AAuth at aauth.boxlab.site

These are public AAuth servers you can call, and conformance reports for the servers on this host. The Rust servers are aauth-rust 0.1.0-alpha.28. The Go servers are aauth-go ad34a9a. The suite is aauth-conformance f415f2f, in remote mode.

Get an exchange

With an agent key of your own, the exchange is the six calls below. The Person Server binds every accepted person to the subject directed-person-1 and grants only the scope read. A person token lasts 60 seconds. An auth token lasts 180 seconds. An agent token from the provider below lasts 3600 seconds.

1. Enroll the durable key at the Agent Provider.
2. Refresh it into an agent token. The token’s ps is https://ps.aauth.boxlab.site.
3. POST https://ps.aauth.boxlab.site/person, signed by that agent token, with {"resource":"https://rs.aauth.boxlab.site"}. The answer is 200 and a person_token.
4. GET https://rs.aauth.boxlab.site/records with the person token. The resource answers 401 and AAuth-Requirement: requirement=auth-token;resource-token="…".
5. POST https://ps.aauth.boxlab.site/token, signed by the agent token, with {"resource_token":"…","presented_token":"…"}. presented_token is the person token from step 3, and resource_token is the value from step 4. The answer is 200 and an auth_token.
6. GET https://rs.aauth.boxlab.site/records with that auth token. The answer is 200 {"sub":"directed-person-1"}.

Agent Provider

https://ap.aauth.boxlab.site

Metadata is GET /.well-known/aauth-agent.json. Keys are GET /.well-known/jwks.json.

POST /bootstrap/enroll is signed with the HTTP signature label sig, scheme hwk, by the durable key (Ed25519 or ES256). Cover @method, @authority, @path and signature-key. The body is a JSON object, application/json; {} is enough. Cover content-type and content-digest as well. created has to be within 60 seconds of this server’s clock. A new key is answered 201 {"agent":"aauth:<local>@ap.aauth.boxlab.site"}. The local part is the key’s thumbprint, so the same key gets the same identifier.

POST /bootstrap/refresh uses scheme jkt-jwt and is answered 200 {"agent_token":"…"}. This provider does not offer single-key refresh or sub-agent tokens.

Enrollments are kept in memory. After the provider restarts, enroll the key again. The signing key does not change across that restart, and the identifier does not change.

Person Server

https://ps.aauth.boxlab.site is a direct Person Server. Metadata is /.well-known/aauth-person.json. POST /person issues the person token. POST /token issues the auth token. Any scope other than read is refused.

Resource

https://rs.aauth.boxlab.site is a three-party resource. The protected route is GET /records. It trusts the Agent Provider and the Person Server on this page. A token from the four-party Access Server does not open it.

Servers

Rust reference roles, one process, plus the two public hosts above.

GET https://api.aauth.boxlab.site/whoami answers 200 {"sub":"<agent identifier>"} for a verified agent. It trusts the bootstrap provider above and the suite’s fixture provider. It is not the resource in the exchange: a direct person-server token is for rs, and a four-party token is for records.

The Go servers are the same roles with go- in front of the host name: https://go-ps.aauth.boxlab.site, https://go-as.aauth.boxlab.site, https://go-fps.aauth.boxlab.site, https://go-api.aauth.boxlab.site/whoami, https://go-records.aauth.boxlab.site/records, https://go-eap.aauth.boxlab.site, https://go-events.aauth.boxlab.site/events/subscribe, https://go-ss.aauth.boxlab.site, https://go-sps.aauth.boxlab.site, https://go-r3.aauth.boxlab.site/authorize, https://go-r3-direct.aauth.boxlab.site/authorize, https://go-r3-person.aauth.boxlab.site, https://go-verifier.aauth.boxlab.site/verify. Go also serves the four-party R3 issuer at https://go-r3-ps.aauth.boxlab.site and https://go-r3-access.aauth.boxlab.site. The Go servers do not trust the public bootstrap provider.

Suite host controls are not published. Names under conformance.test are not public DNS. They are how the suite on this host reaches its own fixture parties.

Discovery fixtures

These files are static fixtures for discovery tests. No specification cites them. The key identifiers signer-ed25519 and signer-ml-dsa-44 stay fixed.

https://discovery.aauth.boxlab.site/.well-known/aauth-resource.json is a metadata document whose jwks_uri is https://discovery.aauth.boxlab.site/jwks.

https://discovery.aauth.boxlab.site/.well-known/example-configuration is the same metadata document under the name example-configuration.

https://discovery.aauth.boxlab.site/jwks holds an Ed25519 key, kid signer-ed25519, and an ML-DSA-44 key, kid signer-ml-dsa-44.

https://discovery.aauth.boxlab.site/jwks-pq-only holds the ML-DSA-44 key signer-ml-dsa-44 alone.

Run the suite against these servers

The grade is a remote-mode run of aauth-conformance. The reports are at /reports/. Each report has report.md, report.json, and this site renders the markdown.

To ask for a fresh grade of these servers, do the steps in the next section and name the roles from the table above.

Have this suite grade your servers

Do these steps. No URL starts a run. Either tracker accepts the request.

1. Sign in to GitLab or to GitHub. Any account can open an issue on either tracker.
2. Open a new issue on gitlab.com/sidecat-dev/aauth-hosted or on github.com/sidecat-dev/aauth-hosted.
3. Write the base URL and the role for each server, in the same terms as the table above. One server on each line.
4. Leave out keys, tokens, logs, and anything else.
5. Submit the issue. The tracker files it when you submit it.

An operator runs the suite, writes the report URL on the issue, and closes the issue. The report is at https://aauth.boxlab.site/reports/<id>/. Those operator steps are RUNS.md in sidecat-dev/aauth-hosted.

To grade a deployment yourself, use remote mode in the conformance README. The deployment file names the same fields the reports use: resource URL, person server, access server, agent provider, supervision server, agent identifier, and control URL where the role has one.

Source

The Caddy config, systemd units, this page, and the public server are in sidecat-dev/aauth-hosted. The README there is how to run a copy and how to operate this one.