Identification Report

JSON-Schema for a certain kind of payload to JSON Web Token (Signature)

Motivation

Online identification is a transient process. The corresponding assertions have a short time to live to prevent attacks (e.g. replay attacks). Furthermore assertions and user token are generally encrypted. Therefore it is barely possible to prove a successful identification process later since you cannot use the assertions or user token. Then it is sometimes handy to have a token that proves a successful identification process. This little schema started as a first approach to have such a piece of text. The followig sequence diagram show the idea behind this identification report

Schema Description

Some ideas are taken from the XTA2 Service Report (see "XTA 2 Version 4" here). Some were results of discussions with the public administration in Germany.

The following attributes are currently in place.

Attribute	Type	Description
reportId	string	Must be unique to a single report. GUID is recommended here.
serverIdentity	string	This is a server id as software instance. This could be the server IP address, servername or the URL of the SAML endpoint providing this identity report (like ServerIdentity in XTA2 Version 4).
reportTime	string (date-time)	Datetime of the creation of this report (like ReportTime in XTA2 Version 4).
identificationTime	string (date-time)	Datetime of the identification process as stated in the original id statement.
idStatus	string (enum)	This is the value to indicate the status of the identification process. In case of failure the corresponding reason shall be stated in the idStatement attribute.
idStatement	string	This is the error reason or some additional information in case of unknown or success situations. The corresponding message should be human-understandable.
subjectRef	object	This should be a short link to the subject authenticated. Currently supported: firstName and lastName. This can easily extended but keep in mind that this field is sensible according to data privacy and should contain just enough data to link to a person.
subjectRefType	string	Describes the object placed in "#subjectRef". This must be a schema-id of another schema. There are publicly available schema-definitions here: https://github.com/Governikus/IdReport-SubjectRefSchemas.
contextInformation	array (string)	The element corresponds to the TransactionContext in BSI TR-03130 which MAY be used to transmit context information. To have a link between this identification report and the service for which the identification process was started.
documentReferences	array (objects)	This element can contain references to documents including their hashes. This is an optional attribute since this is not always needed. This might be useful in some usecases.
levelOfAssurance	string (enum)	in eIDAS contexts an id scheme (if it is notified) has a known LoA. When used in a national context only the values from the authority `bsi.bund.de` SHALL be used, which correspond to the levels as defined in TR-03107-1. See also BSI TR-03130.
trustFramework	string	the type of the executed authentication. This type will also determine the loaSent-attribute.

Sample Data

The schema can be found in the schema directory. You will find the JSON Web Token there as well as the payload. If you want to verify the sample on your own feel free to use the certificate and key found in Signature Material.

Header

{
  "alg": "RS256",
  "typ": "JWT"
}

Report Sample (as payload for JWT)

Signature Material

If you want to verifiy the JWT yourself feel free to use the test keys found here.

Private Key

Certificate