
"type": "boolean"
|
|
36323
|
+
},
|
|
36324
|
+
"walletAttestationRequired": {
|
|
36325
|
+
"description": "Require wallet attestation for this authorization server.",
|
|
36326
|
+
"type": "boolean"
|
|
36327
|
+
},
|
|
36328
|
+
"walletProviderTrustLists": {
|
|
36329
|
+
"description": "Optional wallet provider trust list references for this authorization server.",
|
|
36330
|
+
"type": "array",
|
|
36331
|
+
"items": {
|
|
36332
|
+
"type": "object",
|
|
36333
|
+
"properties": {
|
|
36334
|
+
"trustListId": {
|
|
36335
|
+
"type": "string",
|
|
36336
|
+
"minLength": 1
|
|
36337
|
+
},
|
|
36338
|
+
"url": {
|
|
36339
|
+
"description": "URL of the wallet provider trust list.",
|
|
36340
|
+
"type": "string",
|
|
36341
|
+
"format": "uri"
|
|
36342
|
+
},
|
|
36343
|
+
"verifierKey": {
|
|
36344
|
+
"description": "Optional verifier key material used for trust list verification.",
|
|
36345
|
+
"type": "object",
|
|
36346
|
+
"propertyNames": {
|
|
36347
|
+
"type": "string"
|
|
36348
|
+
},
|
|
36349
|
+
"additionalProperties": {}
|
|
36350
|
+
},
|
|
36351
|
+
"verifierKeyPem": {
|
|
36352
|
+
"description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
|
|
36353
|
+
"type": "string",
|
|
36354
|
+
"pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
|
|
36355
|
+
},
|
|
36356
|
+
"verifierX509Der": {
|
|
36357
|
+
"description": "Optional verifier certificate in DER/base64 form.",
|
|
36358
|
+
"type": "string"
|
|
36359
|
+
}
|
|
36360
|
+
},
|
|
36361
|
+
"additionalProperties": false
|
|
36362
|
+
}
|
|
36363
|
+
},
|
|
36364
|
+
"walletAttestationStatusCheckMode": {
|
|
36365
|
+
"description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
|
|
36366
|
+
"type": "string",
|
|
36367
|
+
"enum": [
|
|
36368
|
+
"strict",
|
|
36369
|
+
"best_effort",
|
|
36370
|
+
"disabled"
|
|
36371
|
+
]
|
|
36372
|
+
},
|
|
36373
|
+
"label": {
|
|
36374
|
+
"description": "Optional display label for UI selection.",
|
|
36375
|
+
"type": "string"
|
|
36376
|
+
},
|
|
36377
|
+
"enabled": {
|
|
36378
|
+
"description": "Whether this authorization server entry is enabled.",
|
|
36379
|
+
"type": "boolean"
|
|
36380
|
+
}
|
|
36381
|
+
},
|
|
36382
|
+
"required": [
|
|
36383
|
+
"type",
|
|
36384
|
+
"id"
|
|
36385
|
+
],
|
|
36386
|
+
"additionalProperties": false
|
|
36387
|
+
}
|
|
36388
|
+
],
|
|
36389
|
+
"description": "Supported authorization server configurations."
|
|
36390
|
+
},
|
|
36391
|
+
"description": "Configured authorization server entries."
