DigitalID Client Registration 1.0 Implementers' Draft 5

Table of Contents

1. Scope

This document specifies the:¶

• client configuration that must be created upon receipt and validation of a Software Statement issued by the DigitalID Directory of Participants¶
• OIDC discovery provisions for an Authorisation Server and Client¶

This document is applicable to all participants engaging in DigitalID.¶

2. Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applied. For undated references, the latest edition of the referenced document (including any amendments) applies.¶

ISODIR2 - ISO/IEC Directives Part 2¶

RFC7519 - JSON Web Token (JWT)¶

RFC7591 - OAuth 2.0 Dynamic Client Registration Protocol¶

OIDC - OpenID Connect Core 1.0 incorporating errata set 1¶

RFC8705 - OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens¶

DigitalID-FAPI - DigitalID FAPI Security Profile 1.0¶

3. Terms and definitions

For the purpose of this document, the terms defined in DigitalID-FAPI, OpenID Connect Core apply.¶

4. Symbols and Abbreviated terms

API – Application Programming Interface¶

FAPI - FAPI security profile¶

HTTP – Hyper Text Transfer Protocol¶

OIDF - OpenID Foundation¶

OP - OpenID Provider¶

REST – Representational State Transfer¶

SS – Software Statement¶

SSA – Software Statement Assertion¶

TLS – Transport Layer Security¶

5. Introduction

ConnectID's ecosystem leverages a federation trust provider or directory of participants as the golden source of information on accredited participants and software that are authorized to partake in the DigitalID ecosystem.¶

The services by the Registry include:¶

• Software registration and management.¶
• Software credential registration and management using DigitalID Certificates.¶
• Software Statement Assertion (SSA) generation.¶

Together these services provide everything necessary to discover and register clients with providers within the scheme.¶

6. ConnectID OpenID Connect Registration

This specification defines the mechanism by which Clients are registered with Identity Providers.¶

As part of the onboarding and configuration process, Relying Parties Clients and associated metadata will be configured in the Digital Identity Registry. Identity Providers are required to synchronise the client information from the Registry to their Authorisation Servers to enable the Clients to be used.¶

IDP shall implement one of the following options for client synchronisation with the Registry: 1. Initial synchronisation (full) and periodic synchronisation at a regular intervals. Maximum refresh period shall be every 2 hours. Minimum refresh period shall be every 15 minutes. Recommended refresh period should be every hour. 2. Initial synchronisation (full) and monitoring for updates via webhooks.¶

In addition to client synchronisation, IDP shall: 1. Periodically refresh client's JWKS. Maximum refresh period shall be every 15 minutes. Minimum refresh period shall be every 1 minutes. Recommended refresh period should be every 5 minutes.¶

          .---.                                                        .--------.
          |IDP|                                                        |Registry|
          '---'                                                        '--------'
            |                                                               |
            |            POST /token (MTLS client authentication)           |
            |                   (client credentials grant)                  |
            |-------------------------------------------------------------->|
            |                                                               |
            |                          access token                         |
            |<--------------------------------------------------------------|
            |                                                               |
            |                 GET /clients                  |
            |                      (MTLS + access token)                    |
            |-------------------------------------------------------------->|
            |                                                               |
            |                    list of all clients                        |
            |<--------------------------------------------------------------|
            |                                                               |
  --------> |                                                               |
 | for      |--------                                                       |
 | each     |        | Register Client                                      |
 | client   |<-------                                                       |
  --------- |                                                               |
            |                                                               |
          .---.                                                        .--------.
          |IDP|                                                        |Registry|
          '---'                                                        '--------'

7. Software Statement

A software statement is a JSON Web Token (JWT) RFC7519 that asserts metadata values about the client software as a bundle.¶

{
  "iat": "1643723203",
  "iss": "sandbox SSA issuer",
  "redirect_uris": ["https://my.accountingapp.com/cb"],
  "token_endpoint_auth_method": "private_key_jwt",
  "grant_types": ["authorization_code"],
  "response_types": ["code"],
  "client_name": "Great Accounting App",
  "client_uri": "https://my.accountingapp.com",
  "logo_uri": "https://my.accountingapp.com/logo.svg",
  "scope": "openid",
  "tos_uri": "https://www.accountingapp.com/terms.html",
  "policy_uri": "https://my.accountingapp.com/policy.html",
  "jwks_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/26c2183c-5e9c-4a63-bc65-164d8e316719/application.jwks",
  "software_id": "26c2183c-5e9c-4a63-bc65-164d8e316719",
  "software_version": "1.0",
  "client_id": "26c2183c-5e9c-4a63-bc65-164d8e316719",
  "sector_identifier_uri": "https://my.accountingapp.com/redirect_uris.json",
  "subject_type": "pairwise",
  "claims": ["given_name", "family_name", "address"],
  "claims_in_verified_claims": ["over18", "over21"],
  "application_type": "web",
  "client_description": "This is a long detailed description of the application",
  "environment": "Production",
  "jwks_inactive_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/26c2183c-5e9c-4a63-bc65-164d8e316719/inactive/application.jwks",
  "jwks_transport_inactive_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/26c2183c-5e9c-4a63-bc65-164d8e316719/inactive/transport.jwks",
  "jwks_transport_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/26c2183c-5e9c-4a63-bc65-164d8e316719/transport.jwks",
  "mode": "Live",
  "roles": [],
  "status": "Active",
  "org_id": "c0ab3873-d86d-430e-bf09-63a097dd5f59",
  "org_jwks_inactive_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/inactive/application.jwks",
  "org_jwks_transport_inactive_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/inactive/transport.jwks",
  "org_jwks_transport_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/transport.jwks",
  "org_jwks_uri": "https://keystore.directory.sandbox.connectid.com.au/c0ab3873-d86d-430e-bf09-63a097dd5f59/application.jwks",
  "org_name": "Test Org",
  "org_number": "ABN123123123",
  "org_status": "Active",
  "organisation_competent_authority_claims": [
    {
      "authorisation_domain": "DigitalID",
      "authorisations": [],
      "registration_id": "BISROLE",
      "authority_name": "DigitalID Authority",
      "authority_id": "b44fac7c-af64-4948-8638-130d1cdf7f4d",
      "authorisation_role": "BIS",
      "authority_code": "ID",
      "status": "Active"
    }
  ]
}

Appendix A. Change History

Appendix B. Notices

Copyright (c) 2024 Australian Payments Plus (ConnectID).¶

Author's Address