ATH-UC-05: Authentication using an eID

This version is a draft one and it will be enhanced as the sprints progress.

Used documentation

Cookbook/ materials	Version	Location
Identity & Authorization Management (I.AM) - Overview	1.0	https://www.ehealth.fgov.be/ehealthplatform/file/view/c87f7d093e56ff1054c73d6aae09e0bb?filename=ehealth_i.am_-_overv
Identity & Authorization Management (I.AM) - Identity Provider (IDP)	1.0	https://www.ehealth.fgov.be/ehealthplatform/fr/data/file/view/d43784683d86392e68f1a95b860f721170f30c7b?name=ehealth_i.am_-_idp_v1.0.pdf
CSAM Youtube channel	-	https://www.youtube.com/channel/UCzMGudd9xdMeGjYpbpjsXFw

TBC

Specification
Use case ID	ATH-UC-05-BF
Use case name	Authentication using an eID card
Actors	Citizen Healthcare giver Representative of an institution
Short Description	This use case denotes the authentication of a user via an eID card.
	1 (High) Must have: The system must implement this goal/ assumption to be accepted.
Pre-Conditions	The user has already an account The user has: an eID card a PIN code of his/her eID card a wireless card reader
Post-Conditions	The user is authenticated The user has access to the services of the mobile application
Steps (basic flow)	0	The user access to the WebSSO application interface to authenticate him/herself and choose the option eID
	1	The user connects using his/her credentials (eID card + PIN) and the wireless card reader
	2	The application sends an access request to the SP
	3	The SP sends an authentication request to the IDP
	4	The IDP checks the identity of the user with the AA
	5	The IDP sends a response message to the SP to inform it that the user is identified
	6	The SP returns a response message to the application to enable the authentication
	7	The user is authenticated and can use the the services of the mobile application
Exceptions (exception flows)	The PIN of the eID card is not correct The creation is aborted (e.g. loss of connection, problem with the wireless card reader, the session is expired)
Frequency	Every time the user needs to authenticate to the mobile application

Flow	Specification
	Use case ID	ATH-UC-05-AF-01
	Use case name	First authentication using an eID card (ATH-UC-(01,02,03,04)-BF)
	Actors
	Short Description
	Priority	1 (High) Must have: The system must implement this goal/ assumption to be accepted.
	Pre-Conditions
	Post-Conditions
	Steps	0
		1
		2
		3
		4
		5
		6
		7
		8
		9
		10
	Exceptions (exception flows)
	Frequency

Specification
Use case ID	ATH-UC-01-EF-01
Use case name	The PIN of the eID card is not correct
Actors	Citizen Representative of an institution Healthcare giver
Short Description	It denotes the use case when the citizen tries to authenticate with his/her eID card and fails in entering the PIN.
Priority	1 (High) Must have: The system must implement this goal/ assumption to be accepted.
Pre-Conditions	The user has already an account The user has: an eID card a PIN code of his/her eID card a wireless card reader
Post-Conditions	The authentication is interrupted
Steps (basic flow)	0	The citizen access to the application interface (i.e. WebSSO) to create an account (first authentication)
	1	The citizen connects for the first time to the application
	2	The application sends a request message to the Service Provider (SP)
	3	The SP sends a request message (i.e. ask authentication get SSO token) to the IDP
	4	The IDP checks the identity of the citizen and it does not find it in the authentic data source via the AA
	5	The IDP contacts the CSAM to ask it to create the certificate to the citizen (first authentication)
	6	The CSAM opens a new web browser page to invite the citizen to enter his/her credentials using the eID card
	7	The citizen tries to send his/her credentials with a wrong PIN.
	8	The authentication is interrupted
Frequency	Every time for a new citizen needs to create a new account and enter a wrong PIN

Specification
Use case ID	ATH-UC-05-EF-02
Use case name	The creation is aborted (e.g. loss of connection, problem with the wireless card reader, the session is expired)
Actors	Citizen
Short Description	It denotes the exception use case when the citizen loses the connection and he/she will not be able to finish the authentication. It may happens at any step of the basic and alternative flows.
Priority	1 (High) Must have: The system must implement this goal/ assumption to be accepted.
Pre-Conditions	The citizen has not an account The citizen has: an e-mail address an eID card a code PIN of his/her eID card an account in the web application Mygipass a wireless card reader
Post-Conditions	The authentication is interrupted
Steps (basic flow)
Frequency	Every time for a new citizen needs to create a new account and loses the connection