ID Authentication

eSignet is integrated with the MOSIP ID Authentication module as an authentication provider. The defined plugins interface has been implemented using the APIs available in the MOSIP ID Authentication module.

Here is a list of the APIs that have been integrated into the eSignet plugin interface implementation.

• KYC Authentication API to perform authentication for an identity provider like eSignet

• KYC Exchange API to share an encrypted KYC token to an identity provider

• Key Binding API to authenticate a user to bind the ID and Wallet of an user

• VC Exchange API to share the VC associate to a user who was authenticated earlier and has shared the associated KYC Token

Appendix - API Specifications

KYC Authentication

API to perform the ID Authentication based on allowed auth policy. Does validation of provided path parameters before doing the actual authentication. Returns a new KYC token and partner specific user token. This API should be called from IdP service only.

post

/idauthentication/v1/key-auth/delegated/{IdP-LK}​/{Auth-Partner-ID}​/{oidc-client-id}

Path parameters

Auth-Partner-IDstringrequired

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

oidc-client-idstringrequired

OIDC client Id. Auto generated while creating OIDC client in PMS

IdP-LKstringrequired

IdP Service License Key. This LK is similar MISP-LK.

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

idstringrequired

IDA standard request ID. Eg: mosip.identity.kycauth

versionstringrequired

Version of the API. Current supported version is '1.0'

individualIdstringrequired

UIN/VID of the individual.

individualIdTypestring

Parameter to indicate individual type. Type can be UIN/VID

transactionIDstringrequired

any random alpha numberic string. Allowed max size is 10.

requestTimestringrequired

Request created time

specVersionstringrequired

IDA Specification version. Current Supported version is 1.0

thumbprintstringrequired

Thumbprint of the certificate used for encrypting the auth request.

domainUristringrequired

Domain uri of the server

envstringrequired

Name of the environment

consentObtainedbooleanrequired

User provided Consent either true or false

requestHMACstringrequired

HMAC value generated of the whole request.

requestSessionKeystringrequired

Session key used to encrypt the request.

allowedKycAttributesstring[]

Allowed KYC Attributes List.

metadataobject

Any additional attributes needs to be processedin authentication.

requestobjectrequired

Authentication Request with one of the auth challenges. Supported Challenges are: OTP, DEMO and BIOMETRICS

Responses

application/xmlapplication/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://api-internal.collab.mosip.net/idauthentication/v1/key-auth/delegated/{IdP-LK}​/{Auth-Partner-ID}​/{oidc-client-id}' \
  --header 'Content-Type: application/json' \
  --data '{"id":"text","version":"text","individualId":"text","transactionID":"text","requestTime":"text","specVersion":"text","thumbprint":"text","domainUri":"text","env":"text","consentObtained":true,"requestHMAC":"text","requestSessionKey":"text","allowedKycAttributes":[null],"metadata":{"property1":{},"property2":{}},"request":{"otp":"text","timestamp":"text","keyBindedTokens":{},"demographics":{"metadata":{"property1":{},"property2":{}},"name":[{}],"dobType":[{}],"gender":[{}],"addressLine1":[{}],"addressLine2":[{}],"addressLine3":[{}],"location1":[{}],"location2":[{}],"location3":[{}],"fullAddress":[{}]},"biometrics":[{"data":{"digitalId":{}}}]}}'

200

200

application/xml

application/json

application/xml

<?xml version="1.0"?>
<object/>

OK

kyc-exchange

API to validate kycToken returned in kyc-auth call that the kycToken belongs to the provided oidc-client-id and returns encrypted kyc to the caller. This API should be called from IdP service only.

post

/idauthentication/v1/kyc-exchange/delegated/{IdP-LK}​/{Auth-Partner-ID}​/{oidc-client-id}

Path parameters

IdP-LKstringrequired

IdP Service License Key. This LK is similar MISP-LK.

