❗ Important! Before you proceed, please read the EUDI Wallet Reference Implementation project description
This repository contains the implementation of a Wallet Tester Web Service for the Wallet-Driven release of the remote Qualified Electronic Signature (rQES) component.
This service relies on a QTSP Service, defined in this GitHub repository and an external SCA component, defined in this GitHub repository.
Currently, the service is running at https://walletcentric.signer.eudiw.dev, but you can deploy it in your environment.
The released software is an initial development release version:
- The initial development release is an early endeavor reflecting the efforts of a short timeboxed period, and by no means can be considered as the final product.
- The initial development release may be changed substantially over time, might introduce new features but also may change or remove existing ones, potentially breaking compatibility with your existing code.
- The initial development release is limited in functional scope.
- The initial development release may contain errors or design flaws and other problems that could cause system or other failures and data loss.
- The initial development release has reduced security, privacy, availability, and reliability standards relative to future releases. This could make the software slower, less reliable, or more vulnerable to attacks than mature software.
- The initial development release is not yet comprehensively documented.
- Users of the software must perform sufficient engineering and additional testing in order to properly evaluate their application and determine whether any of the open-sourced components is suitable for use in that application.
- We strongly recommend not putting this version of the software into production use.
- Only the latest version of the software will be supported
sequenceDiagram
title Service (QTSP) Authentication
actor U as UserAgent
participant EW as EUDI Wallet
participant AS as Authorization Server (QTSP)
participant OIDV as OID4VP Verifier
U->>+EW: Selects QTSP to use
EW->>+AS: GET /oauth2/authorize?...&redirect_uri=wallet://oauth2/callback&...
opt is not authenticated
AS->>+OIDV: Authorization Request (Post dev.verifier-backend.eudiw.dev/ui/presentations?redirect_uri={oid4vp_redirect_uri})
OIDV->>-AS: Authorization Request returns
AS->>+AS: Generate link to Wallet
AS->>-EW: Redirect to link in the Wallet
EW->>-U: Request Authorization
U->>+EW: Authorize (Shares PID)
EW->>+AS: GET oid4vp_redirect_uri
AS->>+OIDV: Get VP Token
OIDV->>-AS: Send VP Token
AS->>+AS: Validate VP Token
AS->>+EW: Returns session token (successful authentication) & Redirects to /oauth2/authorize
EW->>+AS: GET /oauth2/authorize?...&redirect_uri=wallet://oauth2/callback&... [Cookie JSession]
end
AS->>+EW: Redirect to wallet://oauth2/callback?code={code}
EW->>+EW: GET wallet://oauth2/callback?code={code}
EW->>+AS: /oauth2/token?code={code}
AS->>+AS: Generate Access Token
AS->>+EW: Return Access Token
sequenceDiagram
title Credential Listing
actor U as UserAgent
participant SCC as Signature Creation Component (EUDIW)
participant RS as Resource Server (QTSP)
U->>+SCC: Request list of available credentials
SCC->>+RS: /credentials/list
opt credential list is empty
RS->>+RS: issue credentials
end
RS->>-SCC: List of the credentials of the user
SCC->>-U: Present the list of credentials
opt is a single credential info requested
U->>+SCC: Request the information of a single credential
SCC->>+RS: /credentials/info
RS->>-SCC: credential's information
SCC->>-U: Present the credential's information
end
sequenceDiagram
title Document Signing
actor U as UserAgent
participant EW as EUDI Wallet
participant SCA as Signature Creation Application
participant AS as Authorization Server (QTSP)
participant RS as Resource Server (QTSP)
participant OIDV as OID4VP Verifier
U->>+EW: Chooses credential to use
U->>+EW: Request document signing
EW->>+RS: /csc/v2/credentials/info
RS->>-EW: credentials info
EW->>+SCA: "calculate hash" (certificates, document to sign)
SCA->>-EW: hash value
EW->>+AS: /oauth2/authorize?...&redirect_uri=wallet://login/oauth2/code&...
AS->>+OIDV: Authorization Request (Post dev.verifier-backend.eudiw.dev/ui/presentations?redirect_uri={oid4vp_redirect_uri})
OIDV->>-AS: Authorization Request returns
AS->>+AS: Generate link to Wallet
AS->>-EW: Redirect to link in the Wallet
EW->>-U: Request Authorization
U->>+EW: Authorize (Shares PID)
EW->>+AS: Redirect to oid4vp_redirect_uri
AS->>+OIDV: Request VP Token
OIDV->>-AS: Get and validate VP Token
AS->>-EW: Returns session token (successful authentication) & Redirects to /oauth2/authorize
EW->>+AS: GET /oauth2/authorize?...&redirect_uri=wallet://oauth2/callback&... [Cookie JSession]
AS->>-EW: Redirect to wallet://login/oauth2/code?code={code}
EW->>+EW: Get wallet://login/oauth2/code....
EW->>+AS: /oauth2/token?code={code}
AS->>-EW: access token authorizing credentials use (SAD/R)
EW->>+RS: /signatures/signHash
RS->>-EW: signature
EW->>+SCA: "obtain signed document" (certificates & document & signature value)
SCA->>-EW: signed document
- Python v3.10 or higher
- Flask v2.3 or higher
Click here for detailed installation instructions.
We welcome contributions to this project. To ensure that the process is smooth for everyone involved, follow the guidelines found in CONTRIBUTING.md.
See licenses.md for details.
Copyright (c) 2024 European Commission
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.