Skip to content

Commit dd05d12

Browse files
Mortega5wistefan
Mortega5
and
wistefan
authored
MIgrate to liquibase (#22)
* refactor(db): replace flyway with liquibase Liquibase has better support for different types of databases. It allows having a single migration file for all databases. * do not copy test resources into prod image * update README.md * rename 2.0.3 database migration script --------- Co-authored-by: Stefan Wiedemann <[email protected]>
1 parent 9a9be30 commit dd05d12

31 files changed

+427
-240
lines changed

‎README.md‎

Lines changed: 105 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Credentials Config Service
22

3-
The Credentials Config Service manages and provides information about services and the credentials they are using. It
4-
returns the scope to be requested from the wallet per service and the credentials and issuers that are considered to be
5-
trusted for a certain service.
3+
The Credentials Config Service manages and provides information about services and the credentials they are using. It
4+
returns the scope to be requested from the wallet per service and the credentials and issuers that are considered to be
5+
trusted for a certain service.
66

77
[![FIWARE Security](https://nexus.lab.fiware.org/repository/raw/public/badges/chapters/security.svg)](https://www.fiware.org/developers/catalogue/)
88
[![License badge](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
@@ -13,12 +13,15 @@ trusted for a certain service.
1313

1414
## Background
1515

16-
In an DSBA-compliant framework, a [Verifier](https://github.com/FIWARE/VCVerifier) is responsible to communicate with wallets
16+
In an DSBA-compliant framework, a [Verifier](https://github.com/FIWARE/VCVerifier) is responsible to communicate with
17+
wallets
1718
and verify the credentials they provide. To get this done, it needs information about:
19+
1820
- the credentials to be requested from a wallet
1921
- the credentials and claims an issuer is allowed to issue
2022

21-
To do so, it requires a service that provides such information, e.g. the Credentials Config Service. See the following diagram
23+
To do so, it requires a service that provides such information, e.g. the Credentials Config Service. See the following
24+
diagram
2225
on how the service integrates into the framework.
2326

2427
![overview-setup](doc/overview.png)
@@ -27,20 +30,26 @@ on how the service integrates into the framework.
2730

2831
### Container
2932

30-
The Credentials-Config-Service Service is provided as a container at [quay.io](https://quay.io/repository/fiware/credentials-config-service).
33+
The Credentials-Config-Service Service is provided as a container
34+
at [quay.io](https://quay.io/repository/fiware/credentials-config-service).
3135
To store information about the services, a database has to be provided. In a local setup, you can for example use:
36+
3237
```shell
3338
docker run --name mysql -p 3306:3306 -e MYSQL_ROOT_PASSWORD=root -e MYSQL_USER=user -e MYSQL_PASSWORD=password -e MYSQL_DATABASE=db mysql
3439
```
40+
3541
and the start the service:
42+
3643
```shell
3744
docker run --network host quay.io/fiware/credentials-config-service:0.0.1
3845
```
46+
3947
After that, its accessible at ```localhost:8080```.
4048

4149
### Configuration
4250

43-
Configurations can be provided with the standard mechanisms of the [Micronaut-Framework](https://micronaut.io/), e.g. [environment variables or appliction.yaml file](https://docs.micronaut.io/3.1.3/guide/index.html#configurationProperties).
51+
Configurations can be provided with the standard mechanisms of the [Micronaut-Framework](https://micronaut.io/),
52+
e.g. [environment variables or appliction.yaml file](https://docs.micronaut.io/3.1.3/guide/index.html#configurationProperties).
4453
The following table concentrates on the most important configuration parameters:
4554

4655
| Property | Env-Var | Description | Default |
@@ -55,10 +64,13 @@ The following table concentrates on the most important configuration parameters:
5564

