iSHARE Token Creator (test environment)

Test the full DSGO AuthZ flow in one run: authenticate, call a protected API endpoint, evaluate authorization, and optionally query PRP evidence.

Step 1 — JWT client assertion to POST /token
Step 2 — Bearer token check on the data endpoint
Step 3 — AuthZen evaluation via POST /api/evaluation
Step 4 — PRP lookup via POST /api/search (optional)

Scenario legend

  • Delegation — delegate (99998) acts via issuer (99999) policy → ALLOW
  • No delegation — caller (99998) has own direct policy → ALLOW
  • Direct — issuer (99999) checks its own policy → ALLOW
  • Delegation deny — issuer has no matching policy for this request → DENY
  • Invalid issuer — issuer unknown in registry → DENY
  • Custom — provide your own JSON evaluation body

Ensure demo data is present: php bin/console doctrine:migrations:migrate

Demo Configuration

Values entered here are not stored

Authentication Input

Data Endpoint Check (Step 2)

Evaluation (Step 3)

PRP Search (Step 4)

Non-repudiation (RFC022)

When enabled, evaluation and search responses are wrapped in a signed iSHARE JWT (RS256 + x5c certificate chain), providing cryptographic non-repudiation.

Key Material

Step 1 — Authentication

No token response yet. Submit the form.

Step 2 — Data endpoint call

Method used: GET

No data endpoint response yet.

Step 3 — Delegation evaluation (AuthZen)

Scenario: delegation_allow

Request sent to POST /api/evaluation:

{
    "subject": {
        "type": "service-consumer",
        "id": "did:ishare:EU.NL.NTRNL-99999998",
        "properties": {
            "delegation": {
                "issuer": {
                    "type": "service-consumer",
                    "id": "did:ishare:EU.NL.NTRNL-99999999"
                },
                "license": "DSGO.0008"
            }
        }
    },
    "resource": {
        "type": "api",
        "id": "\/products",
        "properties": {
            "service_provider": "did:ishare:EU.NL.NTRNL-99999999"
        }
    },
    "action": {
        "name": "can_read",
        "properties": {
            "method": "GET",
            "license": "DSGO.0001"
        }
    }
}

No evaluation result yet.

Step 4 — Policy Retrieval Point search (optional)

Request sent to POST /api/search:

{
    "issuer": {
        "type": "service-consumer",
        "id": "did:ishare:EU.NL.NTRNL-99999999"
    },
    "subject": {
        "type": "service-consumer",
        "id": "did:ishare:EU.NL.NTRNL-99999998"
    },
    "resource": {
        "type": "api",
        "id": "\/products"
    }
}

No search result yet.