Subject: [GNAP] Implementation Status

From: Justin Richer <[email-masked]>
Date: Mon, 31 Jan 2022 16:37:21 -0500

Hi everyone,

Ahead of of the IETF 113 Hackathon, we’d like to collect a list of tools that implementors can use for building GNAP. These can either be implementations of GNAP itself (either in whole or some component or subset), or libraries that can be used to implement things needed in GNAP, like HTTP Message Signatures or Subject Identifiers or JOSE. I’ll start off this thread with the tools that I personally know about, and we are asking for everyone else to chime in with their own additions.

GNAP:

- XYZ: A Java implementation (based on Spring) of an AS, RS, and webserver-based client instance. The UX is written in React agains a Spring-based backend API. Supports HTTP Signing and JOSE methods. There was a React-based SPA implementation in there as well but it hasn’t been kept up to date. https://github.com/bspk/oauth.xyz-java <https://github.com/bspk/oauth.xyz-java>

HTTP Signatures:

- Go library (from Yaron Sheffer). https://github.com/yaronf/httpsign <https://github.com/yaronf/httpsign>
- Python implementation behind https://httpsig.org/ <https://httpsig.org/> demo site: https://github.com/bspk/httpsig-org/tree/main/backend
-  Rust library (known to be incomplete — also note this is a branch on a fork): https://github.com/dskyberg/http-signatures/tree/ietf-httpbis-skyberg <https://github.com/dskyberg/http-signatures/tree/ietf-httpbis-skyberg>

HTTP Structured Fields (used with signatures):

- Python: https://pypi.org/project/http-sfv/ <https://pypi.org/project/http-sfv/>
- Java: https://github.com/reschke/structured-fields <https://github.com/reschke/structured-fields>

Subject Identifiers:

- Java: https://github.com/sailpoint-oss/ietf-subject-identifiers-model

JOSE:

I don’t think it’s really worth listing all of the JOSE implementations out there, as there are so many. That said, many that are written as purely JWT libraries don’t like you to provide your own unencoded (or pre-encoded) payload body, which is required with GNAP’s use of JWS for key proofing.

Please submit your additions to the mailing list. We’ll be collecting this list and making it available to Hackathon participants. The editors also plan to incorporate this information in a future version of the spec as an “implementation status” section, as discussed in this issue: https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/258 <https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/258>

 — Justin