From e7bf7d032145f7017e5d03c63c9284e6ef9a3348 Mon Sep 17 00:00:00 2001
From: Pascal Knoth <pascal@malach.it>
Date: Mon, 11 Nov 2024 11:45:34 +0100
Subject: [PATCH] [federation] resolve trust chains

---
 .../Forms/FederationEntityField.vue           |  3 +-
 .../components/Forms/FederationEntityForm.vue | 27 +++--
 .../src/models/federation-entity.model.js     |  4 +-
 .../FederationEntityList.vue                  |  2 +-
 apps/boruta_admin/lib/boruta_admin/clients.ex | 14 +--
 .../lib/boruta_federation/application.ex      |  1 +
 .../lib/boruta_federation/cache.ex            |  5 +
 .../boruta_federation/federation_entities.ex  | 11 ++-
 .../federation_entities/federation_entity.ex  | 32 +++++-
 .../federation_entities/leaf_entity.ex        | 98 +++++++++++++++++--
 .../boruta_federation/openid_federation.ex    |  2 +-
 .../lib/boruta_federation/trust_chains.ex     | 38 ++++++-
 .../controllers/openid_controller.ex          |  7 ++
 .../views/openid_view.ex                      | 11 +++
 apps/boruta_federation/mix.exs                |  2 +
 ...add_authorities_to_federation_entities.exs |  2 +-
 .../identity_providers/backend.ex             |  9 +-
 apps/boruta_web/lib/boruta_web/router.ex      |  6 ++
 mix.lock                                      |  2 +-
 19 files changed, 226 insertions(+), 50 deletions(-)
 create mode 100644 apps/boruta_federation/lib/boruta_federation/cache.ex
 create mode 100644 apps/boruta_federation/lib/boruta_federation_web/controllers/openid_controller.ex
 create mode 100644 apps/boruta_federation/lib/boruta_federation_web/views/openid_view.ex

diff --git a/apps/boruta_admin/assets/src/components/Forms/FederationEntityField.vue b/apps/boruta_admin/assets/src/components/Forms/FederationEntityField.vue
index 7c6a1d8c..1f9b6293 100644
--- a/apps/boruta_admin/assets/src/components/Forms/FederationEntityField.vue
+++ b/apps/boruta_admin/assets/src/components/Forms/FederationEntityField.vue
@@ -2,6 +2,7 @@
   <div class="field">
     <label>federation entity</label>
     <select v-model="currentFederationEntityId">
+      <option></option>
       <option v-for="federationEntityOption in federationEntities" :value="federationEntityOption.id" :key="federationEntityOption.id" :selected="federationEntityOption.id == currentFederationEntityId">
         {{ federationEntityOption.organization_name }}
       </option>
@@ -31,7 +32,7 @@ export default {
         return this.federationEntity.id
       },
       set (federationEntityId) {
-        return this.$emit('federationEntityChange', this.federationEntities.find(({ id }) => id === federationEntityId))
+        return this.$emit('federationEntityChange', this.federationEntities.find(({ id }) => id === federationEntityId) || new FederationEntity())
       }
     }
   }
diff --git a/apps/boruta_admin/assets/src/components/Forms/FederationEntityForm.vue b/apps/boruta_admin/assets/src/components/Forms/FederationEntityForm.vue
index 86e31d8d..c3f04ffb 100644
--- a/apps/boruta_admin/assets/src/components/Forms/FederationEntityForm.vue
+++ b/apps/boruta_admin/assets/src/components/Forms/FederationEntityForm.vue
@@ -13,12 +13,17 @@
             <option v-for="type in entityTypes" :value="type">{{ type }}</option>
           </select>
         </div>
+        <h3>Authorities</h3>
         <div class="field" :class="{ 'error': federationEntity.errors?.authorities }">
-          <label>Authorities</label>
-          <div v-for="(authority, index) in federationEntity.authorities" class="field" :key="index">
-            <div class="ui right icon input">
-              <input type="text" v-model="authority.url" placeholder="http://authority.uri" />
-              <i v-on:click="deleteAuthority(authority)" class="close icon"></i>
+          <div v-for="(authority, index) in federationEntity.authorities" class="ui segment field" :key="index">
+            <i v-on:click="deleteAuthority(authority)" class="close icon"></i>
+            <div class="field">
+              <label>Issuer</label>
+              <input type="text" v-model="authority.issuer" placeholder="http://authority.uri" />
+            </div>
+            <div class="field">
+              <label>Subject</label>
+              <input type="text" v-model="authority.sub" placeholder="sub" />
             </div>
           </div>
           <a v-on:click.prevent="addAuthority()" class="ui blue fluid button">Add an authority</a>
@@ -97,17 +102,19 @@ export default {
 
