Gaia-X Compliance VCs are not supported by EDC Identity Hub

[noelroyf]

We attempted to achieve gaiax compliance by using the EDC Connector. We received the Gaia-X VCs from the Compliance service but are unable to add them to the Identity Hub for the following reasons.

Identity Hub Version : 0.3.1
DID document : https://mvd.noelroy.xyz/company1/did.json
Compliance VC – json : https://mvd.noelroy.xyz/company1/compliance.json
Compliance VC – vc+jwt : https://mvd.noelroy.xyz/company1/compliance-jwt.txt

1. Gaia-X provides a verifiable presentation that includes three VCs. The identity hub does not have an endpoint that accepts VPs. Are we supposed to add the three VCs separately to the IdentityHub?

2. The IdentityHub and Registration Service Cli tools do not support RSA keys.

3. The JWT verification logic fails if the claim's subject is not the parent Connector DID. Is this the proper functionality? The GaiaX Compliance service creates VCs with the VC id as the credential subject. Please find the attached error log. GaiaX-VC Issue.txt

4. An alternative approach appears to be to host the VC in json format using the ‘Self description’ URL provided by Identity Hub and write custom logic to check the federation membership. Is this how EDC intents to handle Gaia-X VCs.?

[paullatzelsperger]

Hello @noelroyf

ad 1. IdentityHub does not accept VPs because VPs serve only to present a VC to a verifier, not to issue it. Attempting to use a VP for VC issuance sounds like a misuse. Note that VC Issuance is not yet implemented in IdentityHub.

ad 2. If you are still using the Registration Service CLI, then you definitely are using a vastly outdated version of either MVD, IdentityHub or both. It was discontinued. I recommend checking out the latest main branch of MVD and IdentityHub.

ad 3. IdentityHub does not perform VC validation. Not sure what you mean.

ad 4. Gaia-X VC should be treated no different than any other VC. But again, IDentityHub does not perform VC verification/validation. This happens in the connector side, and if VCs fulfill all requirements w.r.t. cryptographic and structural integrity, they are accepted.

I think you are using the old (DWN-based) variant of IdentityHub, which is outdated and was never intended for anything beyond proof-of-concept use.
IdentityHub has been completely rewritten and is now based on the Decentralized Claims Protocol, but it should not be considered production-ready at the time of this writing.

[noelroyf]

Thank you for your reply; we were using version 0.3.1, which was also used in the MinimumViableDataspace a while ago. We didn't realize it was updated for the newer version of EDC.