@connectid-tools/rp-nodejs-sdk 4.0.4 → 4.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +573 -0
- package/license +201 -0
- package/package.json +5 -4
- package/relying-party-client-sdk.js +2 -2
package/README.md
ADDED
|
@@ -0,0 +1,573 @@
|
|
|
1
|
+
# Relying Party Node.JS SDK
|
|
2
|
+
|
|
3
|
+
The rp-nodejs-sdk provides an SDK to allows Relying Parties easily integrate with the Digital Identity ecosystem.
|
|
4
|
+
|
|
5
|
+
# Getting Started
|
|
6
|
+
|
|
7
|
+
> A minimum of Node JS version 20.x is recommended. Download [here](https://nodejs.org/download/release/v20.9.0/).
|
|
8
|
+
|
|
9
|
+
Install the package in your nodejs project using:
|
|
10
|
+
|
|
11
|
+
```shell
|
|
12
|
+
npm install @connectid-tools/rp-nodejs-sdk
|
|
13
|
+
```
|
|
14
|
+
|
|
15
|
+
Update your `package.json` to use `module`:
|
|
16
|
+
```json
|
|
17
|
+
{
|
|
18
|
+
.
|
|
19
|
+
.
|
|
20
|
+
.
|
|
21
|
+
"type": "module"
|
|
22
|
+
}
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
You can then import and instantiate an instance of the rp-nodejs-sdk using:
|
|
26
|
+
|
|
27
|
+
```javascript
|
|
28
|
+
import { config } from './config.js';
|
|
29
|
+
import RelyingPartyClientSdk from './relying-party-client-sdk';
|
|
30
|
+
|
|
31
|
+
const rpClient = new RelyingPartyClientSdk(config);
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
The above code assumes that you have a config file called `config.js` in your project folder that contains
|
|
35
|
+
the configuration required for the sdk, eg: the location of the certificate files, the client details,
|
|
36
|
+
the callback urls, etc. The configuration attributes are described below.
|
|
37
|
+
|
|
38
|
+
## Using Typescript
|
|
39
|
+
To use Node SDK with Typescript you need to make the following changes in your `tsconfig.json`:
|
|
40
|
+
* Set `"target: "es2016"` or higher
|
|
41
|
+
* Have `"module": "ES2015"` or higher
|
|
42
|
+
* Have `"moduleResolution": "Bundler"`
|
|
43
|
+
|
|
44
|
+
Sample tsconfig:
|
|
45
|
+
```json
|
|
46
|
+
{
|
|
47
|
+
"compilerOptions": {
|
|
48
|
+
"target": "es2016",
|
|
49
|
+
"module": "ES2015",
|
|
50
|
+
"moduleResolution": "Bundler",
|
|
51
|
+
"strictNullChecks": true,
|
|
52
|
+
"outDir": "dist/",
|
|
53
|
+
},
|
|
54
|
+
"include": ["**/*.ts"]
|
|
55
|
+
}
|
|
56
|
+
```
|
|
57
|
+
### Setting up SDK config options
|
|
58
|
+
`RelyingPartyClientSdkConfig` has some fixed values, specially inside `client` object, to be able to set the config options for the SDK some type gymnastics will be needed as shown below (see `as const`):
|
|
59
|
+
```typescript
|
|
60
|
+
// index.ts
|
|
61
|
+
import RelyingPartyClientSdk from '@connectid-tools/rp-nodejs-sdk'
|
|
62
|
+
import { config } from './config'
|
|
63
|
+
|
|
64
|
+
const relyingPartyClientSdk = new RelyingPartyClientSdk(config)
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
```typescript
|
|
68
|
+
// config.ts
|
|
69
|
+
export const config = {
|
|
70
|
+
data: {
|
|
71
|
+
.
|
|
72
|
+
.
|
|
73
|
+
.
|
|
74
|
+
log_level: 'info' as const,
|
|
75
|
+
.
|
|
76
|
+
.
|
|
77
|
+
.
|
|
78
|
+
client: {
|
|
79
|
+
.
|
|
80
|
+
.
|
|
81
|
+
.