 <style scoped lang="scss">
 .federation-entity-form {
+  .segment .close {
+    z-index: 10;
+    cursor: pointer;
+    position: absolute;
+    top: 1em;
+    right: 1em;
+  }
   .field {
     position: relative;
     &.federation-entitys input {
       margin-right: 3em;
     }
   }
-  .ui.icon.input>i.icon.close {
-    cursor: pointer;
-    pointer-events: all;
-    position: absolute;
-  }
   .authorized-scopes-select {
     margin-right: 3em;
   }
diff --git a/apps/boruta_admin/assets/src/models/federation-entity.model.js b/apps/boruta_admin/assets/src/models/federation-entity.model.js
index 0cc7764c..01020513 100644
--- a/apps/boruta_admin/assets/src/models/federation-entity.model.js
+++ b/apps/boruta_admin/assets/src/models/federation-entity.model.js
@@ -31,7 +31,7 @@ const assign = {
   id: function ({ id }) { this.id = id },
   organization_name: function ({ organization_name }) { this.organization_name = organization_name },
   type: function ({ type }) { this.type = type },
-  authorities: function ({ authorities }) { this.authorities = authorities.map((url) => ({ url })) },
+  authorities: function ({ authorities }) { this.authorities = authorities },
   is_default: function ({ is_default }) { this.is_default = is_default },
   trust_chain_statement_alg: function ({ trust_chain_statement_alg }) { this.trust_chain_statement_alg = trust_chain_statement_alg },
   trust_chain_statement_ttl: function ({ trust_chain_statement_ttl }) { this.trust_chain_statement_ttl = trust_chain_statement_ttl },
@@ -98,7 +98,7 @@ class FederationEntity {
     return {
       id,
       organization_name,
-      authorities: authorities.map(({ url }) => url),
+      authorities: authorities,
       type,
       trust_chain_statement_alg,
       trust_chain_statement_ttl,
diff --git a/apps/boruta_admin/assets/src/views/FederationEntities/FederationEntityList.vue b/apps/boruta_admin/assets/src/views/FederationEntities/FederationEntityList.vue
index ca34caeb..2b568db7 100644
--- a/apps/boruta_admin/assets/src/views/FederationEntities/FederationEntityList.vue
+++ b/apps/boruta_admin/assets/src/views/FederationEntities/FederationEntityList.vue
@@ -24,7 +24,7 @@
               </div>
               <div class="item">
                 <span class="header">Authorities</span>
-                <span class="description" v-for="authority in federationEntity.authorities">{{ authority.url }}</span>
+                <span class="description" v-for="authority in federationEntity.authorities">{{ authority.issuer }} - {{ authority.sub }}</span>
               </div>
               <div class="item">
                 <span class="header">Trust mark logo uri</span>
diff --git a/apps/boruta_admin/lib/boruta_admin/clients.ex b/apps/boruta_admin/lib/boruta_admin/clients.ex
