certify-default.properties

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.

## -------------------------------------- Authentication & Authorization -----------------------------------------------

mosip.certify.security.auth.post-urls={}
mosip.certify.security.auth.put-urls={}
mosip.certify.security.auth.get-urls={}

mosip.certify.security.ignore-csrf-urls=${server.servlet.path}/actuator/**,${server.servlet.path}/error,\
  ${server.servlet.path}/swagger-ui/**,${server.servlet.path}/v3/api-docs/**,\
  ${server.servlet.path}/issuance/**,**/system-info/**,**/credential-configurations/**,**/.well-known/**,**/credentials/**,**/ledger-search/**

mosip.certify.security.ignore-auth-urls=/actuator/**,**/error,**/swagger-ui/**,\
  **/v3/api-docs/**,**/issuance/**,**/system-info/**,**/rendering-template/**,**/credential-configurations/**,\
  **/.well-known/**,**/credentials/**,**/ledger-search/**

## ------------------------------------------ Discovery openid-configuration -------------------------------------------

mosip.certify.discovery.issuer-id=${mosip.certify.domain.url}${server.servlet.path}

##----- These are reference to the oauth resource server providing jwk----------------------------------##

mosip.certify.authn.filter-urls={ '${server.servlet.path}/issuance/credential', '${server.servlet.path}/issuance/vd11/credential', '${server.servlet.path}/issuance/vd12/credential' }

mosip.certify.cnonce-expire-seconds=40

# Change this if certify is used with different OAUTH2.0 server
mosip.certify.authn.issuer-uri=${mosip.certify.authorization.url}/v1/esignet
mosip.certify.authn.jwk-set-uri=${mosip.certify.authorization.url}/v1/esignet/oauth/.well-known/jwks.json

mosip.certify.authn.allowed-audiences={ '${mosip.certify.domain.url}${server.servlet.path}/issuance/credential', '${mosip.certify.authorization.url}/v1/esignet/vci/credential' }

mosip.certify.supported.jwt-proof-alg={'RS256','PS256','ES256','ES256K', 'Ed25519'}
# Other supported values are "Ed25519Signature2018" and "RsaSignature2018"
mosip.certify.data-provider-plugin.issuer.vc-sign-algo=Ed25519Signature2020

#------------------------------------ Key-manager specific properties --------------------------------------------------
#Crypto asymmetric algorithm name
mosip.kernel.crypto.asymmetric-algorithm-name=RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING
#Crypto symmetric algorithm name
mosip.kernel.crypto.symmetric-algorithm-name=AES/GCM/NoPadding
#Keygenerator asymmetric algorithm name
mosip.kernel.keygenerator.asymmetric-algorithm-name=RSA
#Keygenerator symmetric algorithm name
mosip.kernel.keygenerator.symmetric-algorithm-name=AES
#Asymmetric algorithm key length
mosip.kernel.keygenerator.asymmetric-key-length=2048
#Symmetric algorithm key length
mosip.kernel.keygenerator.symmetric-key-length=256
#Encrypted data and encrypted symmetric key separator
mosip.kernel.data-key-splitter=#KEY_SPLITTER#
#GCM tag length
mosip.kernel.crypto.gcm-tag-length=128
#Hash algo name
mosip.kernel.crypto.hash-algorithm-name=PBKDF2WithHmacSHA512
#Symmtric key length used in hash
mosip.kernel.crypto.hash-symmetric-key-length=256
#No of iterations in hash
mosip.kernel.crypto.hash-iteration=100000
#Sign algo name
mosip.kernel.crypto.sign-algorithm-name=RS256
#Certificate Sign algo name
mosip.kernel.certificate.sign.algorithm=SHA256withRSA

mosip.certify.cache.security.secretkey.reference-id=TRANSACTION_CACHE

#mosip.kernel.keymanager.hsm.config-path=local.p12
#mosip.kernel.keymanager.hsm.keystore-type=PKCS12
#mosip.kernel.keymanager.hsm.keystore-pass=${softhsm.idp.pin}

#Type of keystore, Supported Types: PKCS11, PKCS12, Offline, JCE
mosip.kernel.keymanager.hsm.keystore-type=PKCS11
# For PKCS11 provide Path of config file.
# For PKCS12 keystore type provide the p12/pfx file path. P12 file will be created internally so provide only file path & file name.
# For Offline & JCE property can be left blank, specified value will be ignored.
mosip.kernel.keymanager.hsm.config-path=/config/softhsm-application.conf
# Passkey of keystore for PKCS11, PKCS12
# For Offline & JCE proer can be left blank. JCE password use other JCE specific properties.
mosip.kernel.keymanager.hsm.keystore-pass=${softhsm.certify.security.pin}


mosip.kernel.keymanager.certificate.default.common-name=www.example.com
mosip.kernel.keymanager.certificate.default.organizational-unit=EXAMPLE-CENTER
mosip.kernel.keymanager.certificate.default.organization=IIITB
mosip.kernel.keymanager.certificate.default.location=BANGALORE
mosip.kernel.keymanager.certificate.default.state=KA
mosip.kernel.keymanager.certificate.default.country=IN

mosip.kernel.keymanager.softhsm.certificate.common-name=www.example.com
mosip.kernel.keymanager.softhsm.certificate.organizational-unit=Example Unit
mosip.kernel.keymanager.softhsm.certificate.organization=IIITB
mosip.kernel.keymanager.softhsm.certificate.country=IN

