[leifj]

Summary

Refs #203. Implements the first-implementation scope of #203: an optional verifier_ids member in the AuthZEN evaluation response context, so a wallet that answers a circuit_zk request with the pseudonym function gets a verified identifier string for the relying party without parsing certificates, resolving DIDs or walking federation chains.

"verifier_ids": [
  {"verifier_id_type": "semantic", "verifier_id": "semantic_id:VATSE-556000000101", "basis": "x5c-chain"},
  {"verifier_id_type": "dns", "verifier_id": "rp.example.com", "basis": "client-id-binding"}
]

• Off by default. Enabled per policy: constraints.return_verifier_ids: [semantic, dns]. Existing responses and tests are unchanged. Unknown (and deferred) type names are rejected at config load (Config.Validate) and again when the policy is installed.
• Request hint. The optional request context.verifier_id_type narrows the response to one type. It only narrows: return_verifier_ids is a server-side policy control and is stripped from client context like the other controls; the hint is added to the client-suppliable allowlist.
• Types: semantic (access certificate only), dns / uri (after VerifyLeafBinding), did (didweb, didwebvh, didjwks, generic did; resolved + key matched), oidf_entity (validated chain + key matched).
• authzenclient exposes it through authzen.EvaluationResponseContext.VerifierIDs; a test-server DecisionFunc can set it (round-trip test over HTTP).
• Docs: swagger, docs/CONFIGURATION.md (regenerated), README section, example/config.yaml.

Rules, as implemented

1. Fail closed. Nothing is emitted for a deny, when the matched profile's validation failed (normally only a warning, so it is checked explicitly), or when the identifier is not verified. dns/uri re-run VerifyLeafBinding inside the enrichment (so correctness does not depend on the calling registry having done it); an unverified client_id is never echoed; wildcard client_ids are not identifiers. DID/OIDF entries are added only on the key-bound allow path (not resolution-only), and only when the resolved document id / chain leaf subject equals the requested identifier.
2. Canonicalised once, in the PDP. dns: ASCII lower case, no trailing dot. uri: byte-for-byte (the match is already exact; nothing goes through net/url). did: fragment dropped, nothing else (path part is case-sensitive). oidf_entity: byte-for-byte as in the chain. semantic: semantic_id: + value verbatim.
3. semantic is validated against ^[A-Z]{3}[A-Z]{2}-<value>$ (EN 319 412-1 5.1.3) and its type must fit the subject.

Finding: natural-person classification in wrpac.go (narrow fix)

WRPACProfile.ExtractIdentity read organizationIdentifier with a serialNumber fallback and called the certificate a legal person whenever Organization was set. For a natural-person certificate (NCP-n / QCP-n, ETSI TS 119 475 5.1.5) the semantic identifier legitimately lives in serialNumber (e.g. PNOSE-...), so it was relabelled organization_identifier, and a natural person with an affiliated organisation was classified legal_person. Fixed narrowly: when the WRPAC policy OIDs say natural person, serialNumber is not treated as an organisation identifier and the type is natural_person; behaviour is unchanged for legal-person and policy-less certificates. New rpcert.SemanticIdentifier encodes where the value lives per subject kind: legal person reads 2.5.4.97 (serialNumber fallback for legacy certs and fixtures, and an invalid 2.5.4.97 is not papered over by falling back), natural person reads serialNumber only. Natural-person types (PNO IDC PAS TAX TIN) are refused for legal-person certificates and vice versa. A serialNumber that is not a semantic identifier is never emitted.

Decisions where the issue was ambiguous

• Policy option lives under constraints (registry-agnostic: it covers x5c, DID and OIDF), not etsi.
• Intermediary requests: semantic is taken from the RP leaf (the request's x5c is the end RP's; the intermediary chain is unvalidated and never read). dns/uri are omitted because the client_id of a brokered request cannot be shown to name the end RP.
• A type with no entry for a given response is simply absent; did_scid, service, spki_sha256 are rejected in config until implemented, so a typo cannot be mistaken for a deferred type that silently returns nothing.
• Aggregating strategies (all) and composite registries build a new response and do not carry the member; first_match and sequential return the registry's own response and do. Documented.
• oidf_entity: extractEntityID trims a trailing / for resolution, so the chain leaf subject is compared with the raw requested identifier instead; a request that names the entity with a trailing slash still resolves but gets no identifier.

