Latest Release

Version: 1.4.0

• Name: CTK 1.4.0

• Date: 15th April, 2024

• Release Notes

Version: 1.3.0

• Name: CTK 1.3.0

• Date: 5th January, 2024

• Release Notes

Version: 1.2.0

• Name: CTK 1.2.0

• Date: 14th July, 2023

• Release Notes

Version: 1.1.0

• Name: CTK 1.0.0

• Date: 19th February, 2023

• Release Notes

Version: 1.0.0

• Name: CTK 1.0.0

• Date: 3rd February, 2023

• Release Notes

Older Releases

Version: 0.0.9

• Name: CTK 0.0.9

• Date: 1st December, 2022

• Release Notes

Scope

The scope of testing revolved around verifying the compliance of the product as per the specifications published by MOSIP using the below devices:

The Windows Compliance tool kit was tested with the below specifications:

• ABIS (Automated Biometric Identification System) Specifications were tested with Fingerprint, Iris and Face modalities as per specifications.

• Secure Biometric Interface (SBI) with Compliance testcases collection and Quality Assessment testcases collection on below modalities

  • Registration devices for Iris, Face and Fingerprint

  • Authentication devices for Iris, Face and Fingerprint

• Biometric SDK

  • Quality Check

  • Match

  • Extraction

  • Conversion

The Android Compliance tool kit app v1.4.0 was tested with the below specifications:

• Secure Biometric Interface (SBI) with Compliance testcases collection and Quality Assessment testcases collection on below modalities

  • Registration devices for Iris, Face and Fingerprint

  • Authentication devices for Iris, Face and Fingerprint

Test Execution Statistics

ABIS Testing

MOSIP interfaces with an Automated Biometric Identification System (ABIS) to perform de-duplication of a resident's biometric data. A country may use multiple ABISs for the same biometric data and evaluate the best ABIS based on de-duplication quality. ABIS is used for 1:N de-duplication. For 1:1 authentication, Biometric SDK is used. MOSIP does not recommend using an ABIS for 1:1 authentication.

Test cases have been tested with MOSIP mock ABIS for compliance with the MOSIP specifications across 29 test cases.

Out of scope: Real ABIS testing in CTK 1.4.0

SBI Testing

The Secure Biometric Interface (SBI) is used to interface with biometric devices. The compliance tool kit was tested to ensure that the interface built by the device provider is following the specs and security rules defined in the SBI spec. The device hardware security features are not tested as part of compliance tool kit.

For Android Authentication Devices using MOSIP's Android mock SBI

The ‘Android CTK app v1.4.0’ with ‘MOSIP Android Mock SBI’ has been tested for compliance with the specifications. Test cases specific to quality and user interactions have been tested with MOSIP Android mock SBI.

For Android Registration Devices using MOSIP's Android mock SBI

The Android CTK app v1.4.0 with MOSIP Android Mock SBI has been tested for compliance with the specifications. Test cases specific to quality and user interactions have been tested with MOSIP Android mock SBI and real registration face SBI.

For Windows Authentication Devices using MOSIP's Windows mock SBI

The Windows CTK 1.4.0 with MOSIP windows Mock SBI has been tested for compliance with the specifications.

For Windows Registration Devices using MOSIP's windows mock SBI

The Windows CTK 1.4.0 with MOSIP windows Mock SBI has been tested for compliance with the specifications.

Out of scope: Real devices testing on Windows and android CTK v1.4.0.

SDK Testing

The SDK implementation has been tested to support quality check, match, extraction, and conversion of biometrics. Test cases have been tested with MOSIP mock SDK.

Out of scope: Segmentation testing and Real SDK testing.

Docker version (required for Compliance Tool Kit)

mosipqa/compliance-toolkit-batch-job:1.4.0

mosipqa/compliance-toolkit-service:1.4.0

mosipqa/compliance-toolkit-ui:1.4.0

mosipqa/postgres-init:develop

mosipid/config-server:1.1.2

mosipid/kernel-auditmanager-service:1.2.0.1-B1

mosipid/kernel-auth-service:1.2.0.1-B2

mosipqa/authentication-internal-service:release-1.2.0.1

mosipqa/authentication-otp-service:release-1.2.0.1

mosipqa/authentication-service:release-1.2.0.1

mosipid/kernel-keymanager-service:1.2.0.1-B2

mosipqa/keycloak-init:develop

mosipid/partner-management-service:1.2.0.1-B3

mosipqa/partner-onboarder:develop

mosipid/kernel-notification-service:1.2.0.1-B1

Known Issues

• Currently, ABIS partners can successfully create SBI and SDK projects in CTK 1.4.0, although role-based constraints to restrict this functionality is planned for future release

Sonar Report

MOSIP - Compliance-toolkit-service

MOSIP - compliance-toolkit-ui

Scope

The scope of testing revolved around verifying the compliance of the product as per the specifications published by MOSIP using the below devices:

The Windows Compliance tool kit was tested with the below specifications:

• ABIS (Automated Biometric Identification System) Specifications were tested with Fingerprint, Iris and Face modalities as per specifications.

• Secure Biometric Interface (SBI) with Compliance testcases collection and Quality Assessment testcases collection on below modalities

  • Registration devices for Iris, Face and Fingerprint

  • Authentication devices for Iris, Face and Fingerprint

• Biometric SDK

  • Quality Check

  • Match

  • Extraction

  • Conversion

The Android Compliance tool kit app v1.3.0 was tested with the below specifications:

• Secure Biometric Interface (SBI) with Compliance testcases collection and Quality Assessment testcases collection on below modalities

  • Registration devices for Iris, Face and Fingerprint

  • Authentication devices for Iris, Face and Fingerprint

Test Execution Statistics

ABIS Testing

MOSIP interfaces with an Automated Biometric Identification System (ABIS) to perform de-duplication of a resident's biometric data. A country may use multiple ABISs for the same biometric data and evaluate the best ABIS based on de-duplication quality. ABIS is used for 1:N de-duplication. For 1:1 authentication, Biometric SDK is used. MOSIP does not recommend using an ABIS for 1:1 authentication.

Test cases have been tested with MOSIP mock ABIS for compliance with the MOSIP specifications across 29 test cases.

Out of scope: Real ABIS testing in CTK 1.3.0

SBI Testing

The Secure Biometric Interface (SBI) is used to interface with the biometric devices. The Compliance tool kit was tested to ensure that the interface built by the device provider is following the specifications and security rules defined in the SBI spec. The device hardware security features are not tested as a part of Compliance tool kit.

For Android Authentication Devices using MOSIP's Android mock SBI

The Android CTK app v1.3.0 with MOSIP Android Mock SBI has been tested for compliance with the specifications across 55 test cases. Test cases specific to quality and user interactions have been tested with MOSIP Android mock SBI.

For Android Registration Devices using MOSIP's Android mock SBI

The Android CTK app v1.3.0 with MOSIP Android Mock SBI has been tested for compliance with the specifications across 64 test cases. Test cases specific to quality and user interactions have been tested with MOSIP Android mock SBI and real registration face SBI.

For Windows Authentication Devices using MOSIP's Windows mock SBI

The Windows CTK 1.3.0 with MOSIP windows Mock SBI has been tested for compliance with the specifications across 55 authentication spec test cases.

For Windows Registration Devices using MOSIP's windows mock SBI

The Windows CTK 1.3.0 with MOSIP windows Mock SBI has been tested for compliance with the specifications across 76 registration spec test cases.

Out of scope: Real devices testing on Windows and android CTK v1.3.0.

SDK Testing

The SDK implementation has been tested to support quality check, match, extraction, and conversion of biometrics. Test cases have been tested with MOSIP mock SDK.