index 5016ede1..aa8fc82a 100644
--- a/apps/boruta_admin/lib/boruta_admin/clients.ex
+++ b/apps/boruta_admin/lib/boruta_admin/clients.ex
@@ -54,16 +54,10 @@ defmodule BorutaAdmin.Clients do
                   )
               end),
            {:ok, _client_federation_entity} <-
-             (case federation_entity_id do
-                nil ->
-                  {:ok, nil}
-
-                federation_entity_id ->
-                  FederationEntities.upsert_client_federation_entity(
-                    client.id,
-                    federation_entity_id
-                  )
-              end) do
+             FederationEntities.upsert_client_federation_entity(
+               client.id,
+               federation_entity_id
+             ) do
         client
       else
         {:error, error} ->
diff --git a/apps/boruta_federation/lib/boruta_federation/application.ex b/apps/boruta_federation/lib/boruta_federation/application.ex
index abd1fbec..e29c48ed 100644
--- a/apps/boruta_federation/lib/boruta_federation/application.ex
+++ b/apps/boruta_federation/lib/boruta_federation/application.ex
@@ -6,6 +6,7 @@ defmodule BorutaFederation.Application do
   @impl true
   def start(_type, _args) do
     children = [
+      BorutaFederation.Cache,
       BorutaFederation.Repo,
       BorutaFederationWeb.Endpoint
     ]
diff --git a/apps/boruta_federation/lib/boruta_federation/cache.ex b/apps/boruta_federation/lib/boruta_federation/cache.ex
new file mode 100644
index 00000000..111d349e
--- /dev/null
+++ b/apps/boruta_federation/lib/boruta_federation/cache.ex
@@ -0,0 +1,5 @@
+defmodule BorutaFederation.Cache do
+  use Nebulex.Cache,
+    otp_app: :boruta_federation,
+    adapter: Nebulex.Adapters.Replicated
+end
diff --git a/apps/boruta_federation/lib/boruta_federation/federation_entities.ex b/apps/boruta_federation/lib/boruta_federation/federation_entities.ex
index e9b05c96..8b1c42df 100644
--- a/apps/boruta_federation/lib/boruta_federation/federation_entities.ex
+++ b/apps/boruta_federation/lib/boruta_federation/federation_entities.ex
@@ -17,6 +17,7 @@ defmodule BorutaFederation.FederationEntities do
     case Ecto.UUID.cast(id) do
       {:ok, _} ->
         Repo.get(FederationEntity, id)
+
       _ ->
         nil
     end
@@ -55,7 +56,12 @@ defmodule BorutaFederation.FederationEntities do
         ) ::
           {:ok, client_federation_entity :: ClientFederationEntity.t() | nil}
           | {:error, changeset :: Ecto.Changeset.t()}
-  def upsert_client_federation_entity(_client_id, nil), do: {:ok, nil}
+  def upsert_client_federation_entity(client_id, nil) do
+    with {1, _} <-
+           Repo.delete_all(from cfe in ClientFederationEntity, where: cfe.client_id == ^client_id) do
+      {:ok, nil}
+    end
+  end
 