|
|
36392
|
+
},
|
|
36393
|
+
"federation": {
|
|
36394
|
+
"description": "Optional OpenID Federation settings.",
|
|
36395
|
+
"anyOf": [
|
|
36396
|
+
{
|
|
36397
|
+
"type": "object",
|
|
36398
|
+
"properties": {
|
|
36399
|
+
"role": {
|
|
36400
|
+
"description": "Federation role for this issuer.",
|
|
36401
|
+
"type": "string",
|
|
36402
|
+
"enum": [
|
|
36403
|
+
"trust_anchor",
|
|
36404
|
+
"intermediate",
|
|
36405
|
+
"leaf"
|
|
36406
|
+
]
|
|
36407
|
+
},
|
|
36408
|
+
"mode": {
|
|
36409
|
+
"description": "Federation operation mode.",
|
|
36410
|
+
"type": "string",
|
|
36411
|
+
"enum": [
|
|
36412
|
+
"federation-only",
|
|
36413
|
+
"hybrid"
|
|
36414
|
+
]
|
|
36415
|
+
},
|
|
36416
|
+
"entityId": {
|
|
36417
|
+
"description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
|
|
36418
|
+
"type": "string",
|
|
36419
|
+
"pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
|
|
36420
|
+
},
|
|
36421
|
+
"enforceSigningPolicy": {
|
|
36422
|
+
"description": "Enforce strict signing policy checks.",
|
|
36423
|
+
"type": "boolean"
|
|
36424
|
+
},
|
|
36425
|
+
"cacheTtlSeconds": {
|
|
36426
|
+
"description": "Cache time-to-live for federation metadata in seconds.",
|
|
36427
|
+
"type": "integer",
|
|
36428
|
+
"minimum": 1,
|
|
36429
|
+
"maximum": 9007199254740991
|
|
36430
|
+
},
|
|
36431
|
+
"trustAnchors": {
|
|
36432
|
+
"type": "array",
|
|
36433
|
+
"items": {
|
|
36434
|
+
"type": "object",
|
|
36435
|
+
"properties": {
|
|
36436
|
+
"entityId": {
|
|
36437
|
+
"type": "string",
|
|
36438
|
+
"minLength": 1,
|
|
36439
|
+
"description": "Federation trust anchor entity id."
|
|
36440
|
+
},
|
|
36441
|
+
"entityConfigurationUri": {
|
|
36442
|
+
"type": "string",
|
|
36443
|
+
"format": "uri",
|
|
36444
|
+
"description": "Entity configuration URI for the trust anchor."
|
|
36445
|
+
}
|
|
36446
|
+
},
|
|
36447
|
+
"required": [
|
|
36448
|
+
"entityId",
|
|
36449
|
+
"entityConfigurationUri"
|
|
36450
|
+
],
|
|
36451
|
+
"additionalProperties": false
|
|
36452
|
+
},
|
|
36453
|
+
"description": "Federation trust anchors."
|
|
36454
|
+
},
|
|
36455
|
+
"entityTypes": {
|
|
36456
|
+
"description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
|
|
36457
|
+
"minItems": 1,
|
|
36458
|
+
"type": "array",
|
|
36459
|
+
"items": {
|
|
36460
|
+
"type": "string",
|
|
36461
|
+
"enum": [
|
|
36462
|
+
"openid_credential_issuer",
|
|
36463
|
+
"openid_credential_verifier"
|
|
36464
|
+
]
|
|
36465
|
+
}
|
|
36466
|
+
},
|
|
36467
|
+
"authorityHints": {
|
|
36468
|
+
"description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
|
|
36469
|
+
"type": "array",
|
|
36470
|
+
"items": {
|
|
36471
|
+
"type": "string",
|
|
36472
|
+
"format": "uri"
|
|
36473
|
+
}
|
|
36474
|
+
},
|
|
36475
|
+
"entityKeyChainId": {
|
|
36476
|
+
"description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
|
|
36477
|
+
"type": "string",
|
|
36478
|
+
"minLength": 1
|
|
36479
|
+
},
|
|
36480
|
+
"entityConfigurationLifetimeSeconds": {
|
|
36481
|
+
"description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
|
|
36482
|
+
"type": "integer",
|
|
36483
|
+
"minimum": 60,
|
|
36484
|
+
"maximum": 31536e3
|
|
36485
|
+
},
|
|
36486
|
+
"trustMarks": {
|
|
36487
|
+
"description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
|
|
36488
|
+
"type": "array",
|
|
36489
|
+
"items": {
|
|
36490
|
+
"type": "string",
|
|
