New machine-machine authentication method

[TheTechArch]

Description

Altinn, together with MaskinPorten, will create a new solution for machine-machine communication to give a more secure less cumbersome integration process.

For end users this will be called "Systembruker for virksomhet"

Main Goals

• Give a solution that works for Altinn API and other API
• Maskinporten will create tokens
• System access can be delegated to others without sharing secrets
• Altinn Authorization can authorize API calls based on claims in tokens from Maskinporten
• Solution will be available for organizations to use. ID-porten covers private persons.

For more details and background, see #200

Functional description

Altinn will introduce a new concept called SystemUsers (Systembruker for virksomheter) to all organizations.

The functionality will be available from Altinn profile.

From the profile, the administrator can access the system users area to manage the system users for the organization.

A system user needs to be paired with a client_id in Maskinporten. The client_id can belong to system providers like Visma or belong to the organization itself.

When paired, the system vendor can call API on behalf of the organization.

For systems not provided by others, the organization can set up their own maskinporten client with help of uploading JWK

The organization admin can delegate rights to the system users to control what it can do or not do.

Consent based creation

In the future, Altinn will support consent-based creation of system users on request from System Vendors. This is to simplify the onboarding process for consumers.

There are still some clarification needed for this use case

Technical Description

System user administration

The system user will be implemented in Altinn Authentication.

• New GUI implemented as part of new Altinn Authentication Frontend based on new architecture using React with .Net BFF hosted in Azure Containers Service
• Database for system users in a new database for Altinn Authentication in Azure
• API to manage system users in Altinn Authentication component

System User Datamodel

{
"id": "12ffc244-e86e-4d7e-9016-cfd0c1ab8b6d",
"Title": "Regnskapssystem Visma",
"Description": "Dette er regnskapssystemet vi bruker. Det er knyttet til abonnementet for Visma. Tore har detaljer om lisens",
"Client_id": "1d1e8d75-5dc4-4d42-b5a3-111741c8d1ea"
"SystemTypeid": "null",
"Created": "2023-12-24 : 18:30"
}

id: Unique identification that will be used in Altinn authorization to assign rights. Will be added to JWT token fra Maskinporten
Title: "Title used for management
Description: Description used for management
Client_Id: Pointer to own clientID in Maskinporten or Client_id system user
SystemTypeId: Reference to system register if placed

Token Authentication

When authenticating in Maskinporten the client will send a JWT Grant request to maskinport

{
  "aud": "https://maskinporten.no/",
  "iss": "0e85a8ba-77e8-4a6c-a0f5-74fc328a9ffb",

  "scope": "digdir:dialogporten skatteetaten:mva"

  "authorization_details": [ {
     "type": "urn:altinn:systemuserorgno",
     "part": "0192:999888777",     
   }
  ]
}

The token will look like this.

{
  "iss" : "https://ver2.maskinporten.no/",
  "client_amr" : "virksomhetssertifikat",
  "token_type" : "Bearer",
  "aud" : "unspecified",
  "consumer" : {
    "authority" : "iso6523-actorid-upis",
    "ID" : "0192:910753614"
  },
  "authorization_details": [ {
     "type": "urn:altinn:systemuserorgno",
     "systemuserparty": "0192:999888777",      
     "systemuser": "12ffc244-e86e-4d7e-9016-cfd0c1ab8b6d",  // Used for authorization
     "systemid": "f9e58561-a165-4e26-85ed-fe9da8d2325a"  // Identifies the software
   }
  "scope" : "digdir:dialogporten skatteetaten:mva",
  "exp" : 1578924303,
  "iat" : 1578923303,
  "jti" : "QPdTeNlE-RtrNczkCIZ0yAoSzJSIC3Jo7L6B_PmY2X4"
}

SystemUser delegation check

To verify that the client has been given access to a system users for the specified organization, Maskinporten will call a new Altinn Authentication API with the following parameters.

