Attesto.Federation.TrustChain (Attesto v1.8.0)

Copy Markdown View Source

Validate an already-resolved OpenID Federation 1.0 Trust Chain.

The input is ordered leaf first: the leaf Entity Configuration followed by Subordinate Statements issued successively toward the Trust Anchor. The final statement is verified with the Trust Anchor keys supplied out of band. Fetching Entity Statements and choosing among candidate chains remain host responsibilities.

Summary

Types

result()
validation_error()

Functions

validate(chain, trust_anchor_jwks, opts \\ [])

Validate signatures, statement links, time bounds, constraints, and policy.

Types

result()

@type result() :: %{metadata: map(), trust_anchor: String.t(), exp: non_neg_integer()}

validation_error()

@type validation_error() ::
  Attesto.Federation.EntityStatement.verify_error()
  | :invalid_trust_chain
  | :broken_trust_chain
  | :constraint_violation
  | :policy_error

Functions

validate(chain, trust_anchor_jwks, opts \\ [])

@spec validate([String.t()], map() | [map()], keyword()) ::
  {:ok, result()} | {:error, validation_error()}

Validate signatures, statement links, time bounds, constraints, and policy.

:now, :leeway, and :accepted_algs are passed to Entity Statement verification. :trust_anchor optionally pins the expected Trust Anchor Entity Identifier in addition to the out-of-band key pin.