36491
|
+
"minLength": 1
|
|
36492
|
+
}
|
|
36493
|
+
},
|
|
36494
|
+
"entityMetadata": {
|
|
36495
|
+
"description": "Informational federation_entity metadata of the entity configuration.",
|
|
36496
|
+
"type": "object",
|
|
36497
|
+
"properties": {
|
|
36498
|
+
"organization_name": {
|
|
36499
|
+
"type": "string",
|
|
36500
|
+
"minLength": 1
|
|
36501
|
+
},
|
|
36502
|
+
"contacts": {
|
|
36503
|
+
"minItems": 1,
|
|
36504
|
+
"type": "array",
|
|
36505
|
+
"items": {
|
|
36506
|
+
"type": "string",
|
|
36507
|
+
"minLength": 1
|
|
36508
|
+
}
|
|
36509
|
+
},
|
|
36510
|
+
"logo_uri": {
|
|
36511
|
+
"type": "string",
|
|
36512
|
+
"format": "uri"
|
|
36513
|
+
},
|
|
36514
|
+
"policy_uri": {
|
|
36515
|
+
"type": "string",
|
|
36516
|
+
"format": "uri"
|
|
36517
|
+
},
|
|
36518
|
+
"homepage_uri": {
|
|
36519
|
+
"type": "string",
|
|
36520
|
+
"format": "uri"
|
|
36521
|
+
}
|
|
36522
|
+
},
|
|
36523
|
+
"additionalProperties": false
|
|
36524
|
+
},
|
|
36525
|
+
"includeTrustChain": {
|
|
36526
|
+
"description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
|
|
36527
|
+
"type": "boolean"
|
|
36528
|
+
}
|
|
36529
|
+
},
|
|
36530
|
+
"required": [
|
|
36531
|
+
"trustAnchors"
|
|
36532
|
+
],
|
|
36533
|
+
"additionalProperties": false
|
|
36534
|
+
},
|
|
36535
|
+
{
|
|
36536
|
+
"type": "null"
|
|
35353
36537
|
}
|
|
35354
|
-
|
|
35355
|
-
|
|
36538
|
+
]
|
|
36539
|
+
},
|
|
36540
|
+
"registrationCertificate": {
|
|
36541
|
+
"description": "Optional registration certificate settings.",
|
|
36542
|
+
"anyOf": [
|
|
36543
|
+
{
|
|
36544
|
+
"type": "object",
|
|
36545
|
+
"properties": {
|
|
36546
|
+
"enabled": {
|
|
36547
|
+
"description": "Enable issuer registration certificate support.",
|
|
36548
|
+
"type": "boolean"
|
|
36549
|
+
},
|
|
36550
|
+
"mode": {
|
|
36551
|
+
"description": "How registration certificate data is provided.",
|
|
36552
|
+
"type": "string",
|
|
36553
|
+
"enum": [
|
|
36554
|
+
"import",
|
|
36555
|
+
"generate"
|
|
36556
|
+
]
|
|
36557
|
+
},
|
|
36558
|
+
"jwt": {
|
|
36559
|
+
"description": "Optional registration certificate JWT when using import mode.",
|
|
36560
|
+
"type": "string"
|
|
36561
|
+
},
|
|
36562
|
+
"privacyPolicy": {
|
|
36563
|
+
"description": "Optional privacy policy URI.",
|
|
36564
|
+
"type": "string"
|
|
36565
|
+
},
|
|
36566
|
+
"supportUri": {
|
|
36567
|
+
"description": "Optional support URI.",
|
|
36568
|
+
"type": "string"
|
|
36569
|
+
}
|
|
36570
|
+
},
|
|
36571
|
+
"additionalProperties": false
|
|
36572
|
+
},
|
|
36573
|
+
{
|
|
36574
|
+
"type": "null"
|
|
36575
|
+
}
|
|
36576
|
+
]
|
|
36577
|
+
},
|
|
36578
|
+
"display": {
|
|
36579
|
+
"description": "Localized issuer metadata shown to wallets.",
|
|
36580
|
+
"type": "array",
|
|
36581
|
+
"items": {
|
|
36582
|
+
"type": "object",
|
|
36583
|
+
"properties": {
|
|
36584
|
+
"name": {
|
|
36585
|
+
"description": "Issuer display name.",
|
|
36586
|
+
"type": "string"
|
|
36587
|
+
},
|
|
36588
|
+
"locale": {
|
|
36589
|
+
"description": "Locale tag for this display entry.",
|
|
36590
|
+
"type": "string"
|
|
36591
|
+
},
|
|
36592
|
+
"logo": {
|
|
36593
|
+
"description": "Optional issuer logo metadata.",
|
|
36594
|
+
"type": "object",
|
|
36595
|
+
"properties": {
|
|
36596
|
+
"uri": {
|
|
36597
|
+
"type": "string",
|
|
36598
|
+
"minLength": 1,
|
|
36599
|
+
"description": "Logo URI."
