Authorization Server for Authentication Using Inji Wallet Credentials

Overview

Online Login enables users to securely access digital services using a verifiable credential stored in the Inji Wallet. Instead of using traditional usernames and passwords, users can authenticate themselves by presenting a trusted digital credential, completing user verification, and consenting to share only the required information with the service provider.

---

Example Use Case

This use case is applicable to any service provider portal that supports wallet-based authentication through a compatible Authorization Server (AS).

The following example demonstrates the online login flow within the Inji ecosystem using eSignet as the Authorization Server.

• Authorization Server (AS): eSignet
• Service Provider: Health ID Services Portal
• Credential Issuer: Republic of Veridonia National ID Department
• Credential: Veridonia National ID

In this example, a user downloads the Veridonia National ID credential into the Inji Wallet and later uses it to securely sign in to the Health ID Services Portal.

---

User Journey

1. Open the Inji Wallet application.
2. Tap the + button and download a credential from the Republic of Veridonia National ID Department.
3. After the credential is downloaded, open the credential menu (⋮) and activate it.
4. Open the Health ID Services portal and select Sign in with eSignet.
5. A QR code is displayed on the portal. Using the Inji Wallet, scan the QR code from the Share tab or the credential's QR Login option.
6. Complete the face authentication.
7. Review the requested claims and choose the information to share.
8. Provide consent.
9. The requested claims are securely shared, and the user is successfully signed in to the Health ID Services portal.

---

APIs Involved

The user is required to open the portal integrated with eSignet and utilize the app scanner to scan the QR code.

Link Login Transaction

After successfully scanning the QR code, Inji Wallet will access the API below and transmit the link code.

Link Transaction endpoint V2

post

The link transaction endpoint is invoked from Wallet-app.

1. Validates the link-code and its expiry and generates the linkTransactionId. This linkTransactionId is linked to transactionId returned from /oauth-details endpoint.
2. Returns the auth-factors, clientName, logoUrl, User claims, authorize scopes along with linkTransactionId.

Note: Wallet-app will hereafter address the transaction with this linkTransactionId for the /authenticate and /consent endpoints.

Body

requestTimestringRequired

Responses

200

OK

application/json

responseTimestringOptional

post/linked-authorization/v2/link-transaction

POST /v1/esignet/linked-authorization/v2/link-transaction HTTP/1.1
Host: esignet.collab.mosip.net
Content-Type: application/json
Accept: */*
Content-Length: 83

{
  "requestTime": "2023-09-22T08:01:10.000Z",
  "request": {
    "linkCode": "xl4cnYtLQkGRxUj"
  }
}

200

OK

{
  "responseTime": "2023-09-22T08:01:13.000Z",
  "response": {
    "linkTransactionId": "qwert_yt46_hX0xlBJNExl9cnYtL8kGvcbf555",
    "clientName": {
      "eng": "Fastlane e-Sim Service",
      "fra": "Service e-Sim de Fastlane",
      "ara": "خدمة فاست لين e-SIM"
    },
    "logoUrl": "https://fastlane.com/logo.png",
    "authFactors": [
      [
        {
          "type": "OTP",
          "count": 0,
          "subTypes": null
        }
      ]
    ],
    "authorizeScopes": [],
    "credentialScopes": [],
    "essentialClaims": [
      "name",
      "address"
    ],
    "voluntaryClaims": [
      "email",
      "phone_number"
    ],
    "configs": {
      "sbi.env": "Staging",
      "sbi.threshold.face": 40,
      "sbi.threshold.finger": 40,
      "sbi.threshold.iris": 40
    }
  },
  "errors": null
}

Authenticate User

After successful face authentication, the wallet authenticates the user.

Linked Authentication Endpoint V2

post

Once end user provides the user identifier (UIN/VID) and all the required auth challenge to the Wallet-app, this endpoint will be invoked from wallet-app.

Supported auth-challenge depends on the integrated authentication server.

1. Validates linkedTransactionId.
2. Validates null / empty individualId.
3. Invokes kyc-auth call to integrated authentication server (IDA).
4. Relays error from integrated authentication server to UI on failure.
5. It validates stored userconsent against the requested claims and scopes

On Authentication Success: linkTransactionId and consentAction is returned in the below response without any errors.

On Authentication Failure: Error list will be set with the errors returned from the integrated authentication server.

Body

requestTimestringRequiredPattern: yyyy-MM-dd'T'HH:mm:ss.SSS'Z'

Responses

200

OK

application/json

responseTimestringOptional

post/linked-authorization/v2/authenticate

POST /v1/esignet/linked-authorization/v2/authenticate HTTP/1.1
Host: esignet.collab.mosip.net
Content-Type: application/json
Accept: */*
Content-Length: 235

{
  "requestTime": "2023-09-22T08:01:10.000Z",
  "request": {
    "linkedTransactionId": "qwert_yt46_hX0xlBJNExl9cnYtL8kGvcbf555",
    "individualId": "34543276756",
    "challengeList": [
      {
        "authFactorType": "OTP",
        "challenge": "111111",
        "format": "alpha-numeric"
      }
    ]
  }
}

200

OK

{
  "responseTime": "2023-09-22T08:01:13.000Z",
  "response": {
    "linkedTransactionId": "qwert_yt46_hX0xlBJNExl9cnYtL8kGvcbf555",
    "consentAction": "CAPTURE"
  },
  "errors": []
}

Submit User Consent

Once the user approves the requested claims, the wallet submits the consent.

Linked Consent Endpoint V2

post

Once the authentication is successful and user consent is obtained, this endpoint will be invoked by the wallet app to send the accepted consent and permitted scopes.

1. Validates linkedTransactionId.
2. Validate accepted claims and permitted scopes in the request and the signature.
3. If valid, stores the accepted claims, permitted scopes and signature in the consent registry.

Body

requestTimestringRequiredPattern: yyyy-MM-dd'T'HH:mm:ss.SSS'Z'

Responses

200

OK

application/json

responseTimestringOptional

post/linked-authorization/v2/consent

POST /v1/esignet/linked-authorization/v2/consent HTTP/1.1
Host: esignet.collab.mosip.net
Content-Type: application/json
Accept: */*
Content-Length: 241

{
  "requestTime": "2023-09-22T08:01:13.000Z",
  "request": {
    "linkedTransactionId": "qwert_yt46_hX0xlBJNExl9cnYtL8kGvcbf555",
    "permittedAuthorizeScopes": [],
    "acceptedClaims": [
      "name",
      "email",
      "phone_number",
      "address"
    ],
    "signature": "<detached signature>"
  }
}

200

OK

{
  "responseTime": "2023-09-22T08:01:14.000Z",
  "response": {
    "linkedTransactionId": "qwert_yt46_hX0xlBJNExl9cnYtL8kGvcbf555"
  },
  "errors": []
}

---

Benefits

• Passwordless authentication using digital credentials.
• User-controlled sharing of identity attributes.
• Explicit consent before any information is shared.
• Reusable across multiple service provider portals.
• Secure authentication using trusted verifiable credentials.

---

Reference

For details about the Wallet Authentication APIs, refer to the eSignet Wallet Authenticator documentation