Auth subsystem

The auth subsystem handles participant identity and trust verification in the dataLOFT platform. It consists of two services that run as sidecar containers alongside RUN-DSP: Signature-Auth-Handler and HST-DID.

Signature-Auth-Handler

Signature-Auth-Handler is a NestJS service that validates DPoP tokens (RFC 7800) on behalf of RUN-DSP. When a DSP request arrives, RUN-DSP calls Signature-Auth-Handler via gRPC to verify the requester's identity.

The validation process:

1. Check that the DPoP token has not expired.
2. Extract the iss (issuer) field, which must be a did:web URI.
3. Resolve the issuer's DID document.
4. Verify that the token signature matches the public key declared in the DID document.
5. Query FC-Service to confirm that the participant is registered in the catalogue.

If any step fails, Signature-Auth-Handler rejects the request. RUN-DSP does not process it further.

HST-DID

HST-DID is a NestJS service that generates and hosts did:web documents for dataLOFT participants. It derives each DID document from the participant's Let's Encrypt certificate, embedding the certificate's public key as a JsonWebKey2020 verification method with an x5u reference back to the certificate. The document is served at the well-known URL path required by the did:web specification (/.well-known/did.json). The participant uses the corresponding private key to sign verifiable credentials and DPoP tokens.

Reference Authentication Service

The Reference Authentication Service (from the go-dataspace/reference-authn-service repository) is a reference implementation demonstrating the auth hook interface. It does not perform real identity verification and is not used in production deployments. It serves as a starting point for implementing a custom auth handler.

Deployment

Signature-Auth-Handler listens on port 9093. HST-DID listens on port 5000. Both run as sidecars in the RUN-DSP pod.