1.1.0

.github/workflows/push_trigger.yml

@@ -10,6 +10,7 @@ on:
       - 1.*
       - develop
       - main
+      - bugfix-ES-218
 
 jobs:
   call-workflow-codeql-analysis:

.github/workflows/release_chart.yml

@@ -19,6 +19,6 @@ jobs:
         with:
           token: ${{ secrets.ACTION_PAT }}
           charts_dir: ./helm
-          charts_url: https://github.com/mosip
+          charts_url: https://mosip.github.io/mosip-helm
           repository: mosip-helm
           branch: gh-pages

README.md

@@ -29,6 +29,62 @@ The project requires JDK 11.
     $ docker build -f Dockerfile
     ```
 
+## Installing in k8s cluster using helm
+### Pre-requisites
+1. Set the kube config file of the Mosip cluster having dependent services is set correctly in PC.
+1. Make sure [DB setup](db_scripts/README.md#install-in-existing-mosip-k8-cluster) is done.
+1. Add / merge below mentioned properties files into existing config branch:
+    * [esignet-default.properties](https://github.com/mosip/mosip-config/blob/v1.2.0.1-B3/esignet-default.properties) 
+    * [application-default.properties](https://github.com/mosip/mosip-config/blob/v1.2.0.1-B3/application-default.properties)
+1. Below are the dependent services required for esignet service:
+   | Chart | Chart version |
+   |---|---|
+   |[Keycloak](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/external/iam) | 7.1.18 |
+   |[Keycloak-init](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/external/iam) | 12.0.1-B3 |
+   |[Postgres](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/external/postgres) | 10.16.2 |
+   |[Postgres Init](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/external/postgres) | 12.0.1-B3 |
+   |[Minio](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/external/object-store) | 10.1.6 |
+   |[Kafka](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/external/kafka) | 0.4.2 |
+   |[Config-server](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/mosip/config-server) | 12.0.1-B3 |
+   |[Websub](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/mosip/websub) | 12.0.1-B2 |
+   |[Artifactory server](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/mosip/artifactory) | 12.0.1-B3 |
+   |[Keymanager service](https://github.com/mosip/mosip-infra/blob/v1.2.0.1-B3/deployment/v3/mosip/keymanager) | 12.0.1-B2 |
+   |[Kernel services](https://github.com/mosip/mosip-infra/blob/v1.2.0.1-B3/deployment/v3/mosip/kernel) | 12.0.1-B2 |
+   |[Biosdk service](https://github.com/mosip/mosip-infra/tree/v1.2.0.1-B3/deployment/v3/mosip/biosdk) | 12.0.1-B3 |
+   |[Idrepo services](https://github.com/mosip/mosip-infra/blob/v1.2.0.1-B3/deployment/v3/mosip/idrepo) | 12.0.1-B2 |
+   |[Pms services](https://github.com/mosip/mosip-infra/blob/v1.2.0.1-B3/deployment/v3/mosip/pms) | 12.0.1-B3 |
+   |[IDA services](https://github.com/mosip/mosip-infra/blob/v1.2.0.1-B3/deployment/v3/mosip/ida) | 12.0.1-B3 |
+
+### Install
+* Install `kubectl` and `helm` utilities.
+* Run `install-all.sh` to deploy esignet services.
+  ```
+  cd helm
+  ./install-all.sh
+  ```
+* During the execution of the `install-all.sh` script, a prompt appears requesting information regarding the presence of a public domain and a valid SSL certificate on the server.
+* If the server lacks a public domain and a valid SSL certificate, it is advisable to select the `n` option. Opting it will enable the `init-container` with an `emptyDir` volume and include it in the deployment process.
+* The init-container will proceed to download the server's self-signed SSL certificate and mount it to the specified location within the container's Java keystore (i.e., `cacerts`) file.
+* This particular functionality caters to scenarios where the script needs to be employed on a server utilizing self-signed SSL certificates.
+
+### Delete
+* Run `delete-all.sh` to remove esignet services.
+  ```
+  cd helm
+  ./delete-all.sh
+  ```
+
+### Restart
+* Run `restart-all.sh` to restart esignet services.
+  ```
+  cd helm
+  ./restart-all.sh
+  ```
+
+## Onboard esignet
+* Run onboarder's [install.sh](partner-onboarder) script to exchange jwk certificates.
+
+
 ## APIs
 API documentation is available [here](https://mosip.stoplight.io/docs/identity-provider/branches/main/6f1syzijynu40-identity-provider).
 

binding-service-impl/pom.xml

@@ -8,7 +8,7 @@
 	<parent>
 		<groupId>io.mosip.esignet</groupId>
 		<artifactId>esignet-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.1.0-SNAPSHOT</version>
 	</parent>
 