   def upsert_client_federation_entity(client_id, federation_entity_id) do
     %ClientFederationEntity{}
@@ -69,7 +75,8 @@ defmodule BorutaFederation.FederationEntities do
     )
   end
 
-  @spec get_federation_entity_by_client_id(client_id :: String.t()) :: federation_entity :: FederationEntity.t() | nil
+  @spec get_federation_entity_by_client_id(client_id :: String.t()) ::
+          federation_entity :: FederationEntity.t() | nil
   def get_federation_entity_by_client_id(client_id) do
     case Ecto.UUID.cast(client_id) do
       {:ok, client_id} ->
diff --git a/apps/boruta_federation/lib/boruta_federation/federation_entities/federation_entity.ex b/apps/boruta_federation/lib/boruta_federation/federation_entities/federation_entity.ex
index 51ef9828..e52c6108 100644
--- a/apps/boruta_federation/lib/boruta_federation/federation_entities/federation_entity.ex
+++ b/apps/boruta_federation/lib/boruta_federation/federation_entities/federation_entity.ex
@@ -60,6 +60,15 @@ defmodule BorutaFederation.FederationEntities.FederationEntity do
     ]
   }
 
+  @authority_schema %{
+    "type" => "object",
+    "properties" => %{
+      "issuer" => %{"type" => "string"},
+      "sub" => %{"type" => "string"}
+    },
+    "required" => ["issuer", "sub"]
+  }
+
   @primary_key {:id, :binary_id, autogenerate: true}
   @foreign_key_type :binary_id
   schema "federation_entities" do
@@ -69,7 +78,7 @@ defmodule BorutaFederation.FederationEntities.FederationEntity do
     field(:private_key, :string)
     field(:trust_chain_statement_alg, :string)
     field(:trust_chain_statement_ttl, :integer, default: 3600 * 24)
-    field(:authorities, {:array, :string}, default: [])
+    field(:authorities, {:array, :map}, default: [])
     field(:default, :boolean, default: false)
     field(:trust_mark_logo_uri, :string)
     field(:key_pair_type, :map,
@@ -157,10 +166,23 @@ defmodule BorutaFederation.FederationEntities.FederationEntity do
   end
 
   defp validate_authorities(changeset) do
-    validate_change(changeset, :authorities, fn field, values ->
-      Enum.map(values, &validate_url/1)
-      |> Enum.reject(&is_nil/1)
-      |> Enum.map(fn error -> {field, error} end)
+    Enum.reduce(get_field(changeset, :authorities), changeset, fn authority, changeset ->
+      case ExJsonSchema.Validator.validate(
+        @authority_schema,
+        authority,
+        error_formatter: BorutaFormatter
+      ) do
+        :ok ->
+          case validate_url(authority["issuer"]) do
+            nil ->
+              changeset
+            error ->
+              add_error(changeset, :authorities, error)
+          end
+
+        {:error, errors} ->
+          add_error(changeset, :authorities, "validation failed: #{Enum.join(errors, " ")}")
+      end
     end)
   end
 
diff --git a/apps/boruta_federation/lib/boruta_federation/federation_entities/leaf_entity.ex b/apps/boruta_federation/lib/boruta_federation/federation_entities/leaf_entity.ex
index ecbdb427..49fdb262 100644
--- a/apps/boruta_federation/lib/boruta_federation/federation_entities/leaf_entity.ex
+++ b/apps/boruta_federation/lib/boruta_federation/federation_entities/leaf_entity.ex
@@ -5,6 +5,8 @@ defmodule BorutaFederation.FederationEntities.LeafEntity do
 
   import Boruta.Config, only: [issuer: 0]
 
+  @federation_configuration_path "/.well-known/openid-federation"
+
   defmodule Token do
     @moduledoc false
 
@@ -15,12 +17,13 @@ defmodule BorutaFederation.FederationEntities.LeafEntity do
 
   @spec metadata(entity :: FederationEntity.t()) :: {:ok, metadata :: map()}
   def metadata(entity) do
-    {:ok, %{
-      "openid_provider" => %{
-        "issuer" => issuer(),
-        "organization_name" => entity.organization_name
-      }
-    }}
+    {:ok,
+     %{
+       "openid_provider" => %{
+         "issuer" => issuer(),
+         "organization_name" => entity.organization_name
+       }
+     }}
   end
 
   @spec jwks(entity :: FederationEntity.t()) :: {:ok, jwks :: map()}
@@ -43,11 +46,92 @@ defmodule BorutaFederation.FederationEntities.LeafEntity do
     case Joken.encode_and_sign(payload, signer) do
       {:ok, trust_mark, _payload} ->
         {:ok, [trust_mark]}
+
       {:error, error} ->
         {:error, to_string(error)}
     end
   end
 