Out of scope: Segmentation testing and Real SDK testing.

Known Issues

• CTK-Keycloak login field names in Arabic are not appearing in RTL.

• Forgot Password option is not working in CTK login page.

• Error message should be user friendly in CTK sign-in page.

• Column name is showing as 'View report'

• Getting 500 error for endpoint /v1/authmanager/authorize/invalidateToken in development environment.

Docker version (required for Compliance Tool Kit)

mosipqa/compliance-toolkit-service:1.3.0

mosipqa/compliance-toolkit-ui:1.3.0

mosipqa/postgres-init:1.2.0.1

mosipqa/postgres-init:1.2.0.1

mosipqa/postgres-init:develop

mosipid/config-server:1.1.2

mosipid/kernel-auditmanager-service:1.2.0.1-B1

mosipid/kernel-auth-service:1.2.0.1-B2

mosipqa/authentication-service:1.2.0.1

mosipid/kernel-keymanager-service:1.2.0.1-B2

mosipid/keycloak-init:1.2.0.1-B2

mosipid/partner-management-service:1.2.0.1-B3

mosipqa/partner-onboarder:develop

mosipid/kernel-notification-service:1.2.0.1-B1

mosipqa/keycloak-init:1.2.0.1

mosipqa/minio-client-util:latest

Sonar Report

MOSIP - Compliance-toolkit-service

MOSIP - compliance-toolkit-ui

Release Name: CTK 1.2.0

Upgrade From: CTK 1.1.0

Support: Stable Release

Release Date: 14th July, 2023

Overview

The 1.2.0 version of CTK includes the following new features:

1. CTK now supports ABIS testing

2. CTK now supports BQAT quality check on biomterics captured by SBI devices.

3. CTK now supports additional ISO validations for SBI after decoding the image.

Dependency

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

Post installation, follow the setup steps available here.

Documentation

• Feature Documentation

• Compliance Tool Kit User Guide

• Android CTK App user Guide

• QA Report

• Videos

Release Name: CTK 1.1.0

Upgrade From: CTK 1.0.0

Support: Stable Release

Release Date: 19th May, 2023

Overview

The 1.1.0 version of CTK includes the two new features:

1. Multiple Language support in CTK

2. Android SBI testing

Multiple Language support in CTK

• CTK will now support the application in multiple languages.

• While logging in, the partner can select a language from the dropdown.

• Therafter, the application will be displayed in the selected language.

• By default, CTK will support three languages- English, French and Arabic.

Android SBI testing

CTK will now support Android SBI testing using the Android CTK App.

Features Covered

The basic features such as,

• Create a Project

• Create a Collection

• Run a Collection

• View Details of a Test Run

• Add Biometric Data

are available as part of the releases.

The current version can be used by the device and biometric SDK vendors to test their SBIs and SDKs.

As a part of the SBI test suite, we support the verification schema and signature verification of,

• Interfaces

  • Device discovery

  • Device info

  • Capture

  • RCapture

• Certification Level

  • L0

  • L1

• Biometric Modalities

  • Fingerprints

  • Iris

  • Face

As a part of the SDK test suite in the current version, we support the verification of schema and interface level verification for,

• Interfaces

  • Initialization

  • Quality Check

  • Matcher

  • Extractor

  • Converter

• Biometric Modalities

  • Fingerprint

  • Iris

  • Face

The detailed list of the test cases for SBI and SDK in the 1.1.0 version of the Compliance Tool Kit are available here:

• SBI Test Cases

• SDK Test Cases

Dependency

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

Post installation, follow the setup steps available here.

Documentation

• Feature Documentation

• Compliance Tool Kit User Guide

• Android CTK App user Guide

• QA Report

• Videos

This section comprises instructional documents that can provide valuable insights into CTK for a diverse audience. It can be regarded as a knowledge hub that contains all the necessary additional information for effectively utilizing CTK.

Release Name: CTK 1.4.0

Support: Stable Release

Release Date: 15th April, 2024

Overview

The 1.4.0 version of CTK includes the following new features:

New Features in CTK 1.4.0 release

1. Quality Assessment Report is now available for Quality Assessment Collections. This report is eligible for review, similar to the Compliance Collection report.

2. Added a new CTK Landing page

3. Added Terms & Conditions consent popup for partners during login. If a partner does not provide consent, they will be automatically logged out.

SBI Testcases Enhancements

1. Added a negative SBI testcase SBI1196 where Discover request attributes are in UPPER CASE

2. Added testcases(SBI1197, SBI1198 and SBI1199) where bioSubTypes is optional in RCapture request

3. Enhanced all SBI schemas by adding "Additional Properties" as "false" in all nested objects as well. This will disallow any extra attributes at nested levels.

4. Community reported issue in the CTK UI GitHub repository is fixed - Android SBI CTK Check Device Status failed: SBI1028, SBI1029

5. In the trust validation process, we’ve now incorporated an additional check for the Organization Name. This check involves verifying both the logged-in user’s organization and the Subject Organization specified in the certificate. By doing so, we enhance the security and reliability of our validation procedures.

6. Responses from SBI RCapture will now be encrypted and stored in the CTK database.

7. In response to a community-reported issue, CTK now sends the ‘previousHash’ as the SHA256 hash of an empty UTF-8 string, rather than simply an empty string.

8. The attributes, "requestedScore" and "qualityScore" currently support floating point numbers in CTK schemas and testcases.

ABIS Testcases Enhancements

1. Added new ABIS DataShare related testcases ABIS3030, ABIS3031. ABIS3031 is inactive in this release since it needs some changes in kernel-auth-adapter.

2. Enhanced all ABIS schemas by adding "Additional Properties" as "false" in all nested objects as well. This will disallow any extra attributes at nested levels.

SDK Testcases Enhancements

1. Enhanced all SDK schemas by adding "Additional Properties" as "false" in all nested objects as well. This will disallow any extra attributes at nested levels.

Technical Enhancements

1. Added a Batch Job for Archival of oldest X test runs per collection to an archive table. This X is configurable.

2. API documentation

3. Create separate repository for CTK test cases.

4. CTK 1.4.0 test with latest released code of Mock MDS, Mock SDK and Mock ABIS

5. Capture BQAT version and other details in Quality Assessment Report

6. Fixed bugs identified in Security Testing of CTK

Repository Released

Dependency

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

Post installation, follow the setup steps available here.

Documentation

• Feature Documentation

• Compliance Tool Kit User Guide

• Android CTK App user Guide

• QA Report

• Videos

Release Name: CTK 1.3.0

Upgrade From: CTK 1.2.0

Support: Stable Release

Release Date: 5th January, 2024

Note:

1. On January 25th, 2024, the mosip-compliance-toolkit tag has been updated from v1.3.0 to v1.3.1 in order to resolve a bug in the BiometricsQualityCheckValidator during the conversion of bioScore into bioScoreRange.

2. Furthermore, on February 12th, 2024, an update was made to the mosip-compliance-toolkit tag from v1.3.1 to v1.3.2. This update aims to address the issue of missing table names in the ddl.sql located within the db_scripts folder.

Overview

The 1.3.0 version of CTK includes the following new features:

• Enhanced Report Generation and submission capabilities for CTK (Report for Review).

• Added Admin login functionality to enable viewing Partner Reports, conducting Test Runs, and approving or rejecting submitted Reports.

• Incorporated Quality Assessment testcases using BQAT quality check on biometrics captured by SBI devices.

• Additional Hash Validation testcases for SBI to ensure data integrity.

• Included support for Kibana Dashboards in CTK.

To know more about the Hash generation logic, read Hash Generation.

Repository Released

Dependency

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

Post installation, follow the setup steps available here.

