Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

How to Add Trust Marks to the vc_up_and_running Issuer

To update the *rust Trust Marks, you need to modify the trust_marks section of the satosa/plugins/oidc_frontend.yaml file. Follow the steps below to replace the existing Trust Marks with the ones received from the federation operator.

  1. Locate the Trust Marks Section

    In the current configuration, the `trusttrust_marks` marks are defined under: 

    Code Block
    languageyml
    trust_marks:
      - <existing-trust-mark-1>
      - <existing-trust-mark-2>

    You need to replace these values with the new Trust Marks provided by the federation operator.

  2. Example Update 

    If the federation operator provided the following new Trust Marks:

    Code Block
    languageyml
    eyJhbGciOiJSUzI1NiIsImtpZCI6IjM2NWQ2MjY3LTI5MzQtNGJhNy05YjEyLWU4ZmFkNTYwYjZjMyJ9...
    eyJhbGciOiJSUzI1NiIsImtpZCI6IjkwNTFjZTgzLTY1NzEtNDliYi04ODdjLTc3OWQzMDNmOTRmYyJ9...

    Modify the `trusttrust_marks` marks section as follows: 

    Code Block
    languageyml
    trust_marks:
      - eyJhbGciOiJSUzI1NiIsImtpZCI6IjM2NWQ2MjY3LTI5MzQtNGJhNy05YjEyLWU4ZmFkNTYwYjZjMyJ9...
      - eyJhbGciOiJSUzI1NiIsImtpZCI6IjkwNTFjZTgzLTY1NzEtNDliYi04ODdjLTc3OWQzMDNmOTRmYyJ9..


  3. Restart the Issuer to Apply Changes

    Once you've updated the configuration file, restart the Issuer container to apply the changes: 

    Code Block
    languagebash
    ./stop.sh && \
    ./start.sh


  4. Verify the Changes
    After restarting

    SATOSA

    the Issuer, verify that the new Trust Marks are correctly applied:

    Code Block
    languagebash
    curl -k -s https://<issuer-host>:8000/.well-known/openid-federation | cut -d '.' -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | jq .

    Look for the updated trust_marks in the JSON response.

Testing Trust Marks

  1. Decode JWT: Use tools like jwt.io to inspect the Trust Mark's claims and ensure all required fields are present.

  2. Verify Signature: Validate the JWT signature against the Trust Mark Issuer's public key.

  3. Check Expiration: Ensure the exp claim (if present) has not expired.

  4. Validate References: Follow the ref URL (if provided) to confirm compliance with human-readable policy documents.

...