|
|
82
|
+
application_type: 'web' as const,
|
|
83
|
+
grant_types: ['client_credentials', 'authorization_code', 'implicit'] as ['client_credentials', 'authorization_code', 'implicit'],
|
|
84
|
+
id_token_signed_response_alg: 'PS256' as const,
|
|
85
|
+
post_logout_redirect_uris: [] as [],
|
|
86
|
+
require_auth_time: false as const,
|
|
87
|
+
response_types: ['code id_token', 'code'] as ['code id_token', 'code'],
|
|
88
|
+
subject_type: 'public' as const,
|
|
89
|
+
token_endpoint_auth_method: 'private_key_jwt' as const,
|
|
90
|
+
token_endpoint_auth_signing_alg: 'PS256' as const,
|
|
91
|
+
introspection_endpoint_auth_method: 'private_key_jwt' as const,
|
|
92
|
+
revocation_endpoint_auth_method: 'private_key_jwt' as const,
|
|
93
|
+
request_object_signing_alg: 'PS256' as const,
|
|
94
|
+
require_signed_request_object: true as const,
|
|
95
|
+
require_pushed_authorization_requests: true as const,
|
|
96
|
+
authorization_signed_response_alg: 'PS256' as const,
|
|
97
|
+
tls_client_certificate_bound_access_tokens: true as const,
|
|
98
|
+
backchannel_user_code_parameter: false as const,
|
|
99
|
+
scope: 'openid' as const,
|
|
100
|
+
software_roles: ['RP-CORE'] as ['RP-CORE'],
|
|
101
|
+
},
|
|
102
|
+
```
|
|
103
|
+
|
|
104
|
+
# rp-nodejs-sdk Configuration
|
|
105
|
+
|
|
106
|
+
The following properties can be configured for the sdk. Users of the sdk will need to generate their
|
|
107
|
+
own transport and signing certificates to use with the sdk as per the
|
|
108
|
+
[Relying Party User Guide](https://docs.sandbox.connectid.com.au/docs/relying-parties/).
|
|
109
|
+
|
|
110
|
+
The configuration must be passed into the `RelyingPartyClient` when it is created. A reference file with the required
|
|
111
|
+
the configuration properties is available from: <https://github.com/connectid-tools/rp-nodejs-sdk/blob/main/src/config.ts>.
|
|
112
|
+
The simplest way to pass in the configuration is shown below (assumes the `config.js` file is in the project directory):
|
|
113
|
+
|
|
114
|
+
```javascript
|
|
115
|
+
const config = require('./config');
|
|
116
|
+
const RelyingPartyClientSdk = require('@connectid-tools/rp-nodejs-sdk');
|
|
117
|
+
const rpClient = new RelyingPartyClientSdk(config);
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
| Property | Description | Example value |
|
|
121
|
+
|---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
122
|
+
| `ca_pem` | The collection of trusted root certificates that can be used for certification validation. May be an absolute or relative path. | `'./conf/ca.pem' ` |
|
|
123
|
+
| `ca_pem_content` | The collection of trusted root certificates content (string) that can be used for certification validation. Overrides `ca_pem`. | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'` |
|
|
124
|
+
| `signing_kid` | The id for the signing key in the JWKS. This can be found in the registry via Software Statements -> Client Details -> Certificates | `'Xf1Pf-GXyhryOY5wwg0ddL5yzUicIcQrOIxja0yHhpg'` |
|
|
125
|
+
| `signing_key` | The path to the signing key used when signing requests. May be an absolute or relative path. `signing_key` or `signing_key_content` must be used to provide the signing key. | `'./conf/signing.key'` |
|
|
126
|
+
| `signing_key_content` | The signing key content (string) used when signing requests. If supplied, will override the key data supplied via `signing_key`. | `'-----BEGIN PRIVATE KEY----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'` |
|
|
127
|
+
| `registry_participants_uri` | The URI for the registry endpoint that provides the participant list | `https://data.directory.sandbox.connectid.com.au/participants` |
|
|
128
|
+
| `signing_pem` | The path to the signing certificate used when signing requests. May be an absolute or relative path. | `'./conf/signing.pem'` |
|
|
129
|
+
| `transport_key` | The path to the transport key used for mutual TLS. May be an absolute or relative path. `transport_key` or `transport_key_content` must be used to provide the transport key. | `'./conf/transport.key'` |
|
|
130
|
+
| `transport_key_content` | The transport key content (string) used for mutual TLS. If supplied, will override the key data supplied via `transport_key`. | `'-----BEGIN PRIVATE KEY----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'` |
|
|
131
|
+
| `transport_pem` | The path to the transport certificate used for mutual TLS. May be an absolute or relative path. `tranport_pem` or `transport_pem_content` must be used to provide the transport certificate | `'./conf/transport.pem'` |
|
|
132
|
+
| `transport_pem_content` | The transport certificate content (string) used for mutual TLS. If supplied, will override the certificate supplied via `transport_pem`. | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'` |
|
|
133
|
+
| `application_redirect_uri` | The specific redirect url used for all requests from this rp-nodejs-sdk instance. Must be one of the redirect_urls specified in the registry for the client | `'https://tpp.localhost/cb'` |
|
|
134
|
+
| `client.client_id` | Identifies the client. This value is available from the Registry via Software Statements -> Client Details -> Client ID | `'https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a'` |