Documentation

• Feature Documentation

• Compliance Tool Kit User Guide

• Android CTK App user Guide

• QA Report

• Videos

Release Name: CTK 0.0.9 (Beta)

Upgrade From: NA (First Release)

Release Date: 1st December, 2022

Overview

The 0.0.9 version of MOSIP’s Compliance Tool Kit is the first beta release which covers the essential features to test an SBI and Biometric SDK which follows MOSIP’s biometric specifications. The subsequent releases will have more aggressive test scenarios and integration components (like ABIS, Manual Adjudication & Manual Verification systems).

Features Covered

The basic features such as,

• Create a Project

• Create a Collection

• Run a Collection

• View Details of a Test Run

• Add Biometric Data

are available as part of the releases.

The current version can be used by the device and biometric SDK vendors to test their SBIs and SDKs.

As a part of the SBI test suite, we support the verification schema and signature verification of,

• Interfaces

  • Device discovery

  • Device info

  • Capture

  • RCapture

• Certification Level

  • L0

  • L1

• Biometric Modalities

  • Fingerprints

  • Iris

  • Face

As a part of the SDK test suite in the current version, we support the verification of schema and interface level verification for,

• Interfaces

  • Initialization

  • Quality Check

  • Matcher

  • Extractor

  • Converter

• Biometric Modalities

  • Fingerprint

  • Iris

  • Face

The detailed list of the test cases for SBI and SDK in the 0.9.0 version of the Compliance Tool Kit is available here:

Dependency

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

Documentation

Testing Scope

The scope of testing revolved around verifying the compliance of the product as per the specifications published by MOSIP using the below devices:

• Registration devices for iris, face and fingerprint

• Authentication devices for iris, face and fingerprint

The compliance tool kit was tested with the below biometric specifications:

1. SBI

2. SDK

3. Quality Check

4. 1:N Match

5. Extraction

6. Conversion

Test Execution Statistics

SBI Testing

The Secure Biometric Interface (SBI) is used to interface with biometric devices. The compliance tool kit was tested to ensure that the interface built by the device provider is following the specs and security rules defined in the SBI spec.

For Authentication Devices using MOSIP's mock SBI devices

The MOSIP’s Mock SBI has been tested for compliance with the specifications across 37 test cases. Test cases specific to quality and user interactions have been tested with real devices rather than mock.

For Registration Devices using MOSIP's mock SBI devices

The MOSIP’s Mock SBI has been tested for compliance with the specifications across 49 test cases. Test cases specific to quality and user interactions have been tested with real devices rather than mock.

For Authentication Devices using MOSIP's real devices (only finger)

The MOSIP’s real devices has been tested for compliance with the specification only for fingerprint devices.

For Registration Devices using MOSIP's real devices

The MOSIP’s real SBI has been tested for compliance with the specifications for iris, face and fingerprint devices.

SDK Testing

The SDK implementation has been tested to support quality check, 1:N match, extraction, and conversion of biometrics.

Out of scope: Segmentation testing

Sonar Report

Pre-requisites

CTK should be deployed along with the required dockers as mentioned below.

• compliance-toolkit-service: 1.4.0

• compliance-toolkit-ui: 1.4.0

• compliance-toolkit-batch-job: 1.4.0

To successfully deploy Compliance Toolkit, below mentioned services are mandatorily required.

Dependent Service (dockers)

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

The Setup guide serves as a checklist for the following three categories.

1. Configuration checks

2. Steps to load testdata, schemas, testcases and terms and conditions templates

3. Steps to generate Android APK

Configuration checks

1. Make sure that the kernel-default.properties file includes the mosip-toolkit-client and mosip-toolkit-android-client values in the auth.server.admin.allowed.audience setting. If these values are not set by default, configure them and then restart the kernel-auth-service and compliance-toolkit-service.

2. Ensure that in compliance-toolkit-default.properties, CORS is enabled to allow access to mosip-toolkit-android-client:

   If this was not set by default, then set it and restart compliance-toolkit-service.

3. Check if the roles given to mosip-pms-client match with any of the roles for the following config property: mosip.role.keymanager.postverifycertificatetrust=XXX

   For Example:

   mosip.role.keymanager.postverifycertificatetrust=ZONAL_ADMIN, GLOBAL_ADMIN, PMS_ADMIN, PMS_USER

   Ensure that the mosip-pms-client possesses any of the roles mentioned above.

4. Check that mosip-pms-client has the role REGISTRATION_PROCESSOR, PARTNER_ADMIN, PMS_ADMIN in Key Cloak. If this was not set by default, then set it and restart keymanager and compliance-toolkit-service.

5. It is also needed to generate an encryption key for CTK.

   • Insert the following row to create a new app ID.

     INSERT INTO keymgr.key_policy_def(app_id, key_validity_duration, is_active,pre_expire_days, access_allowed, cr_by, cr_dtimes, upd_by, upd_dtimes, is_deleted, del_dtimes) VALUES ('COMPLIANCE_TOOLKIT', 1095, true, 60, 'NA', 'mosipadmin', '2022-11-28 09:00:40.822625', null, null, false, null);

   • Using the auth manager swagger URL, obtain the client token.

     Swagger URL:

     Endpoint:

     Request:
   • Now using the key manager swagger URL, generate module level certificate.

     Swagger URL:

     Endpoint:

     Request:
   • Directly download the certificate through key manager swagger URL and getCertificate endpoint, with App Id as COMPLIANCE_TOOLKIT and Ref Id as COMP-FIR.
   • This certificate serves as the encryption key specifically for SBI devices.

     For Mock MDS, when running in Auth mode: update the below values in the application.properties file.

     For real MDS/SBI, the vendors can download the new encryption key from the UI and test with the updated SBI which uses this encryption key. It can be downloaded for Auth SBI projects from UI.
6. Ensure that reporting module is deployed from the develop branch. This is required for the Kibana Dashboard.

7. Ensure that the kernel-auth-adapter-1.2.0.1 has been successfully deployed in the compliance-toolkit-service, and verify that the identical authentication adapter was utilized to configure the mock ABIS.

8. Check datashare configurations for ABIS3030 and ABIS3031 testcases.

   • Ensure that in data-share-default.properties and compliance-toolkit-default.properties, the value of mosip-abis-client is set in auth.server.admin.allowed.audience. If this was not set by default, then set it and restart data-share-service and compliance-toolkit-service.

   • For handle CTK datashare token flow, add the below values in data-share-default.properties.

Steps to load testdata, schemas in MINIO

2. Project structure will be displayed as mentioned below.

3. The resources folder has schemas and test data that need to be added to MinIO.

Steps to load testdata and schemas directly in MinIO

1. Log in to MinIO from the browser.

2. Create a compliance-toolkit bucket.

3. Create a new folder named testdata in the above bucket.Upload MOSIP_DEFAULT_XXX.zip files from resources to it.

4. Create a new folder named schemas in the above bucket. Upload all SBI, SDK and ABIS schemas along with subfolders in it.

5. Upload testcase_schema.json from resources folder to schemas folder.

6. Please restart the compliance pods after adding new files in minio to refresh the cache.

Alternately, swagger endpoint can also be used to upload data in Minio. In this case there is no need to restart CTK services.

Steps to upload resources to Minio using Swagger

1. The swagger url is:

https://{api-internal-env-url}/v1/toolkit/swagger-ui/index.html?configUrl=/v1/toolkit/v3/api-docs/swagger-config

2. Using keycloak/ register option in CTK UI, create a new user for compliance toolkit.

3. Make sure to add the email ID. Also, give the role CTK_ADMIN.

4. Login to compliance toolkit in your environment from browser with the above Keycloak user.

5. Go to ResourceManagementController in swagger and upload the schema alongwith testdata files.

6. Then, select any one of type mentioned above and also mention the version (SBI/SDK/ABIS Version).

7. Select the type of required file which you want to upload from resources folder in project.

8. After execution you can see the response.

9. Check inside the Minio, in dev environment, whether the files have been uploaded into it.

Steps to upload test cases to the Database

2. Currently, CTK has a separate repository called compliance-toolkit-testcases, which includes the testcases for the SBI, SDK and ABIS.

