EDC Identity Hub

[ma3u]

The DCP Specification needs a reference implementation with a minimized feature set. Today the feature set of the identity hub is already more as in the DCP specified.

Q1. Where we want to locate the code of the Idenity Hub to develop the missing features?

1. Use existing IdentityHub Repo
2. Additional features in the specific implementation of the data space (e.g. Tractus-X)
3. New Eclipse project for company identity wallet

The wallet is used by the holder and issuer. Dataspaces like Catena-X needed credential issuer(s) for the operational companies. Eclipse Tractus-X implements the ssi-issuer-component.

Q2. Should EDC provide an issuer componnet for data spaces, with the need of issuing the credentials via data space authority?

@jimmarino , @juliapampus @ndr-brt, @nikschul, @bscholtes1A, @mspiekermann

[jimmarino]

I don't understand the point of this question. Identity Hub will implement the DCP spec, which includes both presentation and issuance components, DID management, renewal and revocation as well as a host of other features. There are numerous decision records and architecture documents that have codified these plans. EDC is about implementing enterprise-grade software, which means it always goes above and beyond a minimalist reference implementation.

This work will be done as part of the EDC project. Other projects are free to implement DCP however they see fit or use parts of EDC. However, EDC will implement the full range of required identity and claims components.

[ma3u]

Thank you for the clarification. In the decision board 2022-06-08 Identity Hub its written: identity hub will be used to

• securely deliver Verifiable Credentials from a dataspace issuer to a dataspace participant
• provide Verifiable Presentations on behalf of a participant

DID Management in identity-hub-modules:

• create/read/update(/delete) DID resources in the DidResourceStore
• publish/overwrite DID documents using the publishers
• react to key rotation events from the KeyPair module: adds new keys to the DID, removes old ones, etc.
• react to manual action via the Identity API

Renewal feature:

• identity-hub-modules: VerifiableCredentialManager: it can be configured whether credentials are auto-renewed
• identity.hub.architecture 2.2.1. Verifiable Credential Resources and KeyPair Module

Revocation feature:

• identity-hub-modules 2.2.3. KeyPair Resources
• A KeyPairResource is a type of identity resource that manages public/private key pairs
• The useDuration specifies how long in milliseconds the key pair should be in the ACTIVATED state before a rotation is started.
• Inactive KeyPairResource are rotated or revoked.

[jimmarino]

Note that DR was written well before DCP existed. IH will also implement the issuance flow for DCP.