|
|
135
|
+
| `client.organisation_id` | Identifies the organisation. This value is available from the Registry via Organisation Details | `'ab837240-9618-4953-966e-90fd1fa63999'` |
|
|
136
|
+
| `client.jwks_uri` | The location of the JWKS for this client. Will be in the format: `'https://keystore.directory.sandbox.connectid.com.au/<organisation_id>/<client_id>/application.jwks'` | `'https://keystore.directory.sandbox.connectid.com.au/ab837240-9618-4953-966e-90fd1fa63999/090d41c6-fc27-4b1e-91e9-0fecfc240601/application.jwks'` |
|
|
137
|
+
| `client.redirect_uris` | The list of redirect_uris supported by the client. Must only contain URIs specified in the registry. | `['https://demo.relyingpart.net/cb', 'https://tpp.localhost/cb',]` |
|
|
138
|
+
| `log_level` | The log level to use for console logs, eg: 'info', 'debug'. Enabling 'debug' will cause all requests and responses to remote servers to be logged. 'debug' must not be used in Production as it will log Personal Information. | `'info'` |
|
|
139
|
+
| `cache_ttl` | TTL for the participants list caching. Optional setting. Defaults to 600 seconds if not configured. | `600` |
|
|
140
|
+
| `enable_auto_compliance_verification` | When running the OIDC FAPI compliance suite, it requires a call to userInfo after successfully decoding the response claims. If this is set to true, the SDK will automatically make the required call. | `false` |
|
|
141
|
+
| `purpose` | The default purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared | `'verifying your identity'` |
|
|
142
|
+
| `include_uncertified_participants` | By default the SDK will filter out all authorisation servers that are not fully certified. If you wish to test one of the uncertified auth servers you will need to set this to `true`. If not provided, defaults to 'false' | `false` |
|
|
143
|
+
| `required_claims` | The list of claims that the RP will be using and requires IDPs to support. If supplied, this will be used to filter the list of IDPs returned from `getParticipants` so that only IDPs supporting the claims are returned. If this value is not supplied, no filtering by claim support will be performed. | `['name', 'address']` |
|
|
144
|
+
| `required_participant_certifications` | The list of required certifications a server must support for the IDP use case (eg: TDIF Certification). If supplied, this will be used to filter the list of IDPs returned from `getParticipants` so that only IDPs with the certification are returned. If this value is not supplied, no filtering for specific certifications will be performed. | `[{ profileType: 'TDIF Accreditation', profileVariant: 'Identity Provider'}]` |
|
|
145
|
+
|
|
146
|
+
# Process Overview Sequence Diagram
|
|
147
|
+
|
|
148
|
+
The expected interactions between the Relying Party and RP Connector as part of a standard flow are shown in the diagram below.
|
|
149
|
+
|
|
150
|
+
The key steps are:
|
|
151
|
+
|
|
152
|
+
* Retrieve the list of Participants so the user can be prompted to choose their bank
|
|
153
|
+
* Send a pushed authorisation request to the selected bank with the requested claims and redirect the user to their bank
|
|
154
|
+
* Use the callback querystring to retrieve the access token and identity token with the claims the user has consented to share
|
|
155
|
+
|
|
156
|
+
```mermaid
|
|
157
|
+
sequenceDiagram
|
|
158
|
+
Customer->>+Relying Party: Use Digital ID
|
|
159
|
+
Relying Party->>+rp-nodejs-sdk: getParticipants()
|
|
160
|
+
rp-nodejs-sdk-->>-Relying Party: Participant metadata
|
|
161
|
+
Relying Party-->>-Customer: Display Bank Selector
|
|
162
|
+
Customer->>+Relying Party: Select Bank
|
|
163
|
+
Relying Party->>+rp-nodejs-sdk: sendPushedAuthorisationRequest()
|
|
164
|
+
rp-nodejs-sdk-->>-Relying Party: authUrl, codeVerifier, state, nonce
|
|
165
|
+
Note right of Relying Party: The RP must associate the codeVerifier,<br/>state and nonce with the user<br/>to use when retrieving claims
|
|
166
|
+
Relying Party-->>-Customer: redirect to Bank using authUrl
|
|
167
|
+
Customer->>+Bank: redirect to AuthUrl
|
|
168
|
+
Bank->>Bank: Authenticate & Capture Consent
|
|
169
|
+
Bank-->>-Customer: Redirect customer to RP callback URI
|
|
170
|
+
Customer->>+Relying Party: redirect to callback URL
|
|
171
|
+
Relying Party->>+rp-nodejs-sdk: retrievetokens()
|
|
172
|
+
rp-nodejs-sdk-->>-Relying Party: access and identity tokens
|
|
173
|
+
Relying Party-->>-Customer: Display outcome
|
|
174
|
+
```
|
|
175
|
+
|
|
176
|
+
# API Operations
|
|
177
|
+
|
|
178
|
+
## getParticipants()
|
|
179
|
+
|
|
180
|
+
This allows the list of Identity Providers within the scheme to be retrieved, so that the Relying Party can display them
|
|
181
|
+
to the user and allow the user to choose which Identity Provider they will use to prove their identity.
|
|
182
|
+
|
|
183
|
+
Note that by default the SDK is configured to only return Identity Providers that are fully certified. If you wish to test
|
|
184
|
+
one of the uncertified Identity Providers you will need to set the `include_uncertified_participants` configuration option to `true`.
|
|
185
|
+
(This should only be done in a test environment, and should never be done in production.)