4. compliance_test_definitions_sbi.json file have all the test cases in it.

5. Copy test cases array from this file and prepare a request as shown below.

6. Request body for saveTestCases request.

7. Then, execute it.

8. The same should be done for compliance_test_definitions_sdk.json and compliance_test_definitions_abis.json.

Steps to upload terms and conditions velocity templates to the Database

2. Provide the required parameters:

   • Specify the language for the template using ISO 639 standard language codes.

   • Enter the version of the template. (the template version should be in format as v1,v2,v3 and so on)

   • Enter the template name as terms_and_conditions_template.

3. The template file extension should be.vm(Velocity Template Language).

4. Then , execute it

Steps to generate Android APK

• Once all the steps mentioned above are completed, you can trigger the Android APK build for your environment. https://github.com/mosip/mosip-compliance-toolkit-ui/actions/workflows/android.yml

• You may need GitHub repository write access.

• Add values for the URL’s according to your deployment env.

The scope of testing revolved around verifying the compliance of the product as per the specifications published by MOSIP using the below devices:

• Registration devices for Iris, Face and Fingerprint

• Authentication devices for Iris, Face and Fingerprint

The Android Compliance tool kit App v1.1.0 was tested with the below specifications:

• Secure Biometric Interface (SBI)

The Windows Compliance Tool kit was tested with the below specifications:

Secure Biometric Interface (SBI)

SDK

• Quality Check

• Match

• Extraction

• Conversion

Test Execution Statistics

SBI Testing

The Secure Biometric Interface (SBI) is used to interface with the biometric devices. The Compliance Tool kit was tested to ensure that the interface built by the device provider is following the specs and security rules defined in the SBI spec. The device hardware security features are not tested as part of Compliance Tool kit.

For Android Authentication Devices using MOSIP's Android mock SBI

• The Android CTK app v1.1.0 with MOSIP Android Mock SBI has been tested for compliance with the specifications across 55 test cases.

• Test cases specific to the quality and user interactions have been tested with MOSIP Android mock SBI.

For Android Registration Devices using MOSIP's Android mock SBI

• The Android CTK app v1.1.0 with MOSIP Android Mock SBI has been tested for compliance with the specifications across 64 test cases.

• Test cases specific to quality and user interactions have been tested with MOSIP Android mock SBI and real registration face SBI.

For Android Registration Devices using MOSIP's Android mock SBI

The Android CTK app v1.1.0 with real Android registration face SBI has been tested for compliance with the specification only for registration face device.

For Windows Authentication Devices using MOSIP's Windows mock SBI

The Windows CTK v1.1.0 with MOSIP Windows Mock SBI has been tested for compliance with the specifications across 55 authentication spec test cases.

For Windows Registration Devices using MOSIP's Windows mock SBI

The Windows CTK v1.1.0 with MOSIP windows Mock SBI has been tested for compliance with the specifications across 76 registration spec test cases.

Out of scope: Real devices testing in windows CTK.

SDK Testing

The SDK implementation has been tested to support quality check, match, extraction, and conversion of biometrics. Test cases have been tested with MOSIP mock SDK.

Out of scope: Segmentation testing and Real SDK testing

Known Issues

Docker version (required for Compliance Test Kit)

mosipqa/compliance-toolkit-service: 1.1.0

mosipqa/compliance-toolkit-ui: 1.1.0

mosipqa/postgres-init: 1.2.0.1

mosipid/postgres-init :1.2.0.1-B2

mosipid/config-server: 1.1.2

mosipid/kernel-auditmanager-service: 1.2.0.1-B1

mosipid/kernel-auth-service:1.2.0.1-B2

mosipqa/authentication-service: 1.2.0.1

mosipid/kernel-keymanager-service: 1.2.0.1-B2

mosipid/keycloak-init: 1.2.0.1-B2

mosipqa/partner-management-service: 1.2.0.1

mosipqa/partner-onboarder: develop

mosipid/kernel-notification-service: 1.2.0.1-B1

mosipid/keycloak-init: 1.2.0.1-B2

mosipid/mosip-keycloak: 16.1.1-debian-10-r85

mosipqa/keycloak-init: develop

Sonar Report

MOSIP CTK Service

MOSIP CTK UI Repository

Pre-requisites

CTK should be deployed with the required dockers.

• compliance-toolkit-service: 1.1.0

• compliance-toolkit-ui: 1.1.0

To deploy Compliance Toolkit, we require only below mandatory services:

Dependent Service (dockers)

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

The Setup guide is a checklist for the three categories below:

1. Configuration Checks

2. Steps to load testdata, schemas and testcases

3. Steps to generate Android APK

Configuration checks

1. Ensure that in the kernel-default.properties, the value of mosip-toolkit-client and mosip-toolkit-android-client is set in auth.server.admin.allowed.audience. If this was not set by default, then set it and restart kernel-auth-service and compliance-toolkit-service.

2. Ensure that in compliance-toolkit-default.properties, CORS is enabled to allow access to mosip-toolkit-android-client:

   If this was not set by default, then set it and restart compliance-toolkit-service.

3. Check if the roles given to mosip-pms-client match with any of the roles for the following config property: mosip.role.keymanager.postverifycertificatetrust=XXX

   For Example:

   mosip.role.keymanager.postverifycertificatetrust=ZONAL_ADMIN, GLOBAL_ADMIN, PMS_ADMIN, PMS_USER

   Then mosip-pms-client should have any of the above roles.

4. Check that mosip-pms-client has the role REGISTRATION_PROCESSOR, PARTNER_ADMIN, PMS_ADMIN in Key Cloak. If this was not set by default, then set it and restart keymanager and compliance-toolkit-service.

5. From the CTK v 1.0.0 version onwards, we need to generate an encryption key for CTK.

   • Create a new app id by directly inserting the below row.

     INSERT INTO keymgr.key_policy_def(app_id, key_validity_duration, is_active,pre_expire_days, access_allowed, cr_by, cr_dtimes, upd_by, upd_dtimes, is_deleted, del_dtimes) VALUES ('COMPLIANCE_TOOLKIT', 1095, true, 60, 'NA', 'mosipadmin', '2022-11-28 09:00:40.822625', null, null, false, null);

   • Using the auth manager swagger URL, get the client token.

     Swagger URL:

     Endpoint:

     Request:
   • Now using the key manager swagger URL, generate module level certificate.

     Swagger URL:

     Endpoint:

     Request:
   • Directly download the certificate via key manager swagger URL and getCertificate endpoint, with App Id as COMPLIANCE_TOOLKIT and Ref Id as COMP-FIR.
   • This certificate is to be used by SBI devices as the encryption key.

     For Mock MDS, when running in Auth mode: update the below values in the application.properties file.

     For real MDS/SBI, the vendors can download the new encryption key from the UI and test with the updated SBI which uses this encryption key.It can be downloaded for Auth SBI projects from UI.