Auth-Partner-IDstringrequired

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

oidc-client-idstringrequired

OIDC client Id. Auto generated while creating OIDC client in PMS

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

idstringrequired

IDA standard request ID. Eg: mosip.identity.kycexchange

versionstringrequired

Version of the API. Current supported version is '1.0'

requesttimestringrequired

Request created time.

transactionIDstringrequired

Same transaction ID used in kyc-auth request.

individualIdstringrequired

UIN/VID of the individual.

kycTokenstringrequired

kyc token received in kycAuth API response.

resTypestring

Response Type for the user claims. Currently defaulted to signed JWT.

consentObtainedstring[]required

List of consents obtained from user.

localesstring[]

user selected list of languages.

Responses

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://api-internal.collab.mosip.net/idauthentication/v1/kyc-exchange/delegated/{IdP-LK}​/{Auth-Partner-ID}​/{oidc-client-id}' \
  --header 'Content-Type: application/json' \
  --data '{"id":"text","version":"text","requesttime":"text","transactionID":"text","individualId":"text","kycToken":"text","consentObtained":[null],"locales":[null]}'

200

200

{
  "id": "text",
  "version": "text",
  "responseTime": "text",
  "response": {
    "encryptedKyc": "text"
  },
  "errors": [
    {
      "errorCode": "text",
      "errorMessage": "text"
    }
  ]
}

OK

Key Binding

API to perform the ID Authentication based for the provided identity data and based on allowed auth policy. To identity the auth partner API will perform validation of provided path parameters before performing the actual authentication. Wallet will include a public key in the request to be binded for the input VID/UIN Returns a status of key binding, partner specific user token, certificate generated for the input public key (this certificate will be binded to the input VID/UIN). Certificate will be returned only when the authenticate is passed. This API should be called from eSignet service and from Inji Wallet.

post

/idauthentication/v1/identity-key-binding/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}

Path parameters

Auth-Partner-IDstringrequired

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

IdP-LKstringrequired

IdP Service License Key. This LK is similar MISP-LK.

OIDC-Client-Idstringrequired

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

idstringrequired

IDA standard request ID. Eg: mosip.identity.keybinding

versionstringrequired

Version of the API. Current supported version is '1.0'

individualIdstringrequired

UIN/VID of the individual.

individualIdTypestring

Parameter to indicate individual type. Type can be UIN/VID

transactionIDstringrequired

any random alpha numberic string. Allowed max size is 10.

requestTimestringrequired

Request created time

specVersionstringrequired

IDA Specification version. Current Supported version is 1.0

thumbprintstringrequired

Thumbprint of the certificate used for encrypting the auth request.

domainUristringrequired

Domain uri of the server

envstringrequired

Name of the environment

consentObtainedbooleanrequired

User provided Consent either true or false

requestHMACstringrequired

HMAC value generated of the whole request.

requestSessionKeystringrequired

Session key used to encrypt the request.

metadataobject

Any additional attributes needs to be processedin authentication.

identityKeyBindingobjectrequired

Key details needs to be binded to the identity after successful authentication.

requestobjectrequired

Authentication Request with one of the auth challenges. Supported Challenges are: OTP, DEMO and BIOMETRICS

Responses

application/xmlapplication/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://api-internal.collab.mosip.net/idauthentication/v1/identity-key-binding/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}' \
  --header 'Content-Type: application/json' \
  --data '{"id":"text","version":"text","individualId":"text","transactionID":"text","requestTime":"text","specVersion":"text","thumbprint":"text","domainUri":"text","env":"text","consentObtained":true,"requestHMAC":"text","requestSessionKey":"text","metadata":{"property1":{},"property2":{}},"identityKeyBinding":{"authFactorType":"text","publicKeyJWK":{"additionalProp1":{},"additionalProp2":{},"additionalProp3":{}}},"request":{"otp":"text","timestamp":"text","demographics":{"metadata":{"property1":{},"property2":{}},"name":[{}],"dobType":[{}],"gender":[{}],"addressLine1":[{}],"addressLine2":[{}],"addressLine3":[{}],"location1":[{}],"location2":[{}],"location3":[{}],"fullAddress":[{}]},"biometrics":[{"data":{"digitalId":{}}}]}}'

