Issues referencing a DAPS

[aitorcelaya]

I am currently working with the Dataspace Connector v7.1.0 and I am trying to connect to a DAPS installed in another device. We have been working with Docker networks referencing it as https://omejdn and this is no longer possible in the new environment.

We are having issues referencing the DAPS with an IP address in the application.properties:

daps.url=http://192.168.1.197
daps.token.url=http://192.168.1.197/auth/token

These are the logs I am getting with code=400, message=Bad Request:

connectorb  | 2022-05-25T08:38:11,270 [https-jsse-nio-8081-exec-6] INFO - Completed initialization in 5 ms
connectorb  | 2022-05-25T08:38:12,255 [https-jsse-nio-8081-exec-6] ERROR - PRODUCTIVE_DEPLOYMENT: No IDS-Message sent! No DAT could be acquired from DAPS! [code=(IMSCOE0001), reason=(Error connecting to DAPS (possibly currently not reachable or wrong DAPS-URL): Unexpected code Response{protocol=http/1.1, code=400, message=Bad Request, url=http://192.168.1.197/auth/token} Body: {"error":"invalid_client","error_description":"Error decoding JWT: Signature nbf has not been reached"})]
connectorb  | 2022-05-25T08:38:12,258 [https-jsse-nio-8081-exec-6] WARN - Connection to DAPS could not be established. [exception=(Error connecting to DAPS (possibly currently not reachable or wrong DAPS-URL): Unexpected code Response{protocol=http/1.1, code=400, message=Bad Request, url=http://192.168.1.197/auth/token} Body: {"error":"invalid_client","error_description":"Error decoding JWT: Signature nbf has not been reached"})]
connectorb  | 2022-05-25T08:38:12,297 [https-jsse-nio-8081-exec-6] WARN - Unable to retrieve valid DAT. [exception=(Access is denied)]
connectorb  | 2022-05-25T08:38:20,839 [scheduling-1] INFO - Scanning agreements...

Is there any plan for this to be an option in the future?

[tmberthold]

If you take a look at the logs, you are actually reaching the DAPS.

The DAPS responds with an unexpected code Response (400 BAD REQUEST):
{protocol=http/1.1, code=400, message=Bad Request, url=http://192.168.1.197/auth/token} Body: {"error":"invalid_client","error_description":"Error decoding JWT: Signature nbf has not been reached"})]

Error decoding JWT: Signature nbf has not been reached -> The server time of the DAPS seems to be in the past of the DSC or the other way, the server-time of the DSC is in the future of the DAPS-Server, at least that would be a first debugging starting point. Therefore the DAPS does not seem to issue a DAT, because the sent request of the DSC (JWT) is only valid from a certain point in time (not before claim in JWT request token, nbf) which was not reached at the DAPS-Server side, when the request came in -> nbf in future of DAPS -> DAPS rejects DAT issuing.

[tmberthold]

You could use the property:
daps.time.offset.seconds:
freely configure a possible time difference between the system of the connector and the DAPS. The entered interger value is subtracted from the current time in the form of seconds and the iat (issued at) and nbf (not before) are set in the JWT from the connector to the DAPS for the DAT request with the adjusted time
https://github.com/International-Data-Spaces-Association/IDS-Messaging-Services/wiki/09.-Settings:-Connector-Configuration