|
|
36600
|
+
},
|
|
36601
|
+
"alt_text": {
|
|
36602
|
+
"description": "Optional localized alternative text.",
|
|
36603
|
+
"type": "string"
|
|
36604
|
+
}
|
|
36605
|
+
},
|
|
36606
|
+
"required": [
|
|
36607
|
+
"uri"
|
|
36608
|
+
],
|
|
36609
|
+
"additionalProperties": {}
|
|
36610
|
+
}
|
|
36611
|
+
},
|
|
36612
|
+
"additionalProperties": {}
|
|
36613
|
+
}
|
|
36614
|
+
},
|
|
36615
|
+
"notificationEndpointEnabled": {
|
|
36616
|
+
"description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
|
|
36617
|
+
"type": "boolean"
|
|
36618
|
+
},
|
|
36619
|
+
"credentialResponseEncryption": {
|
|
36620
|
+
"description": "Enable encrypted credential responses.",
|
|
36621
|
+
"type": "boolean"
|
|
36622
|
+
},
|
|
36623
|
+
"credentialRequestEncryption": {
|
|
36624
|
+
"description": "Require encrypted credential requests.",
|
|
36625
|
+
"type": "boolean"
|
|
36626
|
+
},
|
|
36627
|
+
"txCodeMaxAttempts": {
|
|
36628
|
+
"description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
|
|
36629
|
+
"anyOf": [
|
|
36630
|
+
{
|
|
36631
|
+
"type": "integer",
|
|
36632
|
+
"minimum": 1,
|
|
36633
|
+
"maximum": 9007199254740991
|
|
36634
|
+
},
|
|
36635
|
+
{
|
|
36636
|
+
"type": "null"
|
|
36637
|
+
}
|
|
36638
|
+
]
|
|
36639
|
+
},
|
|
36640
|
+
"offerLifetimeSeconds": {
|
|
36641
|
+
"description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
|
|
36642
|
+
"anyOf": [
|
|
36643
|
+
{
|
|
36644
|
+
"type": "integer",
|
|
36645
|
+
"minimum": 1,
|
|
36646
|
+
"maximum": 9007199254740991
|
|
36647
|
+
},
|
|
36648
|
+
{
|
|
36649
|
+
"type": "null"
|
|
36650
|
+
}
|
|
36651
|
+
]
|
|
35356
36652
|
}
|
|
35357
36653
|
},
|
|
35358
36654
|
"required": [
|
|
35359
|
-
"
|
|
36655
|
+
"authorizationServers"
|
|
35360
36656
|
],
|
|
35361
36657
|
"additionalProperties": false,
|
|
35362
|
-
"
|
|
36658
|
+
"title": "IssuanceConfig"
|
|
35363
36659
|
}
|
|
35364
|
-
}
|
|
35365
|
-
"required": [
|
|
35366
|
-
"$schema",
|
|
35367
|
-
"metadata",
|
|
35368
|
-
"spec"
|
|
35369
|
-
],
|
|
35370
|
-
"additionalProperties": false
|
|
36660
|
+
}
|
|
35371
36661
|
},
|
|
35372
36662
|
{
|
|
35373
36663
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
35374
|
-
"$id": "https://eudiplo.dev/schemas/
|
|
36664
|
+
"$id": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json",
|
|
35375
36665
|
"title": "IssuanceConfigFile",
|
|
35376
36666
|
"type": "object",
|
|
35377
36667
|
"properties": {
|
|