|
|
186
|
+
|
|
187
|
+
You may also set the `required_claims` and `required_participant_certifications` configuration options to filter the list of IDPs returned
|
|
188
|
+
based on the needs of your use case (eg: if you require IDPs to be TDIF certified).
|
|
189
|
+
|
|
190
|
+
```javascript
|
|
191
|
+
const idps = await rpClient.getParticipants();
|
|
192
|
+
```
|
|
193
|
+
|
|
194
|
+
The response will contain an array of Organisations and their Authorisation Server, with an object structure similar to below.
|
|
195
|
+
|
|
196
|
+
They key fields of interest are:
|
|
197
|
+
|
|
198
|
+
* `CustomerFriendlyName` - this is the name of the Bank to display to the customer
|
|
199
|
+
* `CustomerFriendlyLogoUri` - this is a logo for the Bank that can be displayed alongside the bank name
|
|
200
|
+
* `AuthorisationServerId` - this uniquely identifies the authorisation server. It will be needed as part of the next call
|
|
201
|
+
in the flow to identify the Authorisation Server to send the PAR to.
|
|
202
|
+
|
|
203
|
+
Note that in the response there may be:
|
|
204
|
+
|
|
205
|
+
* multiple organisations - each Bank will be its own organisation
|
|
206
|
+
* multiple authorisation servers per bank - a Bank may have different authorisation servers for its different brands (or potentially
|
|
207
|
+
to differentiate Business Banking from Retail Banking)
|
|
208
|
+
|
|
209
|
+
```json
|
|
210
|
+
[
|
|
211
|
+
{
|
|
212
|
+
"Status": "Active",
|
|
213
|
+
"OrgDomainRoleClaims": [],
|
|
214
|
+
"AuthorisationServers": [
|
|
215
|
+
{
|
|
216
|
+
"PayloadSigningCertLocationUri": "https://auth.bank4.directory.sandbox.connectid.com.au/na",
|
|
217
|
+
"ParentAuthorisationServerId": null,
|
|
218
|
+
"OpenIDDiscoveryDocument": "https://auth.bank4.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
|
|
219
|
+
"CustomerFriendlyName": "Bank W",
|
|
220
|
+
"CustomerFriendlyDescription": "Bank4",
|
|
221
|
+
"TermsOfServiceUri": null,
|
|
222
|
+
"ApiResources": [],
|
|
223
|
+
"AutoRegistrationSupported": true,
|
|
224
|
+
"CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankW.svg",
|
|
225
|
+
"SupportsDCR": false,
|
|
226
|
+
"AuthorisationServerCertifications": [],
|
|
227
|
+
"SupportsCiba": false,
|
|
228
|
+
"DeveloperPortalUri": null,
|
|
229
|
+
"NotificationWebhookAddedDate": null,
|
|
230
|
+
"AuthorisationServerId": "cde44c30-9138-4b58-ba50-221833d14319"
|
|
231
|
+
},
|
|
232
|
+
{
|
|
233
|
+
"PayloadSigningCertLocationUri": "https://auth.bank3.directory.sandbox.connectid.com.au/na",
|
|
234
|
+
"ParentAuthorisationServerId": null,
|
|
235
|
+
"OpenIDDiscoveryDocument": "https://auth.bank3.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
|
|
236
|
+
"CustomerFriendlyName": "Bank N",
|
|
237
|
+
"CustomerFriendlyDescription": "Bank3",
|
|
238
|
+
"TermsOfServiceUri": null,
|
|
239
|
+
"ApiResources": [],
|
|
240
|
+
"AutoRegistrationSupported": true,
|
|
241
|
+
"CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankN.svg",
|
|
242
|
+
"SupportsDCR": false,
|
|
243
|
+
"AuthorisationServerCertifications": [],
|
|
244
|
+
"SupportsCiba": false,
|
|
245
|
+
"DeveloperPortalUri": null,
|
|
246
|
+
"NotificationWebhookAddedDate": null,
|
|
247
|
+
"AuthorisationServerId": "22c2d67e-4d95-414a-b51a-ca863e9d691d"
|
|
248
|
+
}
|
|
249
|
+
],
|
|
250
|
+
"OrgDomainClaims": [],
|
|
251
|
+
"Size": null,
|
|
252
|
+
"RegistrationId": null,
|
|
253
|
+
"OrganisationId": "ed63c5b4-4dcb-4867-bd8b-e2b04a0ab04b",
|
|
254
|
+
"City": "Banksville",
|
|
255
|
+
"Postcode": "4103",
|
|
256
|
+
"AddressLine2": "Bank Town",
|
|
257
|
+
"RegisteredName": "RefBank",
|
|
258
|
+
"AddressLine1": "1 Reference Bank Street",
|
|
259
|
+
"LegalEntityName": "Reference Bank",
|
|
260
|
+
"OrganisationName": "Reference Banks",
|
|
261
|
+
"Country": "AU",
|
|
262
|
