feat: implement Remote STS Account provisioning

.github/workflows/verify.yaml

@@ -46,10 +46,10 @@ jobs:
       - uses: eclipse-edc/.github/.github/actions/setup-build@main
 
       - name: 'Build launcher'
-        run: ./gradlew :launcher:shadowJar
+        run: ./gradlew :launcher:identityhub:shadowJar
 
       - name: 'Build Docker image'
-        run: docker build -t identity-hub ./launcher
+        run: docker build -t identity-hub ./launcher/identityhub
 
       - name: 'Start Identity Hub'
         run: |

README.md

@@ -42,7 +42,8 @@ others.
 
 ## Quick start
 
-A basic launcher configured with in-memory stores (i.e. no persistent storage) can be found [here](launcher/). There are
+A basic launcher configured with in-memory stores (i.e. no persistent storage) can be
+found [here](launcher/identityhub). There are
 two ways of running IdentityHub:
 
 1. As native Java process
@@ -51,7 +52,7 @@ two ways of running IdentityHub:
 ### Build the `*.jar` file
 
 ```bash
-./gradlew :launcher:shadowJar
+./gradlew :launcher:identityhub:shadowJar
 ```
 
 ### Start IdentityHub as Java process
@@ -66,7 +67,7 @@ java -Dweb.http.presentation.port=10001 \
      -Dweb.http.identity.port=8182 \
      -Dweb.http.identity.path="/api/identity" \
      -Dedc.ih.api.superuser.key="c3VwZXItdXNlcgo=c3VwZXItc2VjcmV0Cg==" \
-     -jar launcher/build/libs/identity-hub.jar
+     -jar launcher/identityhub/build/libs/identity-hub.jar
 ```
 
 this will expose the Presentation API at `http://localhost:10001/api/presentation` and the Identity API
@@ -76,7 +77,7 @@ found [here](docs/developer/architecture/identityhub-apis.md)
 ### Create the Docker image
 
