Allow IDHCS to trigger `create_identity` on user's behalf

[Kailai-Wang]

Context

Following the discussion with @kaylawangnow, we'd like to allow IDHCS to send link_identity to request the challenge code on user's behalf. This would increase the user's experience a lot as the user only has to sign one tx to verify the identity.

We have to consider the backwards compatibility, so we need to add an origin filter to allow either:

• IDHCS's address, or
• the user him/herself

---

✔️ Please set appropriate labels and assignees if applicable.

[Kailai-Wang]

Current create_identity extrinsic:
https://github.com/litentry/litentry-parachain/blob/cc55ce7fb5224b97f0934dde593a22272501f145/pallets/identity-management/src/lib.rs#L114-L119

Basically there're two ways to do it:

1. add an extra parameter to the original extrinsic for the user whose identity should be created:

pub fn create_identity(
	origin: OriginFor<T>,
	shard: ShardIdentifier,
        who: T::AccountId,
	encrypted_identity: Vec<u8>,
	encrypted_metadata: Option<Vec<u8>>,

and check the extrinsic caller origin: if it's equal to the authorized origin (= IDHCS origin), take who, otherwise check if origin == who, if so, take who.

2. simply add another extrinsic create_identity_authorized that has the same signature as 1, but we only allow authorized origin for this extrinsic.

So we either do it in a single extrinsic or separately. Any preference? @jingleizhang @jonalvarezz

[jingleizhang]

Thanks for the explanation! I prefer option 1 which could reduce the request latency and be more friendly to the user.

[jonalvarezz]

Thank you Kai. Option 1 is what I would expect too.

if it's equal to the authorized origin (= IDHCS origin)

Instead of checking for a fixed address, can we check against something like an authorized list (whitelist)? this would enable us to do key rotation and add white list other partners

[Kailai-Wang]

Thank you Kai. Option 1 is what I would expect too.

if it's equal to the authorized origin (= IDHCS origin)

Instead of checking for a fixed address, can we check against something like an authorized list (whitelist)? this would enable us to do key rotation and add white list other partners

Yes we will have some whitelist