5665
### Database
5766

58-
Credentials-Config-Service requires an SQL database. It currently supports MySql-compatible DBs, PostgreSQL and H2 (as an In-Memory DB for dev/test purposes).
59-
Migrations are applied via [flyway](https://flywaydb.org/), see the [migration-scripts](./src/main/resources/db/migration) for the schema.
67+
Credentials-Config-Service requires an SQL database. It currently supports MySql-compatible DBs, PostgreSQL and H2 (as
68+
an In-Memory DB for dev/test purposes).
69+
Migrations are applied via [liquibase](https://www.liquibase.com/), see
70+
the [migration-scripts](./src/main/resources/db/migration).
6071

61-
By default, the system is configured to use MySQL. To run it with PostgreSQL, you should update the following configuration:
72+
By default, the system is configured to use MySQL. To run it with PostgreSQL, you should update the following
73+
configuration:
6274

6375
```yaml
6476
# Update default datasource dialect and driver
@@ -69,76 +81,81 @@ datasources:
6981
username: superuser
7082
password: superpassword
7183
dialect: POSTGRES
72-
84+
```
85+
7386
## Usage
7487
7588
The service provides the following API:
76-
- [Credentials-Config-Service API](./api/credentials-config-service.yaml)
7789
78-
It is used to manage the service-related entries and provides endpoints to retrieve the required information.
90+
- [ Credentials-Config-Service API ](./api/credentials-config-service.yaml)
7991
92+
It is used to manage the service-related entries and provides endpoints to retrieve the required information.
8093
8194
### Example
8295
8396
To have information about a service available, it first needs to be created.
8497
An example request would look like:
85-
```shell
86-
curl -X 'POST' \
98+
99+
```shell
100+
curl -X 'POST' \
87101
'http://localhost:8080/service' \
88-
-H 'accept: */*' \
89-
-H 'Content-Type: application/json' \
102+
-H 'accept: */*' \
103+
-H 'Content-Type: application/json' \
90104
-d '{
91-
"id": "packet-delivery-service",
92-
"defaultOidcScope": "default",
93-
"oidcScopes": {
94-
"default": {
95-
"credentials": [
105+
"id": "packet-delivery-service",
106+
"defaultOidcScope": "default",
107+
"oidcScopes": {
108+
"default": {
109+
"credentials": [
110+
{
111+
"type": "VerifiableCredential",
112+
"trustedParticipantsLists": [
113+
"https://tir-pdc.ebsi.fiware.dev"
114+
],
115+
"trustedIssuersLists": [
116+
"https://til-pdc.ebsi.fiware.dev"
117+
]
118+
}
119+
],
120+
"presentationDefinition": {
121+
"id": "somethingUnique",
122+
"name": "Presentation to be requested.",
123+
"purpose": "something that describes our request.",
124+
"input_descriptors": [
96125
{
97-
"type": "VerifiableCredential",
98-
"trustedParticipantsLists": [
99-
"https://tir-pdc.ebsi.fiware.dev"
100-
],
101-
"trustedIssuersLists": [
102-
"https://til-pdc.ebsi.fiware.dev"
126+
"id": "somethingUnique",
127+
"name": "User Age request",
128+
"purpose": "Only users above a certain age should get service access",
129+
"constraints": {
130+
"fields": [
131+
{
132+
"id": "somethingUnique",
133+
"name": "User Age request",
134+
"purpose": "Only users above a certain age should get service access",
135+
"optional": false,
136+
"path": [
137+
"$.dateOfBirth"
138+
]
139+
}
140+
]
141+
},
142+
"format": {
143+
"vc+sd-jwt":
144+
"alg": [ "ES256" ]
145+
}
103146
]
104147
}
105-
],
106-
"presentationDefinition": {
107-
"id": "somethingUnique",
108-
"name": "Presentation to be requested.",
109-
"purpose": "something that describes our request.",
110-
"input_descriptors": [
111-
{
112-
"id": "somethingUnique",
113-
"name": "User Age request",
114-
"purpose": "Only users above a certain age should get service access",
115-
"constraints": {
116-
"fields": [
117-
{
118-
"id": "somethingUnique",
119-
"name": "User Age request",
120-
"purpose": "Only users above a certain age should get service access",
121-
"optional": false,
122-
"path": [
123-
"$.dateOfBirth"
124-
]
125-
}
126-
]
127-
},
128-
"format": {
129-
"vc+sd-jwt":
130-
"alg": ["ES256"]
131-
}
132-
]
133-
}
134-
}
135-
}
136-
}'
148+
}
149+
}
150+
}'
137151
```
138-
Such configuration will define that the requested scope for authentication-requests to ```packet-delivery-service``` is
139-
```VerifiableCredential``` and that the issuer needs to be listed as a trusted-participant at
140-
```https://tir-pdc.ebsi.fiware.dev``` and that the information about the trusted-issuers should be retrieved from ```https://til-pdc.ebsi.fiware.dev```.
141-
Additionally, it describes the presentation to be requested need to include the claim ```$.dateOfBirth``` and should be a ```vc+sd-jwt``` credential, signed by an ```ES256``` algorithm.
152+
153+
Such configuration will define that the requested scope for authentication-requests to ```packet-delivery-service``` is
154+
```VerifiableCredential``` and that the issuer needs to be listed as a trusted-participant at
155+
```https://tir-pdc.ebsi.fiware.dev``` and that the information about the trusted-issuers should be retrieved from
156+
```https://til-pdc.ebsi.fiware.dev```.
157+
Additionally, it describes the presentation to be requested need to include the claim ```$.dateOfBirth``` and should be
158+
a ```vc+sd-jwt``` credential, signed by an ```ES256``` algorithm.
142159