 ```bash
-docker build -t identity-hub ./launcher
+docker build -t identity-hub ./launcher/identityhub
 ```
 
 ### Start the Identity Hub

core/identity-hub-core/build.gradle.kts

@@ -10,7 +10,7 @@ dependencies {
     implementation(project(":core:lib:credential-query-lib"))
     implementation(libs.edc.spi.dcp) //SignatureSuiteRegistry
     implementation(libs.edc.core.connector) // for the CriterionToPredicateConverterImpl
-    implementation(libs.edc.ext.jsonld) // for the JSON-LD mapper
+    implementation(libs.edc.jsonld) // for the JSON-LD mapper
     implementation(libs.edc.lib.util)
     implementation(libs.edc.lib.store)
     implementation(libs.edc.lib.jsonld)
@@ -25,7 +25,7 @@ dependencies {
 
 
     testImplementation(libs.edc.junit)
-    testImplementation(libs.edc.ext.jsonld)
+    testImplementation(libs.edc.jsonld)
     testImplementation(testFixtures(project(":spi:identity-hub-store-spi")))
     testImplementation(testFixtures(libs.edc.vc.jwt)) // JWT generator
 }

core/identity-hub-did/build.gradle.kts

@@ -15,7 +15,7 @@ dependencies {
     implementation(libs.edc.lib.query)
 
     testImplementation(libs.edc.junit)
-    testImplementation(libs.edc.ext.jsonld)
+    testImplementation(libs.edc.jsonld)
     testImplementation(libs.edc.lib.keys)
     testImplementation(testFixtures(project(":spi:identity-hub-spi")))
     testImplementation(testFixtures(project(":spi:did-spi")))

core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextExtension.java

@@ -16,22 +16,20 @@
 
 import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
-import org.eclipse.edc.identityhub.spi.participantcontext.AccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
+import org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextObservable;
 import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.runtime.metamodel.annotation.Provider;
 import org.eclipse.edc.spi.event.EventRouter;
-import org.eclipse.edc.spi.result.ServiceResult;
 import org.eclipse.edc.spi.security.Vault;
 import org.eclipse.edc.spi.system.ServiceExtension;
 import org.eclipse.edc.transaction.spi.TransactionContext;
 
 import java.time.Clock;
 
-import static java.util.Optional.ofNullable;
 import static org.eclipse.edc.identityhub.participantcontext.ParticipantContextExtension.NAME;
 
 @Extension(NAME)
@@ -53,8 +51,8 @@ public class ParticipantContextExtension implements ServiceExtension {
     @Inject
     private DidResourceStore didResourceStore;
 
-    @Inject(required = false)
-    private AccountProvisioner accountProvisioner;
+    @Inject
+    private StsAccountProvisioner stsAccountProvisioner;
 
     private ParticipantContextObservable participantContextObservable;
 
@@ -65,7 +63,7 @@ public String name() {
 
     @Provider
     public ParticipantContextService createParticipantService() {
-        return new ParticipantContextServiceImpl(participantContextStore, didResourceStore, vault, transactionContext, participantContextObservable(), accountProvisioner());
+        return new ParticipantContextServiceImpl(participantContextStore, didResourceStore, vault, transactionContext, participantContextObservable(), stsAccountProvisioner);
     }
 
     @Provider
@@ -76,9 +74,4 @@ public ParticipantContextObservable participantContextObservable() {
         }
         return participantContextObservable;
     }
-
-    private AccountProvisioner accountProvisioner() {
-        return ofNullable(accountProvisioner)
-                .orElseGet(() -> manifest -> ServiceResult.success()); // default is a NOOP
-    }
 }

core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImpl.java

@@ -15,8 +15,8 @@
 package org.eclipse.edc.identityhub.participantcontext;
 
 import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
-import org.eclipse.edc.identityhub.spi.participantcontext.AccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
+import org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextObservable;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
@@ -52,20 +52,20 @@ public class ParticipantContextServiceImpl implements ParticipantContextService
     private final TransactionContext transactionContext;
     private final ApiTokenGenerator tokenGenerator;
     private final ParticipantContextObservable observable;
-    private final AccountProvisioner accountProvisioner;
+    private final StsAccountProvisioner stsAccountProvisioner;
 
     public ParticipantContextServiceImpl(ParticipantContextStore participantContextStore,
                                          DidResourceStore didResourceStore,
                                          Vault vault,
                                          TransactionContext transactionContext,
                                          ParticipantContextObservable observable,
-                                         AccountProvisioner accountProvisioner) {
+                                         StsAccountProvisioner stsAccountProvisioner) {
         this.participantContextStore = participantContextStore;
         this.didResourceStore = didResourceStore;
         this.vault = vault;
         this.transactionContext = transactionContext;
         this.observable = observable;
-        this.accountProvisioner = accountProvisioner;
+        this.stsAccountProvisioner = stsAccountProvisioner;
         this.tokenGenerator = new ApiTokenGenerator();
     }
 
@@ -79,7 +79,7 @@ public ServiceResult<Map<String, Object>> createParticipantContext(ParticipantMa
             var context = convert(manifest);
             var res = createParticipantContext(context)
                     .compose(u -> createTokenAndStoreInVault(context)).onSuccess(k -> response.put("apiKey", k))
