Skip to main content

1.3.1.5

Participant onboarding: Certification - Identity and credentials issuance

Coverage: Assess the coverage of a minimally viable credential lifecycle is supported: request (credentials), issuance, validation, renewal, revocation.

note

The description of Test 1.3.1.5 was extracted from this page in the GitHub repository.
This file was last modified at 2026-06-24 15:37:50 UTC.

Information​

  • Phase 1

  • Minimal? Yes

  • Related KPIs:

    • Security: [Integrity] The credential issuance/verification services implements the minimum viable controls to manage the issuance and renewal/revoking of credentials and certificates.

  • Evaluation Criteria:

To calculate an overall score from the list of criteria, you can use the average of the individual scores for each VC Lifecycle Stage. Here is the updated table with a formula for calculating the overall score:

VC Lifecycle StageCoverageScore (0-4)
Issuance and Storage
Presentation
Verification & Use
Revocation/Expiration
Renewal/Re-Issuance

Formula to Calculate Overall Score:

Overall Score = (Score_Issuance + Score_Presentation + Score_Verification + Score_Revocation + Score_Renewal) / 5

Results​

note

The results for Test 1.3.1.5 for Fiware were extracted from this page in the GitHub repository.
This file was last modified at 2026-06-24 15:37:50 UTC.

Environment​

The test is conducted in the IONOS FIWARE_cluster cluster using node pool IP 85.215.161.198.

Tested quality metric and method​

The test quality is based on the metric defined in iso27001_kpis_subkpis.xlsx. For the current phase (phase 1), the test focuses on the Functional Suitability quality metric.

Expected output​

The expected output of the test is an assessment of whether the FIWARE connector supports the full credential lifecycle, including request, issuance, validation, renewal, and revocation.

Results​

Assessment​

Verifiable Credential Issuance

  1. The access token is created accessing keycloak test realm portal using the following command:
export ACCESS_TOKEN=$(curl --insecure -v -X POST https://keycloak.demo-portal.eu/realms/test-realm/protocol/openid-connect/token  \
      --header 'Accept: */*' \
      --header 'Content-Type: application/x-www-form-urlencoded' \
      --data grant_type=password \
      --data client_id=admin-cli \
      --data username=admin-user \
      --data password=test | jq '.access_token' -r); echo ${ACCESS_TOKEN}
  1. Check credential_configuration_id from Keycloak credential issuer info endpoint
curl --insecure -v -X GET https://keycloak.demo-portal.eu/realms/test-realm/.well-known/openid-credential-issuer
  1. Get offer uri
export OFFER_URI=$(curl --insecure -s -X GET 'https://keycloak.demo-portal.eu/realms/test-realm/protocol/oid4vc/credential-offer-uri?credential_configuration_id=natural-person' \
      --header "Authorization: Bearer ${ACCESS_TOKEN}" | jq '"\(.issuer)\(.nonce)"' -r); echo ${OFFER_URI}
  1. Get Pre_authorized_code
export PRE_AUTHORIZED_CODE=$(curl --insecure -s -X GET ${OFFER_URI} \
            --header "Authorization: Bearer ${ACCESS_TOKEN}" | jq '.grants."urn:ietf:params:oauth:grant-type:pre-authorized_code"."pre-authorized_code"' -r); echo ${PRE_AUTHORIZED_CODE}
  1. Get Credential_access_token
export CREDENTIAL_ACCESS_TOKEN=$(curl --insecure -s -X POST https://keycloak.demo-portal.eu/realms/test-realm/protocol/openid-connect/token \
      --header 'Accept: */*' \
      --header 'Content-Type: application/x-www-form-urlencoded' \
      --data grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code \
      --data code=${PRE_AUTHORIZED_CODE} | jq '.access_token' -r); echo ${CREDENTIAL_ACCESS_TOKEN}

Request Verifiable Credential 6) Get Verifiable Credential

export VERIFIABLE_CREDENTIAL=$(curl --insecure -s -X POST https://keycloak.demo-portal.eu/realms/test-realm/protocol/oid4vc/credential \
      --header 'Accept: */*' \
      --header 'Content-Type: application/json' \
      --header "Authorization: Bearer ${CREDENTIAL_ACCESS_TOKEN}" \
      --data '{"credential_identifier":"natural-person", "format":"jwt_vc"}' | jq '.credential' -r); echo ${VERIFIABLE_CREDENTIAL}

Verify Credentials

Credential verification is done using the Verifiert component. For more information consult: https://github.com/FIWARE/VCVerifier?tab=readme-ov-file#overview

Revoke Credentials User revocation is not available. However, since the vcverifier does check the existence of a participant in the TIR. Participants could be deleted from the TIR and then the access would be revoked.

Measured results​

The VC lifecycle is partially covered by the FIWARE connector as follows:

VC Lifecycle StageCoverageScore (0-4)
Issuance and StorageCovered4
PresentationCovered4
Verification & UseCovered4
Revocation/ExpirationNot fully covered. API does not support it, but participants can be deleted to stop access.2
Renewal/Re-IssuanceNot covered, but participants can be created and deleted.1

Overall Calculation: (4+4+4+2+1)/5 = 3

Functional Suitability Quality Metric Score: 3