   @spec resolve_parents_chain(entity :: FederationEntity.t()) :: {:ok, chain :: list(String.t())}
-  def resolve_parents_chain(_entity), do: {:ok, []}
+  def resolve_parents_chain(entity) do
+    Enum.reduce_while(entity.authorities, {:ok, []}, fn authority, {:ok, acc} ->
+      case resolve_chain(authority) do
+        {:ok, statement, trust_chain} ->
+          case Enum.reduce_while(
+            trust_chain ++ [statement],
+            {:ok, acc},
+            fn statement, {:ok, acc} ->
+              # TODO
+              {:ok, %{"sub" => sub}} = Joken.peek_claims(statement)
+
+              case fetch_statement(authority, sub) do
+                {:ok, statement} ->
+                  {:cont, {:ok, acc ++ [statement]}}
+
+                {:error, error} ->
+                  {:halt, {:error, error}}
+              end
+            end
+          ) do
+            {:ok, chain} ->
+              {:cont, {:ok, acc ++ chain}}
+            {:error, error} ->
+              {:halt, {:error, error}}
+          end
+
+        _ ->
+          {:halt, {:error, "Could not fetch parent chain."}}
+      end
+    end)
+  end
+
+  defp resolve_chain(authority) do
+    with {:ok, %Finch.Response{status: 200, body: configuration}} <- Finch.build(:get, authority["issuer"] <> @federation_configuration_path) |> Finch.request(OpenIDHttpClient),
+         {:ok, %{"federation_resolve_endpoint" => resolve_url}} <- Jason.decode(configuration) do
+      case Finch.build(:get, resolve_url <> "?sub=#{authority["sub"]}") |> Finch.request(OpenIDHttpClient) do
+        {:ok, %Finch.Response{status: 200, body: statement}} ->
+          with {:ok, %{"jwks" => [jwk], "trust_chain" => trust_chain}} <-
+            Joken.peek_claims(statement),
+               {:ok, %{"alg" => alg}} <- Joken.peek_header(statement),
+               {_, pem} <- JOSE.JWK.from_map(jwk) |> JOSE.JWK.to_pem(),
+               signer <- Joken.Signer.create(alg, %{"pem" => pem}),
+               {:ok, _claims} <- Token.verify_and_validate(statement, signer) do
+            {:ok, statement, trust_chain}
+          else
+            {:ok, []} ->
+              {:ok, statement, []}
+
+            _ ->
+              {:error, "Could not resolve parent trust chain."}
+          end
+
+        _ ->
+          {:error, "Could not resolve #{authority["issuer"]} parent trust chain."}
+      end
+    else
+      _ ->
+        {:error, "Could not resolve #{authority["issuer"]} configuration."}
+    end
+  end
+
+  defp fetch_statement(authority, sub) do
+    with {:ok, %Finch.Response{status: 200, body: configuration}} <- Finch.build(:get, authority["issuer"] <> @federation_configuration_path) |> Finch.request(OpenIDHttpClient),
+         {:ok, %{"federation_fetch_endpoint" => fetch_url}} <- Jason.decode(configuration) do
+    with {:ok, %Finch.Response{status: 200, body: statement}} <-
+      Finch.build(:get, fetch_url <> "?sub=#{sub}") |> Finch.request(OpenIDHttpClient),
+         {:ok, %{"jwks" => [jwk]}} <- Joken.peek_claims(statement),
+         {:ok, %{"alg" => alg}} <- Joken.peek_header(statement),
+         {_, pem} <- JOSE.JWK.from_map(jwk) |> JOSE.JWK.to_pem(),
+         signer <- Joken.Signer.create(alg, %{"pem" => pem}),
+         {:ok, _claims} <- Token.verify_and_validate(statement, signer) do
+      {:ok, statement}
+    else
+      _ ->
+        {:error, "Could not fetch #{authority["issuer"]} statement"}
+    end
+    else
+      _ ->
+        {:error, "Could not resolve #{authority["issuer"]} configuration."}
+    end
+  end
 end
diff --git a/apps/boruta_federation/lib/boruta_federation/openid_federation.ex b/apps/boruta_federation/lib/boruta_federation/openid_federation.ex
index 958c1c44..633cb81b 100644
--- a/apps/boruta_federation/lib/boruta_federation/openid_federation.ex
+++ b/apps/boruta_federation/lib/boruta_federation/openid_federation.ex
@@ -41,7 +41,7 @@ defmodule BorutaFederation.OpenidFederation do
         module.resolve_failure(context, error)
 
       entity ->
-        case TrustChains.generate_statement(entity) do
+        case TrustChains.generate_statement(entity, include_trust_chain: true) do
           {:ok, statement} ->
             module.resolve_success(context, statement)
 
diff --git a/apps/boruta_federation/lib/boruta_federation/trust_chains.ex b/apps/boruta_federation/lib/boruta_federation/trust_chains.ex
index 44b7c492..93705a3d 100644
--- a/apps/boruta_federation/lib/boruta_federation/trust_chains.ex
+++ b/apps/boruta_federation/lib/boruta_federation/trust_chains.ex
@@ -1,13 +1,17 @@
 defmodule BorutaFederation.TrustChains do
   @moduledoc false
 