+
"RegistrationNumber": "ABN 123 456 7890",
|
|
263
|
+
"CreatedOn": "2021-12-14T23:09:03.581Z",
|
|
264
|
+
"Tag": null,
|
|
265
|
+
"ParentOrganisationReference": "",
|
|
266
|
+
"CompanyRegister": "ABN",
|
|
267
|
+
"CountryOfRegistration": "AU"
|
|
268
|
+
},
|
|
269
|
+
{
|
|
270
|
+
"Status": "Active",
|
|
271
|
+
"OrgDomainRoleClaims": [],
|
|
272
|
+
"AuthorisationServers": [
|
|
273
|
+
{
|
|
274
|
+
"PayloadSigningCertLocationUri": "https://mtls.partner.idp.test.commbank.com.au/pf/JWKS",
|
|
275
|
+
"ParentAuthorisationServerId": null,
|
|
276
|
+
"OpenIDDiscoveryDocument": "https://mtls.partner.idp.test.commbank.com.au/.well-known/openid-configuration",
|
|
277
|
+
"CustomerFriendlyName": "Commonwealth Bank",
|
|
278
|
+
"CustomerFriendlyDescription": "Test IDP for CBA",
|
|
279
|
+
"TermsOfServiceUri": null,
|
|
280
|
+
"ApiResources": [],
|
|
281
|
+
"AutoRegistrationSupported": true,
|
|
282
|
+
"CustomerFriendlyLogoUri": "https://www.commbank.com.au/test.svg",
|
|
283
|
+
"SupportsDCR": false,
|
|
284
|
+
"AuthorisationServerCertifications": [],
|
|
285
|
+
"SupportsCiba": false,
|
|
286
|
+
"DeveloperPortalUri": null,
|
|
287
|
+
"NotificationWebhookAddedDate": null,
|
|
288
|
+
"AuthorisationServerId": "355df9aa-bf8f-4cec-aa4d-78b10356762e"
|
|
289
|
+
}
|
|
290
|
+
],
|
|
291
|
+
"OrgDomainClaims": [],
|
|
292
|
+
"Size": null,
|
|
293
|
+
"RegistrationId": "",
|
|
294
|
+
"OrganisationId": "adf2af89-2782-4058-86d9-ff3a9068e4a5",
|
|
295
|
+
"City": "Sydney",
|
|
296
|
+
"Postcode": "2000",
|
|
297
|
+
"AddressLine2": "201 Sussex Street",
|
|
298
|
+
"RegisteredName": "Commonwealth Bank of Australia",
|
|
299
|
+
"AddressLine1": "Ground Floor Tower 1",
|
|
300
|
+
"LegalEntityName": "Commonwealth Bank of Australia",
|
|
301
|
+
"OrganisationName": "Commonwealth Bank of Australia",
|
|
302
|
+
"Country": "AU",
|
|
303
|
+
"RegistrationNumber": "ABN 48 123 123 124",
|
|
304
|
+
"CreatedOn": "2022-03-14T00:42:29.202Z",
|
|
305
|
+
"Tag": null,
|
|
306
|
+
"ParentOrganisationReference": "",
|
|
307
|
+
"CompanyRegister": "ABN",
|
|
308
|
+
"CountryOfRegistration": "AU"
|
|
309
|
+
}
|
|
310
|
+
]
|
|
311
|
+
```
|
|
312
|
+
|
|
313
|
+
## getFallbackProviderParticipants()
|
|
314
|
+
|
|
315
|
+
This allows the list of Fallback Identity Providers (ie: manual document based verification) within the scheme to be retrieved, so that the Relying Party can use them as a fallback option if the user does not have a relationship
|
|
316
|
+
with one of the identity providers. Note that there is only expected to be a single Fallback Provider authorisation
|
|
317
|
+
server for the Scheme.
|
|
318
|
+
|
|
319
|
+
It is expected that clients will only use this method if they are building their own IDP selector and need to
|
|
320
|
+
identify the scheme Fallback Identity Provider.
|
|
321
|
+
|
|
322
|
+
Note that there is only expected to be a single Fallback Provider for the scheme (so only one participant with one
|
|
323
|
+
auth server should be returned here).
|
|
324
|
+
|
|
325
|
+
```javascript
|
|
326
|
+
const fallbackProviders = await rpClient.getFallbackProviderParticipants();
|
|
327
|
+
```
|
|
328
|
+
|
|
329
|
+
The response will contain an array of Organisations and their Authorisation Servers, with the structure the same
|
|
330
|
+
as that for `getParticipants()`.
|
|
331
|
+
|
|
332
|
+
|
|
333
|
+
## sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[], voluntaryClaims: string[] = [], purpose: string = '{default value from config}')
|
|
334
|
+
|
|
335
|
+
This sends a Pushed Authorisation Request to the specified Identity Server requesting the list of supplied claims. The response
|
|
336
|
+
will include the `authUrl` which is the URL that the user needs to be redirected to so they can complete the authorisation
|
|
337
|
+
process.
