Ga naar inhoud

ADR-0042: Optional per-attribute token binding for ASI tokens

Context and problem statement

ETSI TS 119 478 clause 6.1.3.2 binds an access token per operation only (verify, retrieve). With one token, the QTSP can ask every attribute of the data service, also when the citizen approved something else (F-95, E5). Article 9(5) of Implementing Regulation 2025/1569 lets a member state impose access control. Q-33 asks whether the Netherlands imposes a binding per attribute. This ADR stays proposed until that decision.

Proposed decision

The proposal has four parts:

  1. A QTSP can name the attributes in the authorization request as one RFC 9396 authorization_details entry. The entry has the provisional type https://gbo.example/authorization-details/authentic-source-attributes. The entry has these fields:
    • locations, equal to resource.
    • actions, equal to the scope.
    • attribute_identifiers, with 1 to 50 unique https URIs.
  2. The authorization server validates the entry against the data service and the scope. It refuses an invalid entry with invalid_request. It shows the attributes on the request page and puts the entry unchanged in the token.
  3. If the token carries the entry, the ASIP refuses a request for another attribute with 401 insufficient_scope.
  4. By default, the binding is optional, so a QTSP that implements only ETSI can connect. Without the entry, the authorization is per operation, and the description of the data service is the limit. A configuration switch makes the entry mandatory (AZSP_REQUIRE_AUTHORIZATION_DETAILS=true in the demo).

Consequences

  • With the binding, the citizen sees exactly which attributes the QTSP asks (REQ-91). The token is not valid for other attributes.
  • Only parties that know the GBO type can use the binding. The type identifier is provisional.
  • If the Netherlands makes the binding mandatory, QTSPs that implement only ETSI cannot connect. This stays so until ETSI or a national profile defines the extension.

Considered options

The proposal considered three other options:

  • A binding per operation only, as ETSI specifies. This option is simpler for QTSPs, but the token is wider than the approval.
  • A mandatory binding per attribute. This option is closer to P-02. But it excludes QTSPs that implement only ETSI, until the extension is standard.
  • Attributes in the scope string. Not chosen. ETSI fixes the scopes, and RFC 9396 is the standard place for structured detail.

Traceability