-                    .compose(apiKey -> accountProvisioner.create(manifest))
+                    .compose(apiKey -> stsAccountProvisioner.create(manifest))
                     .onSuccess(accountInfo -> {
                         if (accountInfo != null) {
                             response.put("clientId", accountInfo.clientId());

core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImplTest.java

@@ -20,7 +20,7 @@
 import org.assertj.core.api.Assertions;
 import org.eclipse.edc.identithub.spi.did.model.DidResource;
 import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
-import org.eclipse.edc.identityhub.spi.participantcontext.AccountProvisioner;
+import org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextObservable;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
@@ -62,7 +62,7 @@ class ParticipantContextServiceImplTest {
     private final ParticipantContextStore participantContextStore = mock();
     private final ParticipantContextObservable observableMock = mock();
     private final DidResourceStore didResourceStore = mock();
-    private final AccountProvisioner provisionerMock = mock();
+    private final StsAccountProvisioner provisionerMock = mock();
     private ParticipantContextServiceImpl participantContextService;
 
     @BeforeEach

core/presentation-api/build.gradle.kts

@@ -32,7 +32,7 @@ dependencies {
     implementation(libs.edc.dcp.transform)
     implementation(libs.jakarta.rsApi)
     testImplementation(libs.edc.junit)
-    testImplementation(libs.edc.ext.jsonld)
+    testImplementation(libs.edc.jsonld)
     testImplementation(testFixtures(libs.edc.core.jersey))
     testImplementation(testFixtures(project(":spi:verifiable-credential-spi")))
     testImplementation(libs.nimbus.jwt)

e2e-tests/api-tests/build.gradle.kts

@@ -18,7 +18,7 @@ dependencies {
     testImplementation(testFixtures(project(":spi:verifiable-credential-spi")))
     testImplementation(testFixtures(libs.edc.testfixtures.managementapi))
     testImplementation(testFixtures(libs.edc.core.sql))
-    testImplementation(libs.edc.ext.transaction.local)
+    testImplementation(libs.edc.transaction.local)
     testImplementation(libs.edc.sql.pool)
     testImplementation(libs.nimbus.jwt)
     testImplementation(libs.jakarta.rsApi)

e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/ParticipantContextApiEndToEndTest.java

@@ -59,7 +59,7 @@
 import static io.restassured.http.ContentType.JSON;
 import static java.util.stream.IntStream.range;
 import static org.assertj.core.api.Assertions.assertThat;
-import static org.eclipse.edc.identityhub.spi.participantcontext.AccountProvisioner.CLIENT_SECRET_PROPERTY;
+import static org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner.CLIENT_SECRET_PROPERTY;
 import static org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndTestContext.SUPER_USER;
 import static org.hamcrest.Matchers.anyOf;
 import static org.hamcrest.Matchers.equalTo;

e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/fixtures/IdentityHubEndToEndExtension.java

@@ -76,7 +76,7 @@ public static IdentityHubEndToEndTestContext context() {
             var runtime = new EmbeddedRuntime(
                     "identity-hub",
                     configuration.config(),
-                    ":launcher"
+                    ":launcher:identityhub"
             );
 
             return new IdentityHubEndToEndTestContext(runtime, configuration);
@@ -112,7 +112,7 @@ public static IdentityHubEndToEndTestContext context(String dbName, Integer port
             var runtime = new EmbeddedRuntime(
                     "control-plane",
                     cfg,
-                    ":launcher",
+                    ":launcher:identityhub",
                     ":extensions:store:sql:identity-hub-credentials-store-sql",
                     ":extensions:store:sql:identity-hub-did-store-sql",
                     ":extensions:store:sql:identity-hub-keypair-store-sql",

e2e-tests/runtimes/identityhub-remote-sts/build.gradle.kts

@@ -0,0 +1,54 @@
+/*
+ *  Copyright (c) 2022 Microsoft Corporation
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Amadeus - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+    id("application")
+}
+
+dependencies {
+    runtimeOnly(project(":core:presentation-api"))
+    runtimeOnly(project(":core:identity-hub-did"))
+    runtimeOnly(project(":core:identity-hub-core"))
+    runtimeOnly(project(":core:identity-hub-participants"))
+    runtimeOnly(project(":core:identity-hub-keypairs"))
+    runtimeOnly(project(":extensions:did:local-did-publisher"))
+    runtimeOnly(project(":extensions:common:credential-watchdog"))
+    runtimeOnly(project(":extensions:sts:sts-account-provisioner"))
+    runtimeOnly(project(":extensions:sts:sts-account-service-remote"))
+    runtimeOnly(project(":extensions:api:identity-api:did-api"))
+    runtimeOnly(project(":extensions:api:identity-api:participant-context-api"))
+    runtimeOnly(project(":extensions:api:identity-api:verifiable-credentials-api"))
+    runtimeOnly(project(":extensions:api:identity-api:keypair-api"))
+    runtimeOnly(project(":extensions:api:identity-api:api-configuration"))
+    runtimeOnly(project(":extensions:api:identityhub-api-authentication"))
+    runtimeOnly(project(":extensions:api:identityhub-api-authorization"))
+    runtimeOnly(libs.edc.identity.did.core)
+    runtimeOnly(libs.edc.core.token)
+
+    // not needed:
+    // runtimeOnly(libs.edc.api.version)
+
+    runtimeOnly(libs.edc.identity.did.web)
+    runtimeOnly(libs.edc.jsonld)
+    runtimeOnly(libs.bundles.connector)
+}
+
+application {
+    mainClass.set("org.eclipse.edc.boot.system.runtime.BaseRuntime")
+}
+
+edcBuild {
+    publish.set(false)
+}