Steps to load testdata, schemas in MINIO

2. Project structure will be as shown below.

3. The resources folder has schemas, test data and testcases that need to be added to MinIO and DB.

Steps to load testdata and schemas directly in MinIO

1. Log in to MinIO from the browser.

2. Create a compliance-toolkit bucket.

3. Create a new folder named testdata in the above bucket.Upload MOSIP_DEFAULT_XXX.zip files from resources to it.

4. Create a new folder named schemas in the above bucket. Upload all SBI and SDK schemas along with subfolders in it.

5. Upload testcase_schema.json from resources folder to `schemas folder.

6. There is no need to upload compliance_test_definitions_sbi.json & compliance_test_definitions_sdk.json

7. Please restart the compliance pods after adding new files in minio to refresh the cache.

Alernately swagger endpoint can also be used to upload data in Minio. In this case there is no need to restart CTK services.

Steps to upload resources to MinIO using Swagger

1. The swagger url is:

https://{api-internal-env-url}/v1/toolkit/swagger-ui/index.html?configUrl=/v1/toolkit/v3/api-docs/swagger-config

2. Using keycloak/ register option in CTK UI create a new user for compliance toolkit.

3. Make sure to add the email ID. Also, give the role GLOBAL_ADMIN.

4. Login to compliance toolkit in your environment from browser with above the Keycloak user.

5. Go to ResourceManagementController in swagger, there you need to upload schema and testdata files.

6. Then you have to choose any one of the types which is mentioned above and also mention the version (SBI/SDK Version).

7. Select the type of required file which you want to upload from resources folder in project.

8. After execution you can see the response.

9. Check inside the MinIo in dev environment whether the files have been uploaded into it.

Steps to upload test cases to the Database

2. Open resources folder in project.

3. compliance_test_definitions_sbi.json file have all the test cases in it.

4. Copy test cases array from this file and prepare a request as shown below.

5. Request body for saveTestCases request.

6. Then execute it.

7. Same should be done for compliance_test_definitions_sdk.json.

Steps to generate Android APK

• Once all the steps mentioned above are completed, you can trigger the Android APK build for your env https://github.com/mosip/mosip-compliance-toolkit-ui/actions/workflows/android.yml

• You may need GitHub repository write access.

• Add values for the URL’s according to your deployment env.

Release Name: CTK 1.0.0 (Beta)

Upgrade From:

Release Date: 3rd February 2023

Overview

The 1.0.0 version of MOSIP’s Compliance Tool Kit is the first patch release on top of the release on top of 0.0.9 version. This release covers similar features as the 0.0.9 version but has additional test scenarios for the SBI, like

• Key Rotation Validations

• Quality Check Validation of the biometrics captured in SBI

• ISO Validation of the ISO data captured from the SBI

The subsequent releases will have more aggressive test scenarios and integration components (like ABIS, Manual Adjudication & Manual Verification systems).

Features Covered

The basic features such as,

• Create a Project

• Create a Collection

• Run a Collection

• View Details of a Test Run

• Add Biometric Data

are available as part of the releases.

The current version can be used by the device and biometric SDK vendors to test their SBIs and SDKs.

As a part of the SBI test suite, we support the verification schema and signature verification of,

• Interfaces

  • Device discovery

  • Device info

  • Capture

  • RCapture

• Certification Level

  • L0

  • L1

• Biometric Modalities

  • Fingerprints

  • Iris

  • Face

As a part of the SDK test suite in the current version, we support the verification of schema and interface level verification for,

• Interfaces

  • Initialization

  • Quality Check

  • Matcher

  • Extractor

  • Converter

• Biometric Modalities

  • Fingerprint

  • Iris

  • Face

The detailed list of the test cases for SBI and SDK in the 1.0.0 version of the Compliance Tool Kit is available here:

Dependency

• Artifactory: mosipid/artifactory-ref-impl: 1.2.0.1-B2

• Audit manager: mosipid/kernel-auditmanager-service: 1.2.0.1-B1

• Auth Manager: mosipid/kernel-authmanager: 1.2.0.1-B1

• Key Manager: modipid/kernel-keymanager-service: 1.2.0.1-B1

• Partner Management: mosipid/partner-management-service: 1.2.0.1-B1

• KeyCloak: mosipid/keycloak-init: 1.2.0.1-B1

• Postgres: mosipid/postgres-init: 1.2.0.1-B1

• Config Server: config-server: mosipid/config-server: 1.1.2

• Notification Service: mosipid/kernel-notification-service: 1.2.0.1-B1

• ClamAV: clamav/clamav: latest

• MinIO

Documentation

Testing Scope

The scope of testing revolved around verifying the compliance of the product as per the specifications published by MOSIP using the below devices: Registration devices for iris, face and fingerprint Authentication devices for the iris, face and fingerprint The compliance tool kit was tested with the below biometric specifications:

1. SBI a. Registration b. Authentication

2. SDK a. Quality Check b. 1: N Match c. Extraction d. Conversion

Test Execution Statistics

SBI Testing

The Secure Biometric Interface (SBI) is used to interface with biometric devices. The compliance tool kit was tested to ensure that the interface built by the device provider follows the specs and security rules defined in the SBI spec.

For Authentication Devices using MOSIP's mock SBI devices

The MOSIP’s Mock SBI has been tested for compliance with the specifications across 48 test cases. Test cases specific to quality and user interactions have been tested with real devices rather than mock.

For Registration Devices using MOSIP's mock SBI devices

The MOSIP’s Mock SBI has been tested for compliance with the specifications across 65 test cases. Test cases specific to quality and user interactions have been tested with real devices rather than mock.

For Authentication Devices using MOSIP's real devices (only finger)

The MOSIP’s real devices have been tested for compliance with the specification only for fingerprint and iris devices.

For Registration Devices using MOSIP's real devices

The MOSIP’s real SBI has been tested for compliance with the specifications for iris, face and fingerprint devices.

SDK Testing

The SDK implementation has been tested to support quality checks, 1:N matches, extraction, and conversion of biometrics.

Out of scope: Segmentation testing

Sonar Report

CTK Android App can be used to test the .

• After downloading the APK in Android device, the registered partner can launch the app which will redirect them to the login screen in browser.

• On successful login, a dashboard is displayed with the details of the existing SBI Projects. The partner can create new projects as well.

• To test the SBI implementation, partner can create collection of testcases and run them following the same steps as in the CTK web application.

To know more, watch the video below!

Compliance Tool Kit (CTK) is an online portal that can be used by MOSIP partners to test the compliance of their product developed as per specifications (specs) published/adopted by MOSIP.

Currently, CTK supports testing of compliance with the below specifications:

1. SBI: Secure Biometric Interface (SBI) is used to interface with biometric devices. Device partners are required to build a software layer that provides a unified communication protocol for all biometric capture use cases. The specifications that should be followed are defined as Secure Biometrics Interface (SBI) specs. The compliance tool kit ensures that the interface built by the device provider follows the specs, and a certain level of security and integrity is defined in the SBI spec. The device hardware security features are not tested as part of this toolkit.

   CTK also supports the testing with .

2. SDK: Biometric Service Providers (BSPs) provide SDK implementation which supports quality check, match, extraction, and conversion of biometrics. MOSIP defines an as the specification for this SDK implementation. Biometric SDK providers are also required to integrate this into their solution. This allows running the SDK as an independent HTTP service. The compliance tool kit would make sure that these interfaces are as per the MOSIP-defined specifications for smooth interaction.

3. ABIS: To provide a unique identity for a resident, MOSIP has to ensure that the uniqueness of the resident's biometrics is maintained. To achieve this, MOSIP interfaces with an Automated Biometric Identification System (ABIS) to perform the de-duplication of a resident's biometric data. ABIS is used for 1:N deduplication. MOSIP interacts with ABIS only via message queues. The JSON format is used for all control messages in the queue. ABIS must comply with the interface defined in .

How does Compliance Tool Kit work?

• To support compliance with the specifications, CTK has predefined test cases for each of the above specs.

• Each test case is run on a given method of the specs. Each test case defines the attributes required to create the request to be sent to the method.

