Skip to main content

Ident record

Example of an full ident record:

<idr:Confirmation 
xmlns:idr="http://www.a-trust.at/namespace/idconfirmation#" 
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" 
Version='4'>
	<idr:PersonData>
		<idr:GivenName>Max Xaver</idr:GivenName>
		<idr:FamilyName>Mustermann</idr:FamilyName>
		<idr:SexCode>female</idr:SexCode>
		<idr:DateOfBirth>1976-11-11</idr:DateOfBirth>
		<idr:PlaceOfBirth>Wien</idr:PlaceOfBirth>
		<idr:PhoneNumber>+436505555555</idr:PhoneNumber>
		<idr:EMailAddress>test@test.com</idr:EMailAddress>
		<idr:PostalAddress>
			<idr:AddressLine1>Max Mustermann</idr:AddressLine1>
            ...
			<idr:PostalCode>1000</idr:PostalCode>
		</idr:PostalAddress>
	</idr:PersonData>
	<idr:Identification>
		<idr:IdMethod>IdCard</idr:IdMethod>
		<idr:IdType>PERS</idr:IdType>
		<idr:IdNumber>12345678</idr:IdNumber>
		<idr:IdIssueDate>2011-08-01</idr:IdIssueDate>
		<idr:IdAuthority>Mag. Wien</idr:IdAuthority>
		<idr:IdNation>AT</idr:IdNation>
	</idr:Identification>   
	<idr:ProcessData>
		<idr:Name>A-TrustQES</idr:Name>
		<idr:Tag>CustomTag</idr:Tag>
		<idr:Design>A-Trust</idr:Design>
		<idr:Language>DE</idr:Language>
		<idr:Response>
			<idr:Success>https://.../success?token=123455</idr:Success>
			<idr:Error>https://.../error?token=123455</idr:Error>
		</idr:Response>
		<idr:Binding type="MobilePhoneNumber">+436505555555</idr:Binding>
		<idr:HashValue>8jew91qk...1982qw=</idr:HashValue>
	</idr:ProcessData>
	<dsig:Signature>...</dsig:Signature>
</idr:Confirmation>

Structure of the Ident record​

The identity record is an XML file with the root element Confirmation. The following elements can be defined within it:

  • PersonData
  • Identification
  • ProcessData
  • Custom
  • Signature

At least the elements PersonData, Identification, ProcessData, and Signature must be specified. Likewise, the attribute Version must be specified with the value 4.

PersonData​

The element PersonData contains the personal data.

  • GivenName
  • FamilyName
  • SexCode (female, male, company, diverse, intersex, open, unknown, not stated)
  • DateOfBirth (Format: YYYY-MM-DD)
  • PlaceOfBirth
  • PhoneNumber
  • EMailAddress
  • PostalAddress/AddressLine1
  • PostalAddress/AddressLine2
  • PostalAddress/AddressLine3
  • PostalAddress/AddressLine4
  • PostalAddress/CountryCode
  • PostalAddress/PostalCode

The field SexCode can contain the values male, female, company, diverse, intersex, open, unknown or not stated.

Example PersonData

<idr:Confirmation 
xmlns:idr="http://www.a-trust.at/namespace/idconfirmation#" 
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" 
Version='4'>
	<idr:PersonData>
		<idr:GivenName>Max Xaver</idr:GivenName>
		<idr:FamilyName>Mustermann</idr:FamilyName>
		<idr:SexCode>female</idr:SexCode>
		<idr:DateOfBirth>1976-11-11</idr:DateOfBirth>
		<idr:PlaceOfBirth>Wien</idr:PlaceOfBirth>
		<idr:PhoneNumber>+436505555555</idr:PhoneNumber>
		<idr:EMailAddress>test@test.com</idr:EMailAddress>
		<idr:PostalAddress>
			<idr:AddressLine1>Max Mustermann</idr:AddressLine1>
			<idr:AddressLine2></idr:AddressLine2>
			<idr:AddressLine3>Mustergasse 1</idr:AddressLine3>
			<idr:AddressLine4>Wien</idr:AddressLine4>
			<idr:CountryCode>AT</idr:CountryCode>
			<idr:PostalCode>1000</idr:PostalCode>
		</idr:PostalAddress>
	</idr:PersonData>
...
</idr:Confirmation>

AddressLine1 Should contain the name of the person or company. Maximum 32 characters.

AddressLine2 If a company was specified in AddressLine1, the person's name will be entered here. Maximum 32 characters.

AddressLine3 Contains the street name, building number, and apartment number. Maximum 32 characters.

AddressLine4 Contains the city or town. Maximum 24 characters.

CountryCode Country code (2 digits - ISO 3166 Alpha-2 code)

PostalCode Postal code (max. 6 digits)

Identification​

This field is used to specify identification characteristics. At least the IDMethod field must be specified, possible values are:

  • AutoIdent
  • BankIdent
  • EID
  • IdCard
  • QES
  • TrustedDatabase
  • VideoIdent

If the person's identification is based on video identification, this must be specified in the IdMethod field.

