kych

OAuth 2.0 API for Swiyu to enable Taler integration of Swiyu for KYC (experimental)
Log | Files | Refs | Submodules | README | LICENSE

00-kych-defaults.conf (2980B)

      1 ####################################################################
      2 #  Default configuration of the KyCH OAuth 2.0 gateway.
      3 #
      4 #  This file is part of the "kych" package and is read before
      5 #  /etc/kych/kych.conf on every start.  Do not edit it: an upgrade
      6 #  replaces it without asking.  Everything in it can be overridden
      7 #  by setting the same option in /etc/kych/kych.conf, which is read
      8 #  afterwards and therefore wins.
      9 #
     10 #  See kych.conf(5) for what each option means.
     11 ####################################################################
     12 
     13 [kych-oauth2-gateway]
     14 
     15 # Plain HTTP on a Unix socket, for a reverse proxy to pass requests
     16 # to; kych.service creates /run/kych for it and runs the daemon as
     17 # user kych with group www-data, so that a proxy running as www-data
     18 # can reach the socket at 0660.
     19 SERVE = unix
     20 UNIXPATH = /run/kych/kych.sock
     21 UNIXPATH_MODE = 660
     22 
     23 # Connects over the local socket and authenticates as the operating
     24 # system user the daemon runs as (kych), which is what "peer"
     25 # authentication in a stock Debian PostgreSQL expects -- so no
     26 # password is stored anywhere.  kych-dbconfig(1) creates a role and a
     27 # database to match.
     28 #
     29 # "?host=" with a path is what selects a Unix socket directory; the
     30 # port, though, is only read from the authority part, so a server on
     31 # another port needs
     32 #     postgres://localhost:5433/kych?host=/var/run/postgresql
     33 # See kych.conf(5).
     34 DATABASE = postgres:///kych?host=/var/run/postgresql
     35 
     36 # Where kych-dbinit(1) looks for versioning.sql and the oauth2gw-*.sql
     37 # patch files.  $DATADIR is /usr/share/kych for this package.
     38 SQL_DIR = $DATADIR/sql
     39 
     40 # Bytes of raw randomness behind the /authorize nonce, the access
     41 # tokens and the authorization codes; 32 bytes (256 bits) is the
     42 # recommended value for all three.
     43 NONCE_BYTES = 32
     44 TOKEN_BYTES = 32
     45 AUTH_CODE_BYTES = 32
     46 
     47 # How long an authorization code stays redeemable at /token, in
     48 # minutes.  It is consumed on first use in any case.
     49 AUTH_CODE_TTL_MINUTES = 10
     50 
     51 # The credential KyCH asks the SWIYU verifier for.  These are the
     52 # values of the Swiss e-ID beta credential; they must match what the
     53 # issuer actually issues, and are published to clients on /config.
     54 VC_TYPE = betaid-sdjwt
     55 
     56 # dc+sd-jwt is the canonical SD-JWT VC media type; the verifier also
     57 # still accepts the older vc+sd-jwt.
     58 VC_FORMAT = dc+sd-jwt
     59 
     60 # Advertised to clients on /config.  DCQL has no place for them in the
     61 # credential query, so they are not sent to the verifier.
     62 VC_ALGORITHMS = {ES256}
     63 
     64 # Every claim that exists in the credential type above.  A client may
     65 # only request claims from this set.
     66 VC_CLAIMS = {family_name, given_name, birth_date, sex, place_of_origin, birth_place, nationality, portrait, personal_administrative_number, age_over_16, age_over_18, age_over_65, age_birth_year, document_number, issuance_date, expiry_date, additional_person_info, reference_id_type, reference_id_expiry_date, verification_type, verification_organization, issuing_authority, issuing_country}