143160
The verifier can access that information via:
144161

@@ -149,6 +166,7 @@ curl --location 'localhost:8080/service/packet-delivery-service'
149166
#### Support for Gaia-X registries
150167

151168
The config service also supports GAIA-X Registries as participants list(even mixed configurations):
169+
152170
```shell
153171
curl -X 'POST' \
154172
'http://localhost:8080/service' \
@@ -178,6 +196,7 @@ curl -X 'POST' \
178196
```
179197

180198
and receive:
199+
181200
```shell
182201
{
183202
"id": "packet-delivery-service",
@@ -208,7 +227,8 @@ Besides that, it's also possible to get just the scope to be requested:
208227
curl --location 'localhost:8080/service/packet-delivery-service/scope'
209228
```
210229

211-
and receive:
230+
and receive:
231+
212232
```shell
213233
[
214234
"VerifiableCredential"
@@ -217,12 +237,14 @@ and receive:
217237

218238
#### Presentation Definition
219239

220-
For each service and scope, a [Presentation Definition](https://identity.foundation/presentation-exchange/#presentation-definition) can be defined.
221-
The Presentation Definition will be requested in the OID4VP exchange from the Holder's Wallet.
240+
For each service and scope,
241+
a [Presentation Definition](https://identity.foundation/presentation-exchange/#presentation-definition) can be defined.
242+
The Presentation Definition will be requested in the OID4VP exchange from the Holder's Wallet.
222243

223244
Example:
224245

225246
```json
247+
{
226248
"presentationDefinition": {
227249
"id": "somethingUnique",
228250
"name": "Presentation to be requested.",
@@ -240,10 +262,10 @@ Example:
240262
"purpose": "We do only accept offical documents for proofing the age.",
241263
"optional": false,
242264
"path": [
243-
"$.vct"
265+
"$.vct"
244266
],
245267
"filter": {
246-
"const": "NaturalPersonCredential"
268+
"const": "NaturalPersonCredential"
247269
}
248270
},
249271
{
@@ -252,25 +274,32 @@ Example:
252274
"purpose": "Only users above a certain age should get service access",
253275
"optional": false,
254276
"path": [
255-
"$.dateOfBirth"
277+
"$.dateOfBirth"
256278
]
257279
}
258280
]
259281
},
260282
"format": {
261-
"vc+sd-jwt":
262-
"alg": ["ES256"]
283+
"vc+sd-jwt": {
284+
"alg": [
285+
"ES256"
286+
]
287+
}
288+
}
263289
}
264290
]
265291
}
292+
}
266293
```
267294

268-
This definition will request a credential of type ```NaturalPersonCredential```, that contains the claim ```$.dateOfBirth```(defined by a JsonPath expression),
269-
in the ```vc+sd-jwt``` format, signed by the ```ES256``` algorithm. While PresentationDefinitions allow very fine-grained control about the claims and
270-
credentials to be requested, most wallets do only support a limited complexity(f.e. only level-one path expressions or no filtering). At the moment,
295+
This definition will request a credential of type ```NaturalPersonCredential```, that contains the claim
296+
```$.dateOfBirth```(defined by a JsonPath expression),
297+
in the ```vc+sd-jwt``` format, signed by the ```ES256``` algorithm. While PresentationDefinitions allow very
298+
fine-grained control about the claims and
299+
credentials to be requested, most wallets do only support a limited complexity(f.e. only level-one path expressions or
300+
no filtering). At the moment,
271301
its recommended to keep complexity at the minimal level.
272302