Example IDMethod for video identification

<idr:Confirmation 
xmlns:idr="http://www.a-trust.at/namespace/idconfirmation#" 
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" 
Version='4'>
...
  <idr:Identification>
    <idr:IdMethod>VideoIdent</idr:IdMethod>
  </idr:Identification>
...
</idr:Confirmation>

If the signatory is identified by means of an identity document (e.g. by a Registration Officer), the other identity document details must also be provided.

  • IdNation
  • IdAuthority
  • IdIssueDate
  • IdNumber
  • IdType

The following are the most frequently used values for the ID document type: (IdType). A complete list can be found in the interface's XML schema.

  • REIS Internationaler Reisepass
  • FUEH Österreichischer Führerschein
  • IDKA Österreichische Identitätskarte
  • PERD Deutscher Personalausweis
  • RA Rechtsanwaltsausweis
  • eDA eDA Dienstausweis Republik Österreich
  • eDAO eDA Land Oberösterreich
  • EDU EDU-Card
  • GEME Gemeindeausweis
<idr:Confirmation 
xmlns:idr="http://www.a-trust.at/namespace/idconfirmation#" 
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" 
Version='4'>
...
  <idr:Identification>
    <idr:IdMethod>IdCard</idr:IdMethod>
    <idr:IdType>PERS</idr:IdType>
    <idr:IdNumber>12345678</idr:IdNumber>
    <idr:IdIssueDate>2011-08-01</idr:IdIssueDate>
    <idr:IdAuthority>Mag. Wien</idr:IdAuthority>
    <idr:IdNation>AT</idr:IdNation>
  </idr:Identification>    
...
</idr:Confirmation>

ProcessData​

The element ProcessData contains information about the required process; elements to be specified:

  • Name (A-TrustQES, EuIdentity, WebId, Seal, TestCa, ShortLived)
  • Tag
  • CustomerName
  • Design
  • Language (DE, EN)
  • Response/Success
  • Response/Error
  • IdentValidTo
  • Binding
  • HashValue
<idr:Confirmation 
xmlns:idr="http://www.a-trust.at/namespace/idconfirmation#" 
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
Version='4'>
  ...
	<idr:ProcessData>
		<idr:Name>A-TrustQES</idr:Name>
		<idr:Tag>CustomTag</idr:Tag>
		<idr:Design>A-Trust</idr:Design>
		<idr:Language>DE</idr:Language>
		<idr:Response>
			<idr:Success>https://.../success?token=12</idr:Success>
			<idr:Error>https://.../error?token=12</idr:Error>
		</idr:Response>	
		<idr:IdentValidTo>2025-01-01</idr:IdentValidTo>
		<idr:Binding type="MobilePhoneNumber">+436505555555</idr:Binding>
		<idr:HashValue>8jew91qk...1982qw=</idr:HashValue>
	</idr:ProcessData>
  ...
</idr:Confirmation>
  • IdentValidTo The maximum is 30 days, this can be reduced with this parameter.
  • Response These URLs will be used for redirection after successful activation or in case of an error.
  • Binding binds the Ident Record to a user factor, possible values for the field type type are:
    • MobilePhoneNumber
    • CINCSN
    • ExtCardNumber
    • EMail
    • ActivationCode

Binding and HashValue

Optionally, a Binding and HashValue can be specified.

These values are passed to the identified person to initiate the issuance of the selected product at a later time via https://www.a-trust.at/Aktivierung.

The Binding can be randomly assigned or linked to the person, e.g., their phone number or email address.

The HashValue element contains a Base64-encoded SHA256 hash value derived from the Binding and the Freischalte-PIN (Unlock PIN), these are concatenated.

Hash=Base64(SHA256(UTF8_Bytes(Binding+FreischaltePIN)))

The Freischalte-PIN is:

  • A code generated by the identifying system, which may only be known to the identified person (e.g., activation code sent by registered mail)
  • A secret chosen by the identified person and known only to them (e.g., revocation password)

The activation code and Freischalte-PIN values must be UTF-8 encoded. A pseudocode implementation is shown in the following Listing.

Pseudocode for HashValue Generation

var identifier = AktivierungsCode+FreischaltePIN;
var utf8bytes = UTF8.GetBytes(identifier);
var hash = SHA256(utf8bytes);
var HashValue = Base64.Encode(hash);

Custom​

The element Custom contains additional fields that are not further defined.

Signature​

This element contains an XMLDSIG signature of the identified data.

The following elements must be specified at a minimum:

  • PersonData/GivenName
  • PersonData/FamilyName
  • PersonData/DateOfBirth
  • Identification/IdMethod
  • ProcessData/Name
  • Signature