• Each test case also defines the response expected from the method. In this response, various validators are run. Each validator will perform a predefined check on the response. If all validations are successful, the test case is passed otherwise it is a failed test case.

• Partners can use CTK to run these test cases to check if their implementation adheres to the MOSIP’s specs or not.

Architecture

The diagram below illustrates the architecture of Compliance Tool Kit.

Default Collections for CTK

• When a new project is created, two new collections will be automatically added to the project.

• The first collection is the Compliance Collection, which is applicable for all project types. The second collection is the Quality Assessment Collection, specifically for SBI projects.

Compliance Collection Reporting Process (for all project types)

• Partners can run the Compliance Collection and they can generate Draft Report for the same.

• After self-review, the partners can submit the Draft Report for review by the CTK Admin.

• CTK Admin can review the partner's test run, project details and all other details before Approving or Rejecting the Report.

• Final report can be downloaded by both, the partner and CTK Admin.

Summarizing as below:

• Partner > Add Project > Compliance Collection > Run Collection (Test Run) > View Test Run > Download Draft Report > Submit for Review

• CTK Admin > View Draft Report / View Test Run > Approve / Reject Report

Quality Assessment Collection Reporting Process (only for SBI)

• The Quality Assessment Collection reporting procedure is very similar to the Compliance Collection process.

• Using this collection, partner can collect biometric scores for various groups of individuals (age wise, gender wise, occupation wise etc.).

• BQAT SDK provides biometric score.

• This biometric score serves as the basis for evaluating the quality of the SBI partner..

Summarizing as below:

• Partner > Add Project > Quality Assessment Collection > Run Collection (Test Run) > View Test Run > Download Quality Assessment Draft Report > Submit for Review

• CTK Admin > View Quality Assessment Draft Report / View Test Run > Approve / Reject Report

Compliance Tool Kit Portal

Build and deploy

To access the build and read through the deployment instructions, refer to the below-mentioned READMEs:

Configurations

Developer Guide

Source code

To access the source code for Compliance Tool Kit, refer,

This guide will help the partners in using the Compliance Took Kit portal.

Below are simple steps to use this portal:

1. The partners using the compliance tool kit should be registered partners in the system.

2. Login into CTK with the same credentials.

3. Partner can also select their preferred language while logging-in.

4. Create a project of type SBI / SDK / ABIS.

5. Create a collection by selecting the test cases that you want to test.

6. Provide the necessary details to connect to your device / SDK / ABIS service.

7. Execute the Test Run by running the collection.

8. For executing each test case, follow the instructions on the screen.

9. Once the entire collection is run, the results of the number of test cases passed or failed will be displayed.

10. You can see all the Test Run details as well. For example, the request sent to SBI, the response received from SBI, validations performed on the response and the result.

11. Test runs previously executed will be available in the Test Run history.

12. More collections can be created as per the test cases required.

Compliance Toolkit Landing Page

On the CTK landing page, partners can view the introduction of the CTK portal and watch a video about CTK. Additionally, they can login or register by clicking the respective buttons. The landing page also provides links to other resources such as the GitHub repository, documentation, and partner details.

Additionally, it showcases several robust features of CTK, including its pre-defined test cases, validation mechanisms, and comprehensive reporting.

The landing page offers details about the SBI, Android SBI, SDK, and ABIS specifications. Furthermore, partners have the option to download the compliance toolkit APK by choosing the download button.

Login

The partner needs to enter the registered username or e-mail and password to log in.

The partner can select the language of their preference from the dropdown in the top-right corner of the screen. Thereafter, the application is displayed in the selected language. By default, CTK supports the following languages:

• English

• French

• Arabic

Note: After registering, partners need to login the partner management portal to retrieve partner details.

Terms and Conditions Consent

After logging in, partners will encounter a Terms & Conditions popup window. Partner must accept these terms; otherwise, they will be logged out.

Also, upon logging in, partners will be prompted with a popup if there have been any changes to the Terms & Conditions since their last consent.

Dashboards

After accepting the Terms & Conditions, partners gain access to the Project Dashboard by default. Additionally, they have the option to explore the Biometric Data Dashboard and My Reports Dashboard.

• Project: A project is a module that the partner wants to test. For example, if a device partner has developed a new version of their SBI for the fingerprint slap device, then, they can create a project in the compliance tool kit to verify this version of SBI.

• Biometric Data: As a part of the CTK, there is an option for the partner to upload their test data which can be used to verify the partner’s software. Currently, in MOSIP, we can upload test data for an SDK and ABIS.

• My Reports: Partners of CTK will be able to view the reports that they have submitted for review as well as the status of those reports.

Project dashboard

Below are the possible activities as part of the Project Dashboard.

• View all the projects on the dashboard

• Create a new project

• View a specific project

• Archive a project

• Move to the biometric data dashboard

Let us go through each of them in detail.

View projects

Once the partner logs into the compliance tool kit, they can view all the existing projects in the dashboard.

The project dashboard will display the following attributes of a project:

• Name of the project

• Project Type

• Total number of collections in the project

• Creation date and time of the project

• Last time a collection in the project was run

• Status of the last run on the project

The filter option in the dashboard will filter based on the name of the project, project type and the creation date and time.

Create a project

• On the Projects Dashboard, select the +Add Project button.

• The page will redirect the partner to the ‘Add a new Project’ page as shown below.

• Enter a unique Project Name and select the Project Type. Currently, MOSIP supports three types of projects: SBI, SDK and ABIS

• Based on the project type selected, the partner needs to enter the mandatory configurations before saving the project.

• When the project type selected is SBI, the partner needs to provide/select the below configurations:

  • Spec Version: MOSIP SBI specification for which the SBI is built

  • Purpose: The purpose of the device

  • Device Type: The type of device

  • Device SubType: The Subtype of the device

  • SBI Hash: Encoded hash of SBI installation file

  • Website URL: Partner website URL

  • Device Images: The image of the device

• When the project type selected is SDK, the partner needs to provide the below configurations:

  • Base URL: URL where the SDK is deployed

  • Spec Version: MOSIP SDK specification for which the SDK is built

  • Purpose: Purpose of the SDK

  • SDK Hash: Encoded hash of SDK installation file

  • Website URL: Partner website URL

  • Test Data: Input data needed for the run

• When the project type selected is ABIS, the partner needs to provide the below configurations:

  • Active MQ URL: URL where the ABIS is deployed

  • Modality: Combinations of different modality

  • Username: Username of Active MQ URL

  • Password: Password of Active MQ URL

  • Request Queue Name: Outbound Queue Name

  • Response Queue Name: Inbound Queue Name

  • Spec Version: MOSIP ABIS specification for which the ABIS is built

  • ABIS Hash: Encoded hash of ABIS installation file

  • Website URL: Partner website URL

  • Test Data: Input data needed for the run

Note: ABIS partner can only create ABIS project.

• After entering data, partners can click Save Project. Popup ask's partner to confirm the hash value and website URL before proceeding. Click on the Save again to confirm if values are correct.

• Once the project is saved, a successful message is displayed and a popup appears on the screen which when closed redirects the partner to the project dashboard (home).

Possible values for the Purpose attribute in SDK are:

• Matcher

• Check Quality

• Extract Template

• Convert Format

Download Encryption Key

• Once the project is created by the partner, they can download the encryption key.

• Partner can download encryption key for Auth devices.

View a specific project

Details of a specific project can be viewed

• By clicking on the name of the project, or,

• By clicking on the option View in the options section of the project row.

Once you click on the above-mentioned link, you will be redirected to the project details page of the specific project.

Move to the biometric data dashboard

• Click on the Biometric Data button on the projects dashboard screen.