Not done / not verified

• Deferred per scope: did_scid, service, spki_sha256. Hence Refs, not Closes.
• Registration certificate is not an input (as per the issue); documented.
• The real round trip through go-wallet-backend (open question in the issue) is not verified here; the Go client/test-server round trip is.
• No didwebvh end-to-end success test (a valid DID log fixture is heavy); the one-line call site is the same helper as the other three DID registries, which are tested.
• Swagger was patched by hand to the new definitions: regenerating with swag pulled in unrelated drift in the committed docs, so only the verifier_ids additions are in the diff.

Tests

New tests for each acceptance item: member present/absent/off; canonical form and basis per type; intermediary; no emission on deny and on failed profile validation; natural-person form and non-semantic serialNumber; hint narrowing (incl. through RegistryManager, and that a client cannot set return_verifier_ids); config rejection; client/test-server round trip. Each was checked to be non-vacuous by breaking the behaviour and confirming the test fails (28 mutations; one, re-serialising a verified URI through net/url, is an equivalent mutant because URISANMatches already compares u.String()). golangci-lint clean; full go test ./... passes with GOEXPERIMENT=jsonv2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VS8tGFQncGyEhFwkQecjPB

[Copilot]

🟡 Changes recommended

Contradictory certificate policies can bypass fail-closed classification, natural-person identity extraction can discard the personal serial, and programmatic policy installation remains unvalidated.

3 open findings

• Reject certificates with contradictory subject policy types · New
• Validate policies during PolicyManager registration · New
• Preserve natural-person serial with affiliated organization ID · New

What changed in this PR

Adds policy-controlled, verified verifier identifiers to AuthZEN evaluation responses.

Changes:

• Adds verifier_ids models, policy configuration, validation, and request narrowing.
• Derives identifiers from verified X.509, DID, and OID Federation material.
• Updates WRPAC semantic-ID handling, tests, examples, and documentation.

File	Description
README.md	Documents verifier identifiers.
pkg/​testserver/​verifierids_test.go	Tests HTTP round-trip behavior.
pkg/​registry/​x5c_enrichment.go	Derives X.509 identifiers.
pkg/​registry/​verifierid.go	Adds shared identifier helpers.
pkg/​registry/​verifierid_test.go	Tests derivation and fail-closed behavior.
pkg/​registry/​verifierid_manager_test.go	Tests policy and hint handling.
pkg/​registry/​rpcert/​wrpac.go	Adjusts natural-person classification.
pkg/​registry/​rpcert/​semanticid.go	Adds semantic-ID parsing and classification.
pkg/​registry/​rpcert/​semanticid_test.go	Tests semantic-ID behavior.
pkg/​registry/​policy.go	Adds verifier-ID policy constraints.
pkg/​registry/​policy_verifierids_test.go	Tests runtime constraint validation.
pkg/​registry/​oidfed/​verifierid_test.go	Tests OIDF identifiers.
pkg/​registry/​oidfed/​oidfed_registry.go	Emits verified OIDF entity IDs.
pkg/​registry/​manager.go	Injects policy and permits request hints.
pkg/​registry/​didwebvh/​didwebvh_registry.go	Emits did:webvh identifiers.
pkg/​registry/​didweb/​verifierid_test.go	Tests did:web identifiers.
pkg/​registry/​didweb/​didweb_registry.go	Emits did:web identifiers.
pkg/​registry/​didjwks/​verifierid_test.go	Tests did:jwks identifiers.
pkg/​registry/​didjwks/​didjwks_registry.go	Emits did:jwks identifiers.
pkg/​registry/​did/​verifierid_test.go	Tests generic DID identifiers.
pkg/​registry/​did/​resolver.go	Emits generic DID identifiers.
pkg/​config/​verifierids_test.go	Tests configuration validation.
pkg/​config/​config.go	Adds verifier-ID configuration.
pkg/​authzen/​verifierids_test.go	Tests response JSON shape.
pkg/​authzen/​types.go	Defines verifier-ID API types.
example/​config.yaml	Adds configuration example.
docs/​swagger/​swagger.yaml	Updates YAML API schema.
docs/​swagger/​swagger.json	Updates JSON API schema.
docs/​swagger/​docs.go	Updates generated Swagger definitions.
docs/​CONFIGURATION.md	Documents the policy setting.
cmd/​gt/​policy_config_test.go	Tests configuration translation.
cmd/​gt/​main.go	Installs verifier-ID policy settings.