• Client_ID
• Virksys orgnumber (999888777 in the example above)

The response will be the system userId that will be added to the Token

Flow diagram

Authorization

The following show the Authorize request that would be called from the PEP (Policy Enforcement Point) to the PDP.
PEP could be Dialogporten, Altinn App or any other API that is allowed to consume Altinn Authorization API

{
  "Request": {
    "ReturnPolicyIdList": true,
    "AccessSubject": [
      {
        "Attribute": [
          {
            "AttributeId": "urn:altinn:systemuser",
            "Value": "12ffc244-e86e-4d7e-9016-cfd0c1ab8b6d"
          },
         {
            "AttributeId": "scope",
            "Value": "digdir:dialogporten skatteetaten:mva"
          }
        ]
      }
    ],
    "Action": [
      {
        "Attribute": [
          {
            "AttributeId": "urn:oasis:names:tc:xacml:1.0:action:action-id",
            "Value": "read",
            "DataType": "http://www.w3.org/2001/XMLSchema#string"
          }
        ]
      }
    ],
    "Resource": [
      {
        "Attribute": [
          {
            "AttributeId": "urn:altinn:resource",
            "Value": "mva_dialog"
          },
          {
            "AttributeId": "urn:altinn:organization",
            "Value": "91234124352"
          }
        ]
      }
    ]
  }
}

System register Maskinporten

In Samarbeidsportalen, System Vendors can create clients that will be available in the system vendor list.
This will be controlled by a scope that will be open and available for everyone having access to Samarbeidsportalen

Maskinporten will expose an API that could be used to get the list of all these integrations.

Maskinporten client admin

To be able to administrate Maskinporten clients from Altinn maskinporten needs to expose API to create and update clients.

The API needs to support upload of JWK.

In scope

To be discussed

• What authentication level will the new token have? Should we have something in token for this? Is this a Altinn only discussion?
• What are the needs for rights delegation in the first iteration

Out of scope

No response

Additional Information

We will use new single rights delegation pages for the delegation of rights to system users.

Analyses

Beta Give feedback

1. Fremtidig løsning for sluttbrukersystemer #200
   kind/analysis +1
2. Juridisk analyse - delegering av rettigheter til systembruker #330
   jus kind/analysis +2
3. Analysis: System Register #329
   0 of 2
   area/systemauthentication kind/analysis +2

Tasks Frontend/BFF

Tasks

Beta Give feedback

1. Create System User creation page altinn-authentication-frontend#19
   kind/user-story status/draft +2
   
2. Task: Setup Infrastructure for Authentication BFF altinn-authentication-frontend#66
   kind/user-story status/draft +2
3. Feature: Functionality for managing system users for organizations altinn-authentication-frontend#2
   kind/user-story status/draft +2
   
4. Create OverviewPage for system users altinn-authentication-frontend#15
   2 of 2
   +0
   
5. Task Group: 9.0 BFF for Authentication-Frontend altinn-authentication-frontend#9
   21 of 25
   task/backend +1
   
6. Create a Consent Like creation page for system user altinn-authentication-frontend#17
   kind/user-story status/draft +2
   

Tasks Authentication Delivery 1

Tasks

Beta Give feedback

1. Feature: Implement SystemUser API in Altinn Authentication #232
   kind/analysis kind/user-story status/draft +3
   
2. Analysis: System Register #329
   0 of 2
   area/systemauthentication kind/analysis +2
3. Define requirements for access to system register scope #347
   kind/analysis status/draft +2
4. Implement System register for system vendors in Altinn Authentication #346
   status/draft +1
5. Create API to search for systemuser from Maskinporten #337
   kind/user-story status/draft +2
   

Dependencies

• Support role delegations to SystemUser (needed?)
• Support Access Group delegations to systemuser
• Support Resource/App delegations to systemuser
• Update PDP to support systemuser
• Expose PDP endpoint
• How to be able to remove rights? (revoke )
• API to list delegations in System users display

Features

Beta Give feedback

1. Administration of systemsusers from profile #459
   kind/feature status/draft +2
2. API for Maskinporten to connect Systemprovider to systemUser #460
   0 of 2
   area/systemauthentication kind/feature status/draft +3
3. Support systemProvider initated systemUser creation #461
   0 of 2
   kind/user-story status/draft +2

[annerisbakk]

@ekorra rydder denne