|
|
338
|
+
|
|
339
|
+
The required function parameters are:
|
|
340
|
+
|
|
341
|
+
* `authorisationServerId` - identifies the authorisation server to send the PAR to
|
|
342
|
+
* `essentialClaims` - a list of the identity essential claim names that being requested for the user.
|
|
343
|
+
Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
|
|
344
|
+
When the IDP is obtaining user consent, the only method for a user to opt out of consenting to an `essential` claim is to cancel the entire transaction.
|
|
345
|
+
* `voluntaryClaims` - a list of the identity voluntary claim names that are being requested for the user.
|
|
346
|
+
Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
|
|
347
|
+
When the IDP is obtaining user consent, they may allow the user to opt out of consenting to providing each of the `voluntary` claims, while still consenting to all `essential` claims.
|
|
348
|
+
If a user does not consent to `voluntary` claims, but does consent to `essential` claims, this will result in a successful transaction.
|
|
349
|
+
* `purpose` - the purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared. If not supplied, the default purpose configured in the SDK config will be used.
|
|
350
|
+
|
|
351
|
+
The method will return: `{ authUrl, code_verifier, state, nonce, xFapiInteractionId }`. The fields are:
|
|
352
|
+
|
|
353
|
+
* `authUrl` - the URL the user must be redirected to in order to complete the authorisation process with their Identity Provider
|
|
354
|
+
* `codeVerifier`
|
|
355
|
+
* `state`
|
|
356
|
+
* `nonce`
|
|
357
|
+
* `xFapiInteractionId` - a unique identifier for this interaction with the Authorisation Server, that was sent in the `x-fapi-interaction-id` request
|
|
358
|
+
header to the server. Intended as a correlation id for diagnosing issues between the client and the authorisation server.
|
|
359
|
+
|
|
360
|
+
The `codeVerifier`, `state` and `nonce` are all associated with this specific PAR and are required when retrieving the
|
|
361
|
+
token claims when the user has authorised the request. You must securely associate these with your user request
|
|
362
|
+
so that you can use them on the subsequent call.
|
|
363
|
+
|
|
364
|
+
## retrieveTokens(authorisationServerId: string, requestParams: CallbackParamsType, codeVerifier: string, state: string, nonce: string)
|
|
365
|
+
|
|
366
|
+
```typescript
|
|
367
|
+
interface CallbackParamsType {
|
|
368
|
+
access_token?: string;
|
|
369
|
+
code?: string;
|
|
370
|
+
error?: string;
|
|
371
|
+
error_description?: string;
|
|
372
|
+
error_uri?: string;
|
|
373
|
+
expires_in?: string;
|
|
374
|
+
id_token?: string;
|
|
375
|
+
state?: string;
|
|
376
|
+
token_type?: string;
|
|
377
|
+
session_state?: string;
|
|
378
|
+
response?: string;
|
|
379
|
+
|
|
380
|
+
[key: string]: unknown;
|
|
381
|
+
}
|
|
382
|
+
```
|
|
383
|
+
|
|
384
|
+
This retrieves the access and identity token containing the claims that the user has consented to share with the
|
|
385
|
+
Relying Party. It uses the authorisation code provided in the callback from the IDP and exchanges this for the access and
|
|
386
|
+
identity token with the claims. The tokens are then returned to the API caller.
|
|
387
|
+
|
|
388
|
+
The required function parameters are:
|
|
389
|
+
|
|
390
|
+
* `authorisationServerId` - identifies the authorisation server providing the user information
|
|
391
|
+
* `requestParams` - the full querystring from the callback to the Relying Party callback address
|
|
392
|
+
* `codeVerifier` - from the response to the PAR for this identity request
|
|
393
|
+
* `state` - from the response to the PAR for this identity request
|
|
394
|
+
* `nonce` - from the response to the PAR for this identity request
|
|
395
|
+
|
|
396
|
+
The method will return a `ConsolidatedTokenSet` which extends [Tokenset](https://github.com/panva/node-openid-client/blob/main/docs/README.md#class-tokenset)
|
|
397
|
+
that contains the access_token and id_token. The user identity claims can be retrieved using the utility method `claims()`
|
|
398
|
+
on the TokenSet. The `ConsolidatedTokenSet` provides a new method `consolidatedClaims()`, which will return a single
|
|
399
|
+
object containing all the claims, including the extended claims, as a single object. The tokenset also contains an `xFapiInteractionId` which
|
|
400
|
+
is a correlation id for the request that was sent to the IDP.
|
|
401
|
+
|
|
402
|
+
## getUserInfo(authorisationServerId: string, accessToken: string)
|
|
403
|
+
|
|
404
|
+
This will call the userinfo endpoint using the supplied access token and return the parsed user information response.
|
|
405
|
+
|
|
406
|
+
Note that in the initial steel thread implementation, there is no requirement for the IDPs to support this endpoint.
|
|
407
|
+
All user identity claims will be provided as part of the `id_token` returned by `retrieveTokens`.