• The partner will now navigate to the Biometric Test Data screen where they can add multiple biometric test data files.

Biometric data dashboard

Possible activities as a part of the Biometric Data Dashboard are:

• View all the biometric data collected on the dashboard

• Upload new biometric data

• Download biometric data

• Delete biometric data

• Move to the project dashboard

View all the biometric data

To view the biometric test data collection, click on Biometric Data on the Dashboard.

The biometric data dashboard should display the below attributes of a biometric data

• Name of the biometric data

• Type of data

• Purpose of the data

• The file name of the data

• Creation date and time of the biometric data

Filter in the dashboard should be able to perform filter based on the name of the biometric data, type, purpose and creation date and time.

Upload new biometric data

• On the Biometric Test Data page, click +Add Biometric data, it redirects the partner to the Upload Biometrics Test Data screen.

• Provide a unique name for the biometric data

• Based on the type selected, the partner needs to enter the respective mandatory details before saving the biometric data.

• When the project type SDK is selected, the partner needs to provide the below details:

  • Purpose: The purpose of the test (SDK test type)

  • Test Data: The test data is to be uploaded as a ZIP

• When the project type ABIS is selected, the partner needs to provide the below details:

  • Test Data: The test data is to be uploaded as a ZIP

  Note: ABIS partner can only upload an ABIS biometric test data.

The Test Data section has two options Browse and Download Sample File.

The Browse button will be the file explorer in the system for the partner to select the test data ZIP to be uploaded.

The Download Sample File button will download a blank ZIP file with instructions in the README of the test case so that the partner can prepare and add biometric test data.

Download test data

• Once the test data is uploaded to the server it can be downloaded by the partner,

  • Clicking on the name of the biometric data in the biometric data, or,

  • Clicking on the Download Zip in the options menu of the biometric data.

My Reports Dashboard

In this dashboard, users have the capability to view reports that have been submitted for review and they can download the submitted reports and check the current status of submiited report, providing a streamlined and efficient way to manage their submissions.

The My Reports Dashboard will display the following attributes of a report:

• Project Type

• Name of the project

• Comments added by user while submitting report

• Date when report was submitted

• Date when report was approved/rejected

• Comments of reviewer

• Download or view the report document

• Current status of the report

The filter option in the dashboard will filter based on the name of the project, project type and the creation date and time.

Users have the option to click on the Project Name, allowing them to navigate directly to the view project dashboard for the respective project.

Users can simply click on the Download button to retrieve the report submitted for the respective project.

Collections

A collection is a group of test cases selected by the partner for a particular project configuration. Inside a project, they can create multiple collections based on their choice of test cases selected. As part of the collection, they can perform the below activities:

• Create a collection

• View a collection

• Run a collection

• View the run history of a collection

• Generate Draft Report for Compliance Collection

• Archive a collection

Create a Collection

• To create a collection for a project:

  • Navigate to the project details page by clicking on the project name or View option in the options list.

  • By default, application will create a Compliance Collection for the project, and it includes all the test cases that are based on project details.

  • Quality Assessment Collection will only be added by default for SBI projects, and it includes only quality assessment testcases.

  • Click on the Add Collection button and you will be redirected to the Add Collection screen.

• Enter a unique name for the collection.

• Select the test cases to be added to the collection

  • The test cases will be displayed in a tabular format with ID, Name, Description and Validator details.

  • Beside every test case, there will be a check box which needs to be selected by the partner.

• After selecting the test cases, the partner can click on the Save Collection button to save the collection.

• Once a collection is successfully created, there is a success popup shown and the partner is redirected to the Project details page.

• Once a collection is created it is displayed on the Collection Dashboard which is available on the Project details page.

Few points to note:

• A collection cannot be saved if no test cases are selected.

• A collection name cannot be empty, the partner needs to provide a unique collection name before saving the collection.

• Every collection row in the dashboard has the option to view the name of the collection, the number of test cases selected as a part of the collection, the creation date, the View Report, the Last Test Run and the Run history of the collection.

View a Collection

Once the partner creates a collection, they can view the collection details by clicking on the collection name.

Run an SBI Collection

• Before running a collection in SBI, the partner needs to connect to a device without which they cannot proceed with testing.

• The partner should click on the Scan Device button in the Collection Dashboard as shown below.

• This triggers a scan of all the configured ports in the system where the SBI is connected.

• If any device connected with an SBI is found, the application asks the partner to select an available port and the device for running the test.

• If any device is not found, an error popup is displayed to the partner with an option to Scan Again.

• Once the device is selected, the partner can click on the Save button.

• After the device is selected and saved in memory, the Run button for the collections is enabled.

• If a device is already scanned and selected before running the collection, the partner can choose to re-scan and select another device for running the test case.

• If a device is selected, the partner can click on the Run button to run the test case.

• If the partner selects a Fingerprint Slap device but the collection is for a Double Iris device, then the test case is not executed. The partner will be shown an error message and asked to re-select the correct device. The combination validated here is for Purpose, Device Type and Sub Type as displayed below.

• If the correct device is selected and the partner initiates the test run, the test case execution should start.

• During the test run,

  • A progress bar will be shown with the percentage of tests execution completed

  • A timer to show the time elapsed during the execution

  • Option to close or cancel the test run

  • Option to initiate capture for a test case or resume run after completing the operation.

• The test run also shows,

  • The total test cases getting executed for that run

  • The current test case name

  • Instructions (if any) for the partner to follow

• Once the test execution is completed, the partner can see,

  • A high-level result with the number of test cases executed- with the number of test cases failed and the number of test cases passed in the run.

• The partner can also see the time elapsed

• They can also view the detailed test run report

Run an SDK Collection

Before running the SDK collection, the partner can change the Test Data, the Base URL and the SDK Hash in the project settings

• Click the Run button of the specific collection.

• The application now checks if the URL shared by the partner is accessible or not. If not accessible, the application shows an error message to the partner.

• Once the run initiates with the proper URL, the execution should complete on its own and during the run, the partner can see:

  • A progress bar with the percentage of test execution completed.

  • A timer to show the time elapsed during the execution.

  • Option to close or cancel the test run.

• Once the test execution is completed, the partner can see:

  • A high-level result with the number of test cases executed- with the number of test cases failed and the number of test cases passed in the run.

  • They can also see the time elapsed.

  • They also have the option to view the detailed Test Run report.

Note: For a test run, the partner can select their data or MOSIP’s default data. But let us assume that the partner chooses their data, but in the ZIP file, they have missed adding data for a particular test case, then the system should take MOSIP’s data for the test case' execution.

Run an ABIS Collection

Before running the ABIS collection, the partner can change the Username, Password, Queue names, Test Data, ABIS Hash and the Actice MQ URL in the project settings

• Click the Run button of the specific collection.

• Once the run initiates with the proper URL, the execution should complete on its own and during the run, the partner can see:

  • A progress bar with the percentage of test execution completed.

  • A timer to show the time elapsed during the execution.

  • Option to close or cancel the test run.

• Once the test execution is completed, the partner can see:

  • A high-level result with the number of test cases executed- with the number of test cases failed and the number of test cases passed in the run.

  • They can also see the time elapsed.

  • They also have the option to view the detailed Test Run report.

Note: For a test run, the partner can select their data or MOSIP’s default data. But let us assume that the partner chooses their data, but in the ZIP file, they have missed adding data for a particular test case, then the system should take MOSIP’s data for the test case' execution.

View the run history of the Collection

The partner after completing a successful test run can view the detailed run by,

• Clicking on the View Test Run button once the test execution is completed.

• Clicking on the View Last Test Run option in the options section of the collection as shown below.