+  use Nebulex.Caching
+
   import Boruta.Config, only: [issuer: 0]
 
   alias BorutaFederation.FederationEntities.FederationEntity
 
+  @trust_chain_ttl 3600
+
   @spec generate_statement(entity :: FederationEntity.t()) ::
           {:ok, trust_chain :: list(String.t())} | {:error, reason :: String.t()}
-  def generate_statement(entity) do
+  def generate_statement(entity, opts \\ []) do
     signer = Joken.Signer.create(entity.trust_chain_statement_alg, %{"pem" => entity.private_key})
 
     with {:ok, metadata} <- apply(String.to_atom(entity.type), :metadata, [entity]),
@@ -25,15 +29,39 @@ defmodule BorutaFederation.TrustChains do
         "trust_marks" => trust_marks
       }
 
-      case Joken.encode_and_sign(payload, signer) do
-        {:ok, statement, _payload} ->
-          {:ok, statement}
+      with true <- opts[:include_trust_chain],
+           {:ok, chain_statements} <-
+             apply(String.to_atom(entity.type), :resolve_parents_chain, [entity]) do
+        payload = Map.put(payload, "trust_chain", chain_statements)
+
+        case Joken.encode_and_sign(payload, signer) do
+          {:ok, statement, _payload} ->
+            {:ok, statement}
+
+          {:error, error} ->
+            {:error, to_string(error)}
+        end
+      else
         {:error, error} ->
-          {:error, to_string(error)}
+          {:error, error}
+
+        _ ->
+          case Joken.encode_and_sign(payload, signer) do
+            {:ok, statement, _payload} ->
+              {:ok, statement}
+
+            {:error, error} ->
+              {:error, to_string(error)}
+          end
       end
     end
   end
 
+  @decorate cacheable(
+              cache: BorutaFederation.Cache,
+              key: {__MODULE__, entity.id},
+              opts: [ttl: @trust_chain_ttl]
+            )
   @spec generate_trust_chain(entity :: FederationEntity.t()) ::
           {:ok, trust_chain :: list(String.t())} | {:error, reason :: String.t()}
   def generate_trust_chain(entity) do
diff --git a/apps/boruta_federation/lib/boruta_federation_web/controllers/openid_controller.ex b/apps/boruta_federation/lib/boruta_federation_web/controllers/openid_controller.ex
new file mode 100644
index 00000000..704503fd
--- /dev/null
+++ b/apps/boruta_federation/lib/boruta_federation_web/controllers/openid_controller.ex
@@ -0,0 +1,7 @@
+defmodule BorutaFederationWeb.OpenidController do
+  use BorutaFederationWeb, :controller
+
+  def well_known(conn, _params) do
+    render(conn, "well_known.json")
+  end
+end
diff --git a/apps/boruta_federation/lib/boruta_federation_web/views/openid_view.ex b/apps/boruta_federation/lib/boruta_federation_web/views/openid_view.ex
new file mode 100644
index 00000000..4ef86d89
--- /dev/null
+++ b/apps/boruta_federation/lib/boruta_federation_web/views/openid_view.ex
@@ -0,0 +1,11 @@
+defmodule BorutaFederationWeb.OpenidView do
+  use BorutaFederationWeb, :view
+
+  def render("well_known.json", _params) do
+    # TODO change to the default entity statement
+    %{
+      federation_fetch_endpoint: Routes.fetch_url(BorutaFederationWeb.Endpoint, :fetch),
+      federation_resolve_endpoint: Routes.resolve_url(BorutaFederationWeb.Endpoint, :resolve)
+    }
+  end
+end
diff --git a/apps/boruta_federation/mix.exs b/apps/boruta_federation/mix.exs
index 4cc2fddd..06e31b1c 100644
--- a/apps/boruta_federation/mix.exs
+++ b/apps/boruta_federation/mix.exs
@@ -38,11 +38,13 @@ defmodule BorutaFederation.MixProject do
   defp deps do
     [
       {:boruta_auth, in_umbrella: true},
+      {:decorator, "~> 1.4"},
       {:ecto_sql, "~> 3.6"},
       {:ex_json_schema, "~> 0.9"},
       {:ex_machina, "~> 2.4", only: :test},
       {:jason, "~> 1.0"},
       {:logger_file_backend, "~> 0.0.13"},
+      {:nebulex, "~> 2.6"},
       {:phoenix, "~> 1.6.0", override: true},
       {:phoenix_ecto, "~> 4.1"},
       {:phoenix_html, "~> 3.0"},
diff --git a/apps/boruta_federation/priv/repo/migrations/20241105155007_add_authorities_to_federation_entities.exs b/apps/boruta_federation/priv/repo/migrations/20241105155007_add_authorities_to_federation_entities.exs
index 9f4c4cfa..1ee7e8a6 100644
--- a/apps/boruta_federation/priv/repo/migrations/20241105155007_add_authorities_to_federation_entities.exs
+++ b/apps/boruta_federation/priv/repo/migrations/20241105155007_add_authorities_to_federation_entities.exs
@@ -3,7 +3,7 @@ defmodule BorutaFederation.Repo.Migrations.AddAuthoritiesToFederationEntities do
 