# Application Id for PMS master key.
mosip.kernel.partner.sign.masterkey.application.id=PMS
mosip.kernel.partner.allowed.domains=DEVICE

mosip.kernel.keymanager-service-validate-url=https://${mosip.hostname}/keymanager/validate
mosip.kernel.keymanager.jwtsign.validate.json=false
mosip.keymanager.dao.enabled=false
crypto.PrependThumbprint.enable=true

mosip.kernel.keymgr.hsm.health.check.enabled=true
mosip.kernel.keymgr.hsm.health.key.app-id=CERTIFY_SERVICE
mosip.kernel.keymgr.hsm.healthkey.ref-id=TRANSACTION_CACHE
mosip.kernel.keymgr.hsm.health.check.encrypt=true

# Set the keymanager prepend property to prepend specified value to the kid.
# Supported Values: {'#', '<DOMAIN_NAME>#', 'PAYLOAD_ISSUER'}
mosip.kernel.keymanager.signature.kid.prepend=PAYLOAD_ISSUER

##----------------------------------------- Database properties --------------------------------------------------------

mosip.certify.database.hostname=postgres-postgresql.postgres
mosip.certify.database.port=5432
spring.datasource.url=jdbc:postgresql://${mosip.certify.database.hostname}:${mosip.certify.database.port}/${mosip.certify.database.name}?currentSchema=certify
spring.datasource.username=certifyuser
spring.datasource.password=${db.dbuser.password}

spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
spring.jpa.show-sql=false
spring.jpa.hibernate.ddl-auto=none
spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation=true

## ---------------------------------------- Cache configuration --------------------------------------------------------
spring.cache.type=redis
spring.cache.cache-names=${mosip.certify.cache.names}
spring.data.redis.host=${mosip.redis.host}
spring.data.redis.port=6379
management.health.redis.enabled=false
spring.data.redis.password=${redis.password}

mosip.certify.access-token-expire-seconds=86400

mosip.certify.cache.names=userinfo,templatecache,credentialConfig,certificatedatacache
# Cache size setup is applicable only for 'simple' cache type. 
# Cache size configuration will not be considered with 'Redis' cache type

# going with a modest size for templatecache considering no multi-tenancy -- useful for DataProvider plugins
mosip.certify.cache.size={'userinfo': 200, 'templatecache': 20 }

# cache duration set to half-hour, templatecache is used to cache Velocity Templates for caching of VCI templates
mosip.certify.templatecache-expire-seconds=1800
mosip.certify.certificatedatacache-expire-seconds=3600

# Cache expire in seconds is applicable for both 'simple' and 'Redis' cache type
mosip.certify.cache.expire-in-seconds={'userinfo': ${mosip.certify.access-token-expire-seconds}, 'certificatedatacache': ${mosip.certify.certificatedatacache-expire-seconds} }

#------------------------------------ Plugin-usecase override properties ------------------------------------------------

mosip.certify.domain.url=
mosip.certify.key-values={}
mosip.certify.database.name=inji_certify
mosip.certify.authorization.url=
# To specify whether plugin or certify should issue a VC. Supported values are "VCIssuance" and "DataProvider"
mosip.certify.plugin-mode=
# This has to be an empty value iff no svg template is configured for VCI templating
mosip.certify.data-provider-plugin.rendering-template-id=
# Used by Certify issuer to add proofMethod & issuer details to the VC
mosip.certify.data-provider-plugin.did-url=
# Workaround for adding id field for certify issuers to fix verification issue
# Ref: Mimoto -- INJIMOB-2446
mosip.certify.data-provider-plugin.id-field-prefix-uri=
mosip.certify.data-provider-plugin.credential-status.supported-purposes={'revocation','suspension'}

#------------------------------------ Credential Config API Default Values ----------------------------------------------
mosip.certify.credential-config.cryptographic-binding-methods-supported={\
  'ldp_vc': {'did:jwk','did:key'},\
  'mso_mdoc': {'cose_key'},\
  'vc+sd-jwt': {'did:jwk','did:key'}\
}
mosip.certify.credential-config.credential-signing-alg-values-supported={\
  'RsaSignature2018': {'RS256'},\
  'Ed25519Signature2018': {'EdDSA'},\
  'Ed25519Signature2020': {'EdDSA'},\
  'EcdsaKoblitzSignature2016': {'ES256K'},\
  'EcdsaSecp256k1Signature2019': {'ES256K'},\
  'EcdsaSecp256r1Signature2019': {'ES256'},\
  'ecdsa-rdfc-2019': {'ES256'},\
  'ecdsa-jcs-2019': {'ES256'},\
  'eddsa-rdfc-2022': {'EdDSA'},\
  'eddsa-jcs-2022': {'EdDSA'}\
}
mosip.certify.credential-config.proof-types-supported={\
  'jwt': {'proof_signing_alg_values_supported': {'RS256', 'PS256', 'ES256', 'Ed25519'}}\
}