Once the partner selects the View Last Test Run option, the application will redirect the partner to display the test run details as shown.

• Clicking on the Test Run History option in the options section of the collection and then click on the Details button of the test run that they want to view

Once the partner clicks on Details, it redirects the partner to the test details as shown above.

• On the Test Run History page, the partner can view:

  • Run date

  • Overall run status

  • Total test cases in the collection

  • Test cases passed

  • Test cases failed

The partner will be able to view the details of any test run they wish.

• On the Test Run details page, the partner can view,

  • List of the test cases in the collection

  • Test case ID

  • Test case Name

  • Status of the test case (Pass or Failed)

  • Execution status of the test case (Complete or Incomplete)

  • Option to view details of the test case

• The details of the test case contain,

  • The request that was sent

  • The response that was received

  • The detailed status of validators that ran in the test case

Generate Draft Report for Compliance Collection

The partner can only generate a Draft Report after running Compliance Collection.

• By default, Compliance Collection will be added when the project was created.

• Click the Run button of the Compliance Collection.

• Once the test execution is completed, the partner can see,

  • A high-level result with the number of test cases executed- with the number of test cases failed and the number of test cases passed in the run.

  • They also have the option to view the detailed Test Run report.

• Partner can create a Draft Report by clicking the Generate Draft Report button.

• Once the report is downloaded, the partner can view:

  • The downloaded draft report, which uses the project name as its filename.

  • A popup will appear to submit the report for review.

• Partners need to check the downloaded Draft Report, which contains their details, project specifics, test cases, and the complete test run results. These results include the number of test cases executed, passed, and failed.

• After reviewing the downloaded report, the partner can submit it for review by checking the checkbox in the popup window. They can then proceed by clicking the Send For Review button to finalize the submission.

• Once submitted the report, the Compliance Collection cannot be rerun for the project. The partner can download the submitted report by clicking on the download icon.

Generate Quality Assessment Draft Report for Quality Assessment Collection

The partner can only generate a QA Draft Report after running Quality Assessment Collection.

• By default, Quality Assessment Collection will be added when the SBI project was created.

• Click the Run button of the Quality Assessment Collection.

• After completing the test execution, the partner will be able to view the below mentioned results

  • A high-level result with the number of test cases executed- with the number of test cases failed and the number of test cases passed in the run.

  • They also have the option to view the detailed Test Run report.

• Partner can create a Quality Assessment Draft Report by clicking the Generate Draft Report button.

• Once the report is downloaded, the partner can view:

  • The downloaded QA draft report, which uses the project name as its filename.

  • A popup will appear to submit the report for review.

• After downloading the report, partners can review the QA Draft Report. This report includes their details, project specifics, test cases, and a comprehensive summary of the test run results, including the number of test cases executed, passed, and failed.

• This report also includes the biometric scores classification for each SDK and SBI.

• After reviewing the downloaded report, the partner can submit it for review by checking the checkbox in the popup window. Following that, they can click the Send For Review button to finalize the submission.

• Once the report has been submitted, the ability to re-execute the Quality Assessment Collection for the project is no longer available. Partners can retrieve the submitted report by clicking on the download icon.

Partner Reports Dashboard

When users with the special CTK Admin role access the application, they are granted access to the Partner Reports Dashboard. This dashboard serves as a centralized hub, offering a comprehensive overview of partner reports.

Below are the possible activities as a part of Partner Reports Tab of the Admin Dashboard.

• Explore a comprehensive list of all reports that have been submitted.

• Efficiently sort and examine reports based on their current status.

• Download and view report submitted.

• Access a preview of the project's test run associated with the submitted report.

• Take decisive action on submitted reports by either approving or rejecting them.

View reports

Upon logging into the compliance toolkit and navigating to the Partner Reports Dashboard, the admin will be presented with a default view showcasing reports submitted for review.

The Partner Reports Dashboard will display the following attributes of a report:

• Name of the partner

• Organization name to which partner belongs to.

• Type of project

• Name of the project

• Partner's comments about the report

• Date when report was submitted

• Current status of the report

• Download or view the report document.

• Access associated test runs and results.

• Approve the report.

• Reject the report.

Filter Reports for Efficient Navigation

The dropdown option in the tab allows you to filter reports based on their current status. There are three available options

• Review (Default): Displays reports that are currently under review.

• Approved: Shows reports that have been approved.

• Rejected: Displays reports that have been rejected.

The filter option in the dashboard will filter based on the name of the project, project type and the creation date and time.

Download reports

When you click on the download icon, the report will be downloaded. Admins can then view the downloaded report and make decisions based on the information it contains.

Preview test run details

Admin can click on the View Test Run link to access detailed information about the test run associated with the report.

Approve/Reject Report

After reviewing the downloaded report and verifying its content, the admin can choose to either approve or reject the report. Optionally, comments can be added to provide additional context or feedback during the decision-making process.

Approve Report: After reviewing the downloaded report, if it meets the criteria and is deemed satisfactory, the admin can proceed to click on the Approve button.

• After selecting the Approve button, a confirmation popup will be displayed to verify the approval action. Admins should review the information provided and, if satisfied, proceed by selecting the checkbox within the popup to finalize the approval.

• After selecting the checkbox, the admin will be presented with an option to add optional comments, if needed, after that the admin can proceed by clicking the Approve button to officially approve the report.

Reject Report: After reviewing the downloaded report, if it does not meet the criteria, the admin can initiate the rejection process by clicking on the Reject button.

• After clicking the Reject button, a popup will appear to confirm the rejection action. After reviewing the information, and once satisfied with the decision, the admin can proceed by checking the checkbox within the popup to finalize the rejection.

• After selecting the checkbox, the admin will be presented with a comment box to add mandatory comments, specifying the reason for rejection. After providing the required comments, the admin can proceed by clicking the Reject button to officially reject the report.

Test Runs Archival Batch Job

Compliance Toolkit has a batch job process that archives X number of test runs for each collection.

Consider this scenario: If there are 15 test runs, with an offset of 10, the most recent 10 will be retained, while the remaining 5 will be moved to an archival table. In the test-run-history, only the last 10 test run records are visible to partners.

A partner can test both their JAR based or docker service based biometric SDKs with MOSIP's Compliance Tool kit. In this document, we have provided the steps that can be followed by the partner to enable the testing of both these solutions.

Test using a SDK JAR

Partners having SDK JARs can test their biometric SDK JARs using Compliance Tool kit, by wrapping their SDKs in MOSIP’s BioSDK Services which provides REST endpoints to interact with the SDK jar.

• Checkout MOSIP’s Bio SDK Services from https://github.com/mosip/biosdk-services.git. Make sure to checkout the code from develop branch.

• Build the code with command mvn clean install -Dgpg.skip.

• After the build is successful, place your SDK jar in the biosdk-services\biosdk-services\lib folder.

• Create a bat file to run biosdk-services.

  Here, the LOCAL_PATH is the installation directory path for the Bio SDK Service and SDK_JAR_NAME is the SDK JAR name.

• Once the Bio SDK Service is running, check if the JAR is working using the Swagger available at URL: http://localhost:9099/biosdk-service/swagger-ui.html

• In Compliance Tool kit, for the SDK project, configure the BASE_URL as: http://localhost:9099/biosdk-service.

Test using docker service

Partners having SDK docker service can test their SDKs using Compliance Tool kit by running their docker service to provide REST API’s to access SDK methods.

Once the docker is deployed and accessible, the partner needs to add the correct URL in the SDK project to access the docker service directly.

Note:The partner may face the CORS issue. To get around this, they can allow the Compliance Tool kit URL in their controllers using @CrossOrigin("<URL>") annotation.

Otherwise, a proxy service can be used, which would redirect all the calls to the docker.