200

200

application/xml

application/json

application/xml

<?xml version="1.0"?>
<object/>

OK

vci-exchange

API to validate kycToken returned in kyc-auth call that the kycToken belongs to the provided oidc-client-id & issued to the same identity used in kyc-auth and returns verifiable credentials to the caller. This API should be called from eSignet service.

post

/idauthentication/v1/vci-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}

Path parameters

IdP-LKstringrequired

IdP Service License Key. This LK is similar MISP-LK.

Auth-Partner-IDstringrequired

Relying Party (RP) Partner ID. This ID will be provided during partner self registration process

OIDC-Client-Idstringrequired

OIDC client Id. Auto generated while creating OIDC client in PMS

Header parameters

signaturestring

Digital Signature of the Auth Request. IdP key will be used to generate the signature.

Body

idstringrequired

IDA standard request ID. Eg: mosip.identity.vciexchange

versionstringrequired

Version of the API. Current supported version is '1.0'

requesttimestringrequired

Request created time.

transactionIDstringrequired

Tansaction ID used in kyc-auth request.

individualIdstringrequired

UIN/VID of the individual.

credSubjectIdstringrequired

JWK DID of the Identity. Eg: did:jwk:ewogICAgImt0eSI6ICJSU0EiLAogICAgImUiOiAiQVFBQiIsCiAgICAibiI6ICJtaFZOaERpaW1WdTQxV0xCRWJzYVpLWUZRTTJrZXBHREQwWDRZNHp2VW8zZEVET3lTbDd0bXhha3RfVnlodXRJdWp3ZlJQMmxTTTRIQ2lZS3BYSXdBNmljVHIyWThDSnc2VDU1bWVRWWJmRHZxLV9QRXNWMDRobEYzUS10cnU2ajhPbUpRdWwzTGtSR05mN3Z6VFNSRmstUU9rcmNuVDRPaC1YbGhCRjhFNFFHNFdTVFF2Qk1xOVdTQ05lZjZkVWFOQ3JXY0lDQ1Q2bi1peHFKLTJBREEzYk5TcWpqS0REQktTM1VPRy1jbUlfTTdKY19BYWJod1JLLTM2blphWGJWLUdQYjR5UjdTNVY5MUhtdTZhS3JJdVdRM1ByY0FlWkZvZ1VuYjlLMUpHS0dhOWJ2S3F0TWd5TjNLdS1aMFdDT3Z1dUtMNndNNzduSDJWdGtJRDZNNVEiCn0

vcFormatstringrequired

Verifiable credential format needed in response object. Supported Format : ldp_vc

vcAuthTokenstringrequired

kyc token received in kycAuth API response.

localesstring[]

list of locales to be included in the issued VC.

metadataobject

credentialsDefinitionobjectrequired

Credential Definition Object of the Identity.

Responses

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://api-internal.collab.mosip.net/idauthentication/v1/vci-exchange/delegated/{IdP-LK}/{Auth-Partner-ID}/{OIDC-Client-Id}' \
  --header 'Content-Type: application/json' \
  --data '{"id":"text","version":"text","requesttime":"text","transactionID":"text","individualId":"text","credSubjectId":"text","vcFormat":"text","vcAuthToken":"text","locales":[null],"metadata":{"property1":{},"property2":{}},"credentialsDefinition":{"type":[null],"context":[null],"credentialSubject":{"property1":{},"property2":{}}}}'

200

200

{
  "id": "text",
  "version": "text",
  "responseTime": "text",
  "response": {},
  "errors": [
    {
      "errorCode": "text",
      "errorMessage": "text"
    }
  ]
}

OK