35378
36668
|
"$schema": {
|
|
35379
36669
|
"type": "string",
|
|
35380
|
-
"const": "https://eudiplo.dev/schemas/
|
|
36670
|
+
"const": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json"
|
|
35381
36671
|
},
|
|
35382
36672
|
"metadata": {
|
|
35383
36673
|
"type": "object",
|
|
@@ -35477,11 +36767,6 @@ var CONFIG_SCHEMAS = [
|
|
|
35477
36767
|
}
|
|
35478
36768
|
]
|
|
35479
36769
|
},
|
|
35480
|
-
"signingKeyId": {
|
|
35481
|
-
"description": "Default signing key chain id for credential issuance.",
|
|
35482
|
-
"type": "string",
|
|
35483
|
-
"minLength": 1
|
|
35484
|
-
},
|
|
35485
36770
|
"authorizationServers": {
|
|
35486
36771
|
"minItems": 1,
|
|
35487
36772
|
"type": "array",
|
|
@@ -35574,7 +36859,7 @@ var CONFIG_SCHEMAS = [
|
|
|
35574
36859
|
"minimum": 60
|
|
35575
36860
|
},
|
|
35576
36861
|
"signingKeyId": {
|
|
35577
|
-
"description":
|
|
36862
|
+
"description": `ID of a key chain with usage type "accessToken" that signs the issued access tokens. Without it, the tenant's access token key chain signs them.`,
|
|
35578
36863
|
"type": "string",
|
|
35579
36864
|
"minLength": 1
|
|
35580
36865
|
},
|
|
@@ -35716,7 +37001,7 @@ var CONFIG_SCHEMAS = [
|
|
|
35716
37001
|
"minimum": 60
|
|
35717
37002
|
},
|
|
35718
37003
|
"signingKeyId": {
|
|
35719
|
-
"description":
|
|
37004
|
+
"description": `ID of a key chain with usage type "accessToken" that signs the issued access tokens. Without it, the tenant's access token key chain signs them.`,
|
|
35720
37005
|
"type": "string",
|
|
35721
37006
|
"minLength": 1
|
|
35722
37007
|
},
|
|
@@ -35824,7 +37109,7 @@ var CONFIG_SCHEMAS = [
|
|
|
35824
37109
|
"minimum": 60
|
|
35825
37110
|
},
|
|
35826
37111
|
"signingKeyId": {
|
|
35827
|
-
"description":
|
|
37112
|
+
"description": `ID of a key chain with usage type "accessToken" that signs the issued access tokens. Without it, the tenant's access token key chain signs them.`,
|
|
35828
37113
|
"type": "string",
|
|
35829
37114
|
"minLength": 1
|
|
35830
37115
|
},
|
|
@@ -38957,7 +40242,7 @@ function createDeploymentCommands(context, setExitCode) {
|
|
|
38957
40242
|
// package.json
|
|
38958
40243
|
var package_default = {
|
|
38959
40244
|
name: "@eudiplo/cli",
|
|
38960
|
-
version: "9.1.0-main.
|
|
40245
|
+
version: "9.1.0-main.f80d85e",
|
|
38961
40246
|
description: "Deployment-aware command line tools for EUDIPLO",
|
|
38962
40247
|
private: false,
|
|
38963
40248
|
type: "module",
|