 	<groupId>io.mosip.esignet</groupId>

binding-service-impl/src/main/java/io/mosip/esignet/services/KeyBindingServiceImpl.java

@@ -12,6 +12,7 @@
 import java.time.format.DateTimeFormatter;
 import java.util.*;
 
+import io.mosip.esignet.api.dto.AuthChallenge;
 import io.mosip.esignet.api.dto.KeyBindingResult;
 import io.mosip.esignet.api.dto.SendOtpResult;
 import io.mosip.esignet.api.exception.KeyBindingException;
@@ -80,13 +81,23 @@ public BindingOtpResponse sendBindingOtp(BindingOtpRequest bindingOtpRequest, Ma
 		return otpResponse;
 	}
 
+	private void validateChallengeListAuthFormat(List<AuthChallenge> challengeList){
+		if(!challengeList.stream().allMatch(challenge->keyBindingWrapper.getSupportedChallengeFormats(challenge.getAuthFactorType()).
+				contains(challenge.getFormat()))) {
+			log.error("Invalid auth factor type or challenge format in the challenge list");
+			throw new EsignetException(INVALID_AUTH_FACTOR_TYPE_OR_CHALLENGE_FORMAT);
+		}
+	}
+
 	@Override
 	public WalletBindingResponse bindWallet(WalletBindingRequest walletBindingRequest, Map<String, String> requestHeaders) throws EsignetException {
 		log.debug("bindWallet :: Request headers >> {}", requestHeaders);
+		validateChallengeListAuthFormat(walletBindingRequest.getChallengeList());
+
 		//Do not store format, only check if the format is supported by the wrapper.
 		if(!keyBindingWrapper.getSupportedChallengeFormats(walletBindingRequest.getAuthFactorType()).
 				contains(walletBindingRequest.getFormat()))
-			throw new EsignetException(INVALID_CHALLENGE_FORMAT);
+			throw new EsignetException(INVALID_AUTH_FACTOR_TYPE_OR_CHALLENGE_FORMAT);
 
 		String publicKey = IdentityProviderUtil.getJWKString(walletBindingRequest.getPublicKey());
 		KeyBindingResult keyBindingResult;

binding-service-impl/src/main/java/io/mosip/esignet/services/PublicKeyRegistryServiceImpl.java

@@ -0,0 +1,36 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+package io.mosip.esignet.services;
+
+import io.mosip.esignet.core.dto.PublicKeyRegistry;
+import io.mosip.esignet.core.spi.PublicKeyRegistryService;
+import io.mosip.esignet.repository.PublicKeyRegistryRepository;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import java.util.Optional;
+
+@Slf4j
+@Service
+public class PublicKeyRegistryServiceImpl implements PublicKeyRegistryService {
+
+    @Autowired
+    private PublicKeyRegistryRepository publicKeyRegistryRepository;
+
+    @Override
+    public Optional<PublicKeyRegistry> findLatestPublicKeyByPsuTokenAndAuthFactor(String psuToken, String authFactor) {
+        Optional<io.mosip.esignet.entity.PublicKeyRegistry> optionalPublicKeyRegistry = publicKeyRegistryRepository.findLatestByPsuTokenAndAuthFactor(psuToken,authFactor);
+        if(optionalPublicKeyRegistry.isPresent()) {
+            PublicKeyRegistry publicKeyRegistry = new PublicKeyRegistry();
+            publicKeyRegistry.setPublicKey(optionalPublicKeyRegistry.get().getPublicKey());
+            publicKeyRegistry.setPsuToken(optionalPublicKeyRegistry.get().getPsuToken());
+            publicKeyRegistry.setAuthFactor(optionalPublicKeyRegistry.get().getAuthFactor());
+            return Optional.of(publicKeyRegistry);
+        }
+        return Optional.empty();
+    }
+}

binding-service-impl/src/test/java/io/mosip/esignet/KeyBindingServiceTest.java

@@ -201,6 +201,7 @@ public void bindWallet_withUnsupportedFormat_thenFail() throws EsignetException,
 		AuthChallenge authChallenge = new AuthChallenge();
 		authChallenge.setAuthFactorType("OTP");
 		authChallenge.setChallenge("111111");
+		authChallenge.setFormat("alpha-numeric");
 		List<AuthChallenge> authChallengeList = new ArrayList();
 		authChallengeList.add(authChallenge);
 		walletBindingRequest.setChallengeList(authChallengeList);
@@ -210,7 +211,7 @@ public void bindWallet_withUnsupportedFormat_thenFail() throws EsignetException,
 			Assert.assertNotNull(keyBindingService.bindWallet(walletBindingRequest, new HashMap<>()));
 			Assert.fail();
 		} catch (EsignetException e) {
-			Assert.assertTrue(e.getErrorCode().equals(ErrorConstants.INVALID_CHALLENGE_FORMAT));
+			Assert.assertTrue(e.getErrorCode().equals(ErrorConstants.INVALID_AUTH_FACTOR_TYPE_OR_CHALLENGE_FORMAT));
 		}
 	}
 