   def change do
     alter table(:federation_entities) do
-      add :authorities, {:array, :string}, null: false, default: []
+      add :authorities, {:array, :jsonb}, null: false, default: []
       add :default, :boolean, null: false, default: false
     end
   end
diff --git a/apps/boruta_identity/lib/boruta_identity/identity_providers/backend.ex b/apps/boruta_identity/lib/boruta_identity/identity_providers/backend.ex
index bd59ec0f..32a2d436 100644
--- a/apps/boruta_identity/lib/boruta_identity/identity_providers/backend.ex
+++ b/apps/boruta_identity/lib/boruta_identity/identity_providers/backend.ex
@@ -45,6 +45,7 @@ defmodule BorutaIdentity.IdentityProviders.Backend do
   alias BorutaIdentity.Accounts.User
   alias BorutaIdentity.Repo
   alias BorutaIdentityWeb.Router.Helpers, as: Routes
+  alias ExJsonSchema.Validator.Error.BorutaFormatter
 
   @type t :: %__MODULE__{
           type: String.t(),
@@ -570,7 +571,7 @@ defmodule BorutaIdentity.IdentityProviders.Backend do
   defp validate_metadata_fields(
          %Ecto.Changeset{changes: %{metadata_fields: metadata_fields}} = changeset
        ) do
-    case ExJsonSchema.Validator.validate(@metadata_fields_schema, metadata_fields) do
+    case ExJsonSchema.Validator.validate(@metadata_fields_schema, metadata_fields, error_formatter: BorutaFormatter) do
       :ok ->
         changeset
 
@@ -587,7 +588,7 @@ defmodule BorutaIdentity.IdentityProviders.Backend do
          %Ecto.Changeset{changes: %{federated_servers: federated_servers}} = changeset
        ) do
     Enum.reduce(federated_servers, changeset, fn federated_server, changeset ->
-      case ExJsonSchema.Validator.validate(@federated_server_schema, federated_server) do
+      case ExJsonSchema.Validator.validate(@federated_server_schema, federated_server, error_formatter: BorutaFormatter) do
         :ok ->
           changeset
 
@@ -605,7 +606,7 @@ defmodule BorutaIdentity.IdentityProviders.Backend do
          %Ecto.Changeset{changes: %{verifiable_credentials: verifiable_credentials}} = changeset
        ) do
     Enum.reduce(verifiable_credentials, changeset, fn verifiable_credential, changeset ->
-      case ExJsonSchema.Validator.validate(@verifiable_credential_schema, verifiable_credential) do
+      case ExJsonSchema.Validator.validate(@verifiable_credential_schema, verifiable_credential, error_formatter: BorutaFormatter) do
         :ok ->
           changeset
 
