Content

Access to the person resource

The three different variants of end user authentication requires usage of different kinds of access_tokens, in conjunction with different types of message flows.

Variant	Message flow / type of access token
Variant 1: End user authentication via OIDC	authorization code flow or implicit flow
Variant 2: End-user authentication embedded in BankID SDO	client credential grant flow
Variant 3: Assessment of individuals without BankID identification	client credential grant flow

In variant 1 the end user is directly referenced in the issued access token, which means the token contains everything the AML resource server needs to identify the individual.

In variant 2 and 3 the token contains no information about the actual end user. The client must in stead provide the end user identification through separate request parameter in the API. See separate AML API documentation.

Variant 1: End-user authentication via OIDC

This variant of the AML person resource uses the default Access Token format of the OIDC Provider from BankID. OIDC Clients can request Access Token for a given end user by supplying appropriate scope values in an Authorize request. The Access Token must be added as a Bearer Token to subsequent requests to endpoints for the AML API.

Note that the AML Service currently requires that the standard scope profile is also added in the scope list along with aml_person/basic

The following is an example of a valid Access Token for this variant of the AML person resource. The resource designator aml_person is added to the resource_access claim of the access token to signify access to the endpoints of the AML API. Note that realm_access to the standard scope profile and the custom scope nnin_altsub are also added.

 {
  "sub": "83e54dbd-23a1-4e04-8e7f-6649c7db0473",
  "resource_access": {
	"aml_person": {
		"roles": ["basic"]
		}
	},
  "birthdate": "1966-12-18",
  "allowed-origins": [],
  "amr": "BIM",
  "iss": "https://oidc.bankidapis.no/auth/realms/prod",
  "typ": "Bearer",
  "bankid_altsub": "9578-5999-4-1765512",
  "given_name": "Frode Beckmann",
  "nonce": "somecorrelationnonce",
  "aud": "aml_person",
  "acr": "4",
  "nbf": 0,
  "realm_access": {"roles": [
    "nnin_altsub",
    "profile"
  ]},
  "azp": "oidc-testclient",
  "auth_time": 1528868516,
  "name": "Frode Beckmann Nilsen",
  "exp": 1528868817,
  "session_state": "a92320b3-520f-40be-a749-66cf1a937c51",
  "iat": 1528868517,
  "family_name": "Nilsen",
  "jti": "2890d456-31a3-4bd2-b8e3-3b1b71cfe8f0"
}

Variant 2 and variant 3

These variants of the AML person resource requires the default Access Token format of the OIDC Provider from BankID, adapted to the Client Credential flow.

Eligibile OIDC Clients can request Access Tokens for the AML Service by invoking the Token endpoint using Client Credential Grant and supplying appropriate scope values. The Access Token must be added as an OAuth2 Bearer Token to subsequent requests to endpoints for the AML API.

The following is an example of a valid Access Token for this variant of the AML Service. The resource designator aml_person is added to the resource_access claim of the access token to signify access to the endpoints of the AML API.

{
  "jti": "1f788619-665a-4ef0-b598-aeb6e2be1b5d",
  "exp": 1550828538,
  "nbf": 0,
  "iat": 1550828238,
  "iss": "https://oidc-current.bankidapis.no/auth/realms/current",
  "aud": [
    "oidc-testclient",
    "aml_person"
  ],
  "sub": "b9ce6414-2ddc-46e2-8330-7f3d59000c64",
  "typ": "Bearer",
  "azp": "oidc-testclient",
  "auth_time": 0,
  "session_state": "7731caa5-f78e-4b16-a280-c60155a9edb7",
  "acr": "1",
  "allowed-origins": [],
  "resource_access": {
    "aml_person": {
      "roles": [
        "basic"
      ]
    }
  },
  "clientHost": "195.139.215.58",
  "clientId": "oidc-testclient",
  "scope": "aml_person/basic",
  "resource_claims": {},
  "clientAddress": "195.139.215.58"
}

Access to the organization resource

The organization resource uses the default Access Token format of the OIDC Provider from BankID, adapted to the Client Credential flow that is used by this variant.

Eligibile OIDC Clients can request Access Tokens for the AML Service by invoking the Token endpoint using Client Credential Grant and supplying appropriate scope values. The Access Token must be added as an OAuth2 Bearer Token to subsequent requests to endpoints for the AML API.

Example access_token:

{
  "jti": "789243ed-41f2-4710-8b1c-7ae063545bc4",
  "exp": 1550828441,
  "nbf": 0,
  "iat": 1550828141,
  "iss": "https://oidc-current.bankidapis.no/auth/realms/current",
  "aud": [
    "oidc-testclient",
    "aml_organization"
  ],
  "sub": "b9ce6414-2ddc-46e2-8330-7f3d59000c64",
  "typ": "Bearer",
  "azp": "oidc-testclient",
  "auth_time": 0,
  "session_state": "5f92080a-898b-42ee-9e62-80db0e006f34",
  "acr": "1",
  "allowed-origins": [],
  "resource_access": {
    "aml_organization": {
      "roles": [
        "basic"
      ]
    }
  },
  "clientHost": "195.139.215.58",
  "clientId": "oidc-testclient",
  "scope": "aml_organization/basic",
  "resource_claims": {},
  "clientAddress": "195.139.215.58"
}

Browser not supported