@@ -230,8 +231,6 @@ public void bindWallet_withInvalidKeyBindingResult_thenFail() throws IOException
 		walletBindingRequest.setPublicKey(
 				(Map<String, Object>) objectMapper.readValue(clientJWK.toJSONString(), HashMap.class));
 
-		when(mockKeyBindingWrapperService.doKeyBinding(Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.anyString(), Mockito.any()))
-				.thenReturn(null);
 		try {
 			Assert.assertNotNull(keyBindingService.bindWallet(walletBindingRequest, new HashMap<>()));
 			Assert.fail();

client-management-service-impl/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>io.mosip.esignet</groupId>
         <artifactId>esignet-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.1.0-SNAPSHOT</version>
     </parent>
 
     <groupId>io.mosip.esignet</groupId>

consent-service-impl/pom.xml

@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at https://mozilla.org/MPL/2.0/. -->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>io.mosip.esignet</groupId>
+        <artifactId>esignet-parent</artifactId>
+        <version>1.1.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>consent-service-impl</artifactId>
+
+    <properties>
+        <maven.compiler.source>11</maven.compiler.source>
+        <maven.compiler.target>11</maven.compiler.target>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <esignet.core.version>${project.version}</esignet.core.version>
+    </properties>
+    <dependencies>
+        <dependency>
+            <groupId>io.mosip.esignet</groupId>
+            <artifactId>esignet-core</artifactId>
+            <version>${esignet.core.version}</version>
+        </dependency>
+        <!-- https://mvnrepository.com/artifact/org.modelmapper/modelmapper -->
+        <dependency>
+            <groupId>org.modelmapper</groupId>
+            <artifactId>modelmapper</artifactId>
+            <version>3.1.1</version>
+        </dependency>
+    </dependencies>
+</project>

consent-service-impl/src/main/java/io/mosip/esignet/config/ModelMapperConfig.java

@@ -0,0 +1,21 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+package io.mosip.esignet.config;
+
+
+import org.modelmapper.ModelMapper;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class ModelMapperConfig {
+
+    @Bean
+    public ModelMapper modelMapper() {
+        return new ModelMapper();
+    }
+
+}

consent-service-impl/src/main/java/io/mosip/esignet/entity/ConsentDetail.java

@@ -0,0 +1,82 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+package io.mosip.esignet.entity;
+
+import lombok.*;
+import org.hibernate.Hibernate;
+
+import javax.persistence.*;
+import javax.validation.constraints.NotNull;
+import java.time.LocalDateTime;
+import java.util.Objects;
+import java.util.UUID;
+
+import static io.mosip.esignet.core.constants.ErrorConstants.INVALID_CLAIM;
+import static io.mosip.esignet.core.constants.ErrorConstants.INVALID_CLIENT_ID;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+@Entity
+public class ConsentDetail {
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private UUID id;
+
+    @NotNull(message = INVALID_CLIENT_ID)
+    @Column(name = "client_id")
+    private String clientId;
+
+    @NotNull
+    @Column(name = "psu_token")
+    private String psuToken;
+
+    @NotNull(message = INVALID_CLAIM)
+    @Column(name = "claims")
+    private String claims;
+
+    /*
+    It stores the requested authorization scopes from the relying party in a json string
+    {
+        "scope" : "boolean" (essential or optional)
+    }
+     */
+    @NotNull
+    @Column(name = "authorization_scopes")
+    private String authorizationScopes;
+
+    @NotNull
+    @Column(name = "cr_dtimes")
+    private LocalDateTime createdtimes;
+
+    @Column(name = "expire_dtimes")
+    private LocalDateTime expiredtimes;
+
+    @Column(name = "signature")
+    private String signature;
+
+    @Column(name = "hash")
+    private String hash;
+
+    @Column(name = "accepted_claims")
+    private String acceptedClaims;
+
+    @Column(name = "permitted_scopes")
+    private String permittedScopes;
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || Hibernate.getClass(this) != Hibernate.getClass(o)) return false;
+        ConsentDetail consentDetail = (ConsentDetail) o;
+        return getId() != null && Objects.equals(getId(), consentDetail.getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getClass().hashCode();
+    }
+}