IATP: extend configuration for multiple trusted issuers

[paullatzelsperger]

WHAT

Currently, a connector can only have one "allowed issuer", i.e. it can only accept credentials created by one entity. In preparation for adopting the Identity And Trust Protocols (IATP), we need to extend this to allow multiple issuers.

WHY

Ultimately, we will have multiple issuers (~operating companies), so we need to prepare for that.

HOW

There are two general ways to approach this:

1. add the allowed issuers via configuration: this is how we do it currently (with one issuer), and it's by far the easiest way.
2. download a list of allowed issuers: this raises the difficult question of how the authenticity and integrity of such a list can be verified, and as of now, there is no agreed-upon way of doing that. It may come at a later point in time.

We will go with approach 1 for now.

Specifically, this means that the SsiCredentialIssuerValidationRule now has to be able to deal with a List<String> instead of a String. Configuration-wise, it should just be a comma-separated list.

FURTHER NOTES

• issuer-IDs are in practice DID's

Please be sure to take a look at
our contribution guidelines and
our PR etiquette.

[paullatzelsperger]

@matgnt FYI

[paullatzelsperger]

related upstream EDC: eclipse-edc/Connector#3531

[matgnt]

Thanks!
I guess you know, but just in case, it seems we need to do this for both settings:

tx.ssi.miw.authority.id=BPNLissuer
tx.ssi.miw.authority.issuer=did:web:dev%3A9000:BPNLissuer

[wolf4ood]

This will be moved into the upstream implementation

eclipse-edc/Connector#3602