Interface for changing the DID controller

[atz3n]

Hi all 👋,

Is there an interface for changing the DID controller? I couldn't find such a function within the AbstractIdentifierProvider class. If not, maybe it is a good idea to define one to have a convenient API for this task.

Cheers,
Attila

[mirceanis]

Hi, you are right. That interface is absent.
We omitted this method initially because of lack of clarity of how DID controllers can change for various DID methods.
So far, we've worked mostly with did:ethr, did:web, and did:key until now, and changing DID controllers is tricky to define.

• did:ethr has an owner property on the ledger, but that does not reflect as a controller property for the DID document, but rather only in the available verification methods.
• did:web spec does not mention controller at all
• did:key controller makes no sense since it cannot be updated.

Now that you have a need for it, it would be great if you could describe your use case and how it can be implemented for different DID methods.
Veramo should be agnostic to the DID method, so what you are asking for makes sense for the general use-case.

[atz3n]

Hi again,

maybe a first version could be a super generic interface like:

abstract changeController(
    args: { identifier: IIdentifier; options?: any },
    context: IAgentContext<IKeyManager>,
  ): Promise<boolean>

where the DID method specific parameters are passed through the options field. A boolean return value indicates whether or not this operation succeeded. Alternatively, it could return void and throw an error if it fails.

Our use case is to generate a DID that represents a project and set the controller to the owner DID of that project. I know this could be done with VCs, but it was decided to do it with the DID controller.

I'm also thinking of implementing a plugin for the bba DID method. This method handles controller keys completely separately from other keys (verification, authentication, etc) so a more specific interface may not be applicable here. I think this could also be the case for other methods.

[mirceanis]

That looks good. Thanks for the suggestion.

I have a feeling boolean result might not be enough. In the case of did:ethr, for example, any update operation requires a transaction, which might take a long time to mine even if sending it was successful.
It might be a good idea then to return a more expressive type. string should be enough, I guess.

[mirceanis]

Also, take a look at this repo if you want to implement a plugin: https://github.com/uport-project/veramo-plugin

Feedback on the template is very welcome as well ;)

[atz3n]

Agree, string should be used as return type. Thanks for the plugin link. In general, I like this project a lot :)

[atz3n]

Hi again,

I'll keep going our import identifier discussion here since it's actually about the controller change workflow :).

I wont create a PR since the solution we use now is a little bit hacky, but I'd like to tell you what I did to achieve a controller change workflow with the ethr DID method. Maybe it's useful for an official implementation :)

In our solution we misuse the addKey interface of the AbstractIdentifierProvider to change the controller. In particular we defined a changeController field for the options parameter and use it to request a controller change. To implement the controller change logic, we forked the ethr-did-provider and added the following functions:

async addKey(
    { identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any },
    context: IRequiredContext,
): Promise<any> {
    if (options?.changeController) {
        return this.changeController({identifier, key, options}, context);
    } else {
        return this._addKey({identifier, key, options}, context);
    }
}

private async _addKey( // function to change the key (the default functionality)
    { identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any },
    context: IRequiredContext,
): Promise<any> {
    const ethrDid = await this.getEthrDidController(identifier, context)
    const usg = 'veriKey'
    const attribute = 'did/pub/' + key.type + '/' + usg + '/hex'
    const value = '0x' + key.publicKeyHex
    const ttl = options?.ttl || this.ttl
    const gasLimit = options?.gas || this.gas

    debug('ethrDid.setAttribute %o', { attribute, value, ttl, gas: gasLimit })

    const txHash = await ethrDid.setAttribute(attribute, value, ttl, gasLimit)
    debug({ txHash })
    return txHash
}

private async changeController( // function to change the controller key
    { identifier, key, options }: { identifier: IIdentifier; key: IKey; options?: any },
    context: IRequiredContext,
): Promise<any> {
    const ethrDid = await this.getEthrDidController(identifier, context)
    const newOwnerAddress = toEthereumAddress(key.publicKeyHex);
    const txHash = await ethrDid.changeOwner(newOwnerAddress);
    return txHash;
}

To update a controller key then we first set the new key and then update the identifier within Veramo:

/* add new controller key to identifier */
await Veramo.agent.didManagerAddKey({
    did: identifier.did,
    key: newControllerKey,
    options: {
        changeController: true
    }
});

/* update identifier internally */
let updatedIdentifier = await Veramo.agent.didManagerGet({ did: identifier.did });
updatedIdentifier.controllerKeyId = newControllerKey.kid;
await Veramo.agent.didManagerImport(updatedIdentifier);

Hopefully this is somehow helpful for you :)

[atz3n]

@mirceanis

[mirceanis]

Thank you, this is very helpful!