Credential Subject ID Mismatch in Validation Rule with Gaia-X Format (Eclipse MVD)

[Zhipeng-lin1]

Hi,

I'm encountering an issue in Eclipse MVD with a validation rule that checks whether the credentialSubject.id matches an expectedSubjectId, in HasValidSubjectIds.java of Connector project. Typically, I've seen the credentialSubject.id follow a format like:
did:web:example.com:participant

However, the credentials being sent for validation are using the Gaia-X format, where the credentialSubject.id looks more like a URL, such as:

https://example.com/credential/<id>

This causes the validation to fail due to a mismatch with the expectedSubjectId.

My questions are:

• Is there any documentation or guidance on how to handle this mismatch within Eclipse MVD?
• Should the validation logic support different ID formats, or is there a recommended way to transform or align the subject ID with expectations?

Any help or pointers would be greatly appreciated!

Thanks in advance.

[paullatzelsperger]

the HasValidSubjectIds rule asserts, that the credentialSubject.id property is equal to the VP holder. This assertion is not specific to EDC, in fact, it is the only way to assert that a VerifiableCredential was indeed issued to the holder of a VP.

In other words, it asserts, that whoever presents the VP, actually "owns" the credential.

Otherwise, what is stopping me from stealing a VC from you, and including it in my VP?

As per the Verifiable Credential Spec (1.1 and 2.0), identifiers must be URIs, which DIDs are. The DCP Specification specifically requires the use of DIDs as identifiers (not web urls), and the implementation in EDC is compliant with DCP.

Using web urls as credentialSubject.id would be possible, if there is some other mechanism establish a relationship from vp.holder <-> vc.credentialSubject.id. That would not be compliant with DCP.

So if you want to use Gaia-X credentials for DCP, they have to be compliant with the DCP specification.

To answer your questions

• there is no mismatch, only a violation of the DCP spec.
• no, it should not, because the current format (DIDs) is what DCP requires.

Amendment 1

if you want to support holder-IDs, that are not identical to credentialSubject IDs, then you will have to plug in your own implementation of the IdentityService and provide a relation from holderId -> credentialSubject.id yourself. Mind you, both have to be DIDs, so web URLs are not allowed. While DCP allows that, I do not recommend that, as it is a potential security weakness. The MVD implements the default/recommended behavior and will not support this.