|
|
408
|
+
|
|
409
|
+
The required function parameters are:
|
|
410
|
+
|
|
411
|
+
* `authorisationServerId` - identifies the authorisation server providing the user information
|
|
412
|
+
* `accessToken` - the access token provided by `retrieveTokens`
|
|
413
|
+
|
|
414
|
+
# Release Notes
|
|
415
|
+
|
|
416
|
+
### 4.0.5 (Feb 24, 2024)
|
|
417
|
+
- Add README.md and license files to bundle.
|
|
418
|
+
|
|
419
|
+
### 4.0.4 (Feb 21, 2024)
|
|
420
|
+
- Remove `declarationMap`.
|
|
421
|
+
|
|
422
|
+
### 4.0.3 (Nov 29, 2024)
|
|
423
|
+
- Issuer value for aud in private_key_jwt.
|
|
424
|
+
|
|
425
|
+
### 4.0.2 (Oct 22, 2024)
|
|
426
|
+
- Single string audience in the private key jwt.
|
|
427
|
+
|
|
428
|
+
### 4.0.1 (Oct 1, 2024)
|
|
429
|
+
- Changed type of `ApiResources` from `str` to `ApiResource`.
|
|
430
|
+
|
|
431
|
+
### 4.0.0 (Sep 2, 2024)
|
|
432
|
+
- Breaking change: removed essential claims default value. If you are relying on essential claims default value calling `sendPushedAuthorisationRequest` then you need to provide the claims explicitly. Otherwise, no need to change anything.
|
|
433
|
+
|
|
434
|
+
How it was:
|
|
435
|
+
```typescript
|
|
436
|
+
const defaultClaimList: string[] = ['given_name', 'middle_name', 'family_name', 'phone_number', 'email', 'address', 'birthdate', 'txn']
|
|
437
|
+
|
|
438
|
+
async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[] = defaultClaimList, voluntaryClaims: string[] = [], purpose: string = this.purpose) {
|
|
439
|
+
```
|
|
440
|
+
|
|
441
|
+
How it is now:
|
|
442
|
+
```typescript
|
|
443
|
+
async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[], voluntaryClaims: string[] = [], purpose: string = this.purpose) {
|
|
444
|
+
```
|
|
445
|
+
|
|
446
|
+
### 4.0.0 (Sep 23, 2024)
|
|
447
|
+
- Updated Node version to 20.x.
|
|
448
|
+
- Removed jest and axios dependencies.
|
|
449
|
+
|
|
450
|
+
### 3.0.0 (Aug 27, 2024)
|
|
451
|
+
- Breaking change: removed `name` from essential claims default value. If you are relying on essential claims default value calling `sendPushedAuthorisationRequest` and use `name` claim then you need to provide `name` claim explicitly. Otherwise, no need to change anything.
|
|
452
|
+
|
|
453
|
+
### 2.15.0 (Jun 20, 2024)
|
|
454
|
+
- Updated purpose statement.
|
|
455
|
+
- Dependencies updated.
|
|
456
|
+
|
|
457
|
+
### 2.14.1 (Jun 17, 2024)
|
|
458
|
+
- Removed `got` dependency and used `fetch` instead.
|
|
459
|
+
|
|
460
|
+
### 2.14.0 (Jun 12, 2024)
|
|
461
|
+
- Added cache to `getParticipants()` method.
|
|
462
|
+
|
|
463
|
+
### 2.13.0 (April 17, 2024)
|
|
464
|
+
- Updated dependencies
|
|
465
|
+
|
|
466
|
+
### 2.12.3 (Nov 8, 2023)
|
|
467
|
+
- `nonce` should have 43 chars.
|
|
468
|
+
|
|
469
|
+
### 2.12.2 (Nov 8, 2023)
|
|
470
|
+
- Updated README.md to include `tsconfig` suggestion.
|
|
471
|
+
|
|
472
|
+
### 2.12.1 (Nov 7, 2023)
|
|
473
|
+
- Made `ca_pem` optional. Although either `ca_pem` or `ca_pem_content` must be provided.
|
|
474
|
+
- Made `signing_key` optional. Although either `signing_key` or `signing_key_content` must be provided.
|
|
475
|
+
- Made `signing_pem` optional. Although either `signing_pem` or `signing_pem_content` must be provided.
|
|
476
|
+
- Made `transport_key` optional. Although either `transport_key` or `transport_key_content` must be provided.
|
|
477
|
+
- Made `transport_pem` optional. Although either `transport_pem` or `transport_pem_content` must be provided.
|
|
478
|
+
|
|
479
|
+
### 2.12.0 (October 19, 2023)
|
|
480
|
+
- Added support to Node 18.
|
|
481
|
+
|
|
482
|
+
### 2.11.2 (August 22, 2023)
|
|
483
|
+
- Conformance test succeed on warnings.
|
|
484
|
+
|
|
485
|
+
### 2.11.1 (August 3, 2023)
|
|
486
|
+
- Added automated Conformance test.
|
|
487
|
+
|
|
488
|
+
### 2.11.0 (August 1, 2023)
|
|
489
|
+
- Updated trust_framework in the PAR to contain an object `{ value: 'au_connectid' }` instead of having a string value. This
|
|
490
|
+
is to bring it inline with OIDC4A spec that requires trust_framework to contain an object.