273-
274303
## License
275304

276305
Credentials-Config-Service is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

‎pom.xml‎

Lines changed: 13 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -179,17 +179,18 @@
179179
<scope>compile</scope>
180180
</dependency>
181181
<dependency>
182-
<groupId>mysql</groupId>
183-
<artifactId>mysql-connector-java</artifactId>
184-
<scope>runtime</scope>
182+
<groupId>org.liquibase</groupId>
183+
<artifactId>liquibase-core</artifactId>
185184
</dependency>
186185
<dependency>
187-
<groupId>org.flywaydb</groupId>
188-
<artifactId>flyway-mysql</artifactId>
186+
<groupId>io.micronaut.liquibase</groupId>
187+
<artifactId>micronaut-liquibase</artifactId>
188+
<scope>compile</scope>
189189
</dependency>
190190
<dependency>
191-
<groupId>org.flywaydb</groupId>
192-
<artifactId>flyway-database-postgresql</artifactId>
191+
<groupId>mysql</groupId>
192+
<artifactId>mysql-connector-java</artifactId>
193+
<scope>runtime</scope>
193194
</dependency>
194195
<dependency>
195196
<groupId>org.postgresql</groupId>
@@ -200,19 +201,17 @@
200201
<groupId>com.h2database</groupId>
201202
<artifactId>h2</artifactId>
202203
</dependency>
203-
<dependency>
204-
<groupId>io.micronaut.flyway</groupId>
205-
<artifactId>micronaut-flyway</artifactId>
206-
<scope>compile</scope>
207-
</dependency>
208204

209205
<!-- logging -->
210206
<dependency>
211207
<groupId>ch.qos.logback</groupId>
212208
<artifactId>logback-classic</artifactId>
213209
<scope>runtime</scope>
214210
</dependency>
215-
211+
<dependency>
212+
<groupId>org.slf4j</groupId>
213+
<artifactId>jul-to-slf4j</artifactId>
214+
</dependency>
216215
<!-- Tests -->
217216
<dependency>
218217
<groupId>org.junit.jupiter</groupId>
@@ -567,10 +566,7 @@
567566
</resource>
568567
<resource>
569568
<directory>src/test/resources</directory>
570-
<filtering>true</filtering>
571-
<excludes>
572-
<exclude>application.yaml</exclude>
573-
</excludes>
569+
<filtering>false</filtering>
574570
</resource>
575571
</resources>
576572
<plugins>

‎src/main/java/org/fiware/iam/Application.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
package org.fiware.iam;
22

33
import io.micronaut.runtime.Micronaut;
4+
import org.slf4j.bridge.SLF4JBridgeHandler;
45

56
public class Application {
67

78
public static void main(String[] args) {
8-
Micronaut.run(Application.class, args);
9+
10+
SLF4JBridgeHandler.removeHandlersForRootLogger();
11+
SLF4JBridgeHandler.install();
12+
Micronaut.run(Application.class, args);
913
}
1014

1115
}

0 commit comments

Comments
 (0)