Files not reviewed (1)

• docs/swagger/docs.go: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

OIDF normalization can emit an entity identifier that does not exactly match the identifier supplied by the request.

0 open findings

3 resolved since last review

• Reject certificates with contradictory subject policy types
• Preserve natural-person serial with affiliated organization ID
• Validate policies during PolicyManager registration

Files not reviewed (1)

• docs/swagger/docs.go: Generated file

Previously missed (1)

In code that hasn't changed since last review

Compare chain subject with the raw requested identifier

pkg/​registry/​oidfed/​oidfed_registry.go:875

This compares the chain subject with entityID after extractEntityID has stripped trailing slashes, not with the identifier actually named by the request. For example, a request for https://rp.example/ can resolve a chain whose leaf is https://rp.example and emit that identifier even though the documented fail-closed rule requires byte-for-byte equality with the requested identifier. Preserve the raw subject/resource ID for this final equality check; normalization may still be used for resolution.

🧠 Review effort: Balanced

[leifj]

Addressed the finding from the second Copilot review (it was only in the review body, not an inline thread): in dcf6106 the oidf_entity identifier is now compared with the raw requested identifier rather than the slash-stripped one, with a test (TestEvaluate_VerifierIDs_OIDFEntity, trailing-slash case) shown to fail when the old comparison is restored. The same commit splits two functions that Sonar flagged for cognitive complexity.

[Copilot]

🔵 Needs a closer look

Malformed organization identifiers can still incorrectly fall back to serialNumber, violating fail-closed semantics.

0 open findings

Files not reviewed (1)

• docs/swagger/docs.go: Generated file

Previously missed (1)

In code that hasn't changed since last review

Prevent serialNumber fallback for malformed organization identifiers

pkg/​registry/​rpcert/​semanticid.go:122

This still falls back to serialNumber when 2.5.4.97 is present but empty or has a non-string ASN.1 value, because realOrganizationIdentifier returns "" for both malformed and absent attributes. Such values survive x509.ParseCertificate, so a malformed organization identifier can be papered over by a valid semantic ID in serialNumber, contrary to the fail-closed rule. Track attribute presence separately and use the legacy fallback only when 2.5.4.97 is absent.

🧠 Review effort: Balanced

[leifj]

Addressed the finding from the third Copilot review (again review-body only) in the follow-up commit: SemanticIdentifier now tracks whether 2.5.4.97 is present, so an empty or non-string organizationIdentifier is treated as malformed and not papered over by serialNumber (test TestSemanticIdentifier_MalformedOrganizationIdentifierDoesNotFallBack, shown to fail when the old fallback is restored).

[Copilot]

🔵 Needs a closer look

Security-sensitive identity derivation now spans several trust mechanisms and warrants final human validation.

0 open findings

Files not reviewed (1)

• docs/swagger/docs.go: Generated file

Previously missed (1)

In code that hasn't changed since last review

Document best_match VerifierIDs loss in compatibility note

README.md:850

best_match also delegates to evaluateAllWithPolicy, whose newly built response drops VerifierIDs, but this compatibility note names only all. Operators using best_match may therefore expect the member to survive; list it with the non-carrying strategies.

🧠 Review effort: Balanced

[leifj]

Fourth Copilot review (body only): README now lists best_match with the strategies that do not carry verifier_ids (it delegates to the aggregating strategy). Also removed the duplicated http/https literals Sonar flagged (S1192).

[smncd]

Looks good to my eyes now. I've only reviewed:

• The return format, which I think makes sense.
• The not-strict-enough profile handling, which is now fixed.

I've not looked too closely at the code otherwise.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.7% Coverage on New Code
0.4% Duplication on New Code

See analysis details on SonarQube Cloud