|
|
491
|
+
|
|
492
|
+
### 2.10.0 (July 31, 2023)
|
|
493
|
+
- Updated documentation to include `registry_participants_uri` parameter.
|
|
494
|
+
- Updated two testcases.
|
|
495
|
+
|
|
496
|
+
### 2.9.0 (July 17, 2023)
|
|
497
|
+
- Updated `getParticipants()` so it only returns participants that are active in the network by default. Can be
|
|
498
|
+
overridden using config to return all if required. Also allow filtering of Auth Servers by capabilities.
|
|
499
|
+
- Added `getFallbackProviderParticipants()` to return the manual verification authorisation server.
|
|
500
|
+
- Note that `sendPushedAuthorisationRequest()` will require the auth server id to be valid for the current filter config (eg: Active auth servers).
|
|
501
|
+
|
|
502
|
+
### 2.8.0 (June 7, 2023)
|
|
503
|
+
- Ensured that the `txn` claim is always requested so clients always have a reference for the transaction.
|
|
504
|
+
|
|
505
|
+
### 2.7.2 (June 6, 2023)
|
|
506
|
+
- Removed `redirect_url` and `response_type` authorization request parameters from the request to the authorization endpoint to comply with FAPI2 Security Profile Implementers Draft 3.
|
|
507
|
+
|
|
508
|
+
### 2.7.1 (June 5, 2023)
|
|
509
|
+
- Removed `scope` authorization request parameter from the request to the authorization endpoint to comply with FAPI2 Security Profile Implementers Draft 3.
|
|
510
|
+
|
|
511
|
+
### 2.7.0 (May 31, 2023)
|
|
512
|
+
- Enhanced logging so x-fapi-interaction-id logged for PAR and token requests.
|
|
513
|
+
|
|
514
|
+
### 2.6.1 (May 29, 2023)
|
|
515
|
+
- Fixed invalid main file definition.
|
|
516
|
+
|
|
517
|
+
### 2.6.0 (May 29, 2023)
|
|
518
|
+
- Added support for `purpose` as request object parameter on PAR requests. Can be supplied per request or use the default supplied via config.
|
|
519
|
+
|
|
520
|
+
### 2.5.0 (May 24, 2023)
|
|
521
|
+
- Added support for `x-fapi-interaction-id` headers on PAR, token and userinfo requests.
|
|
522
|
+
|
|
523
|
+
### 2.4.1 (May 5, 2023)
|
|
524
|
+
- Updated clientId details for testing and documentation to use a federated clientId.
|
|
525
|
+
|
|
526
|
+
### 2.4.0 (March 28, 2023)
|
|
527
|
+
- Reimplemented extended claims, which now supports the following claims: `over16`, `over18`, `over21`, `over25`, `over65`, `beneficiary_account_au`, `beneficiary_account_au_payid`, `beneficiary_account_international`.
|
|
528
|
+
- Implemented strict mode for TypeScript to prevent the use of `any` type and other unsafe types.
|
|
529
|
+
- Fix for `ClaimsRequest` type to support non-verified claims in the type definition.
|
|
530
|
+
|
|
531
|
+
### 2.3.0 (March 10, 2023)
|
|
532
|
+
- Added support for the following extended claims: `over16`, `over18`, `over21`, `over25`, `over65`, `beneficiary_account`, `pay_id`.
|
|
533
|
+
|
|
534
|
+
### 2.2.0 (Feb 20, 2023)
|
|
535
|
+
- Maintenance update of dependencies to address CVE-2022-36083 in JOSE library.
|
|
536
|
+
|
|
537
|
+
### 2.1.0 (Feb 13, 2023)
|
|
538
|
+
- Moved `prompt=consent` parameter to pushed authorisation request object instead of a URL parameter.
|
|
539
|
+
|
|
540
|
+
### 2.0.7 (Dec 22, 2022)
|
|
541
|
+
- Run on Node 14 and 16 (openid-client lib does not support Node 18 yet).
|
|
542
|
+
|
|
543
|
+
### 2.0.6 (Dec 21, 2022)
|
|
544
|
+
- Removed the need to use `--experimental-specifier-resolution=node` flag when importing the SDK.
|
|
545
|
+
- Log SDK version.
|
|
546
|
+
|
|
547
|
+
### 2.0.5 (Dec 20, 2022)
|
|
548
|
+
- Updated documentation.
|
|
549
|
+
|
|
550
|
+
### 2.0.4 (Dec 20, 2022)
|
|
551
|
+
- Fixed `RelyingPartyClientSdk is not a constructor`.
|
|
552
|
+
|
|
553
|
+
### 2.0.3 (Dec 20, 2022)
|
|
554
|
+
- Made `ca_pem_content, signing_key_content, signing_pem_content, transport_key_content, transport_pem_content` from `RelyingPartyClientSdkConfig` optional.
|