Validate the incoming TLS connection against the incoming DAT

[HeinrichPet]

Currently, the Messaging Services only validates whether the DAT is correct and valid. However, the identity of the sender is not validated.

To do this, the transportCertsSha256 from the DAT must be matched with the fingerprint of the TLS certificate.
Therefore the IDS-Messaging Services (and also all other IDS implementations) must dynamically specify their TLS certifacte fingerprint in a DAT request so that the DAT is issued correctly. The DAT is returned only if the identity of the sender has been validated by the DAPS. Therefore, by matching the DAT with the transport certificate fingerprint, we can ensure, that the identity is checked by the DAPS.

Additionally, the hostname specified under referring Connector in the DAT should match the hostname of the TLS connection. This should also be checked.

[tmberthold]

must dynamically specify their TLS certifacte fingerprint in a DAT request
Do we already have a claim or other option for this in the DAT request? If not, it would have to be added.

Would have to be specified here first (can't identify a matching claim): https://github.com/International-Data-Spaces-Association/IDS-G/tree/main/Components/IdentityProvider/DAPS#request-token-that-is-handed-in-at-daps-side

[tmberthold]

I think it's an ongoing discussion?!
Fraunhofer-AISEC/omejdn-server#38

[tmberthold]

Related:

• Enhancement: Validation of requesting host before issuing DAT omejdn-daps#21
• Enhancement: Specifying own certificate-fingerprints in the DAT request omejdn-daps#22

[tmberthold]

Waiting for a reference implementation in EDC as this is on the schedule there for current milestone planning. Will then adapt that here when the solution is available. (Issue 1152 in EDC)

[bellebaum]

For reference, here is the current proposal for specifying the claims as a request parameter (private repo):
https://github.com/International-Data-Spaces-Association/IDS-G-pre/pull/84

[tmberthold]

Here's the link to the EDC issue, which is part of the Milestone 4 for the end of the month:
"check hostname of incoming request"
eclipse-edc/Connector#1152