@@ -623,7 +624,7 @@ defmodule BorutaIdentity.IdentityProviders.Backend do
          %Ecto.Changeset{changes: %{verifiable_presentations: verifiable_presentations}} = changeset
        ) do
     Enum.reduce(verifiable_presentations, changeset, fn verifiable_presentation, changeset ->
-      case ExJsonSchema.Validator.validate(@verifiable_presentation_schema, verifiable_presentation) do
+      case ExJsonSchema.Validator.validate(@verifiable_presentation_schema, verifiable_presentation, error_formatter: BorutaFormatter) do
         :ok ->
           case Jason.decode(verifiable_presentation["presentation_definition"]) do
             {:ok, _map} ->
diff --git a/apps/boruta_web/lib/boruta_web/router.ex b/apps/boruta_web/lib/boruta_web/router.ex
index 460b04d4..5e6e31aa 100644
--- a/apps/boruta_web/lib/boruta_web/router.ex
+++ b/apps/boruta_web/lib/boruta_web/router.ex
@@ -34,6 +34,12 @@ defmodule BorutaWeb.Router do
     get("/.well-known/openid-credential-issuer", OpenidController, :openid_credential_issuer)
   end
 
+  scope "/", BorutaFederationWeb do
+    pipe_through(:api)
+
+    get("/.well-known/openid-federation", OpenidController, :well_known)
+  end
+
   get("/healthcheck", BorutaWeb.MonitoringController, :healthcheck, log: false)
 
   forward("/accounts", BorutaIdentityWeb.Endpoint)
diff --git a/mix.lock b/mix.lock
index 8c0bd901..b364d34a 100644
--- a/mix.lock
+++ b/mix.lock
@@ -2,7 +2,7 @@
   "argon2_elixir": {:hex, :argon2_elixir, "2.4.1", "edb27bdd326bc738f3e4614eddc2f73507be6fedc9533c6bcc6f15bbac9c85cc", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "0e21f52a373739d00bdfd5fe6da2f04eea623cb4f66899f7526dd9db03903d9f"},
   "asn1_compiler": {:hex, :asn1_compiler, "0.1.1", "64a4e52b59d1f225878445ace2c75cd2245b13a5a81182304fd9dc5acfc8994e", [:mix], [], "hexpm", "c250d24c22f1a3f305d88864400f9ac2df55c6886e1e3a030e2946efeb94695e"},
   "bcrypt_elixir": {:hex, :bcrypt_elixir, "3.1.0", "0b110a9a6c619b19a7f73fa3004aa11d6e719a67e672d1633dc36b6b2290a0f7", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "2ad2acb5a8bc049e8d5aa267802631912bb80d5f4110a178ae7999e69dca1bf7"},
-  "boruta": {:git, "https://github.com/malach-it/boruta_auth", "919bf4536d42b26cc9a203ab3e6f760db2b1ef12", [branch: "openid-federation"]},
+  "boruta": {:git, "https://github.com/malach-it/boruta_auth", "b9d7596a593c9f752e9be4c529e2cbb76b259d8b", [branch: "openid-federation"]},
   "bunt": {:hex, :bunt, "1.0.0", "081c2c665f086849e6d57900292b3a161727ab40431219529f13c4ddcf3e7a44", [:mix], [], "hexpm", "dc5f86aa08a5f6fa6b8096f0735c4e76d54ae5c9fa2c143e5a1fc7c1cd9bb6b5"},
   "bypass": {:hex, :bypass, "2.1.0", "909782781bf8e20ee86a9cabde36b259d44af8b9f38756173e8f5e2e1fabb9b1", [:mix], [{:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}, {:plug_cowboy, "~> 2.0", [hex: :plug_cowboy, repo: "hexpm", optional: false]}, {:ranch, "~> 1.3", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "d9b5df8fa5b7a6efa08384e9bbecfe4ce61c77d28a4282f79e02f1ef78d96b80"},
   "castore": {:hex, :castore, "1.0.9", "5cc77474afadf02c7c017823f460a17daa7908e991b0cc917febc90e466a375c", [:mix], [], "hexpm", "5ea956504f1ba6f2b4eb707061d8e17870de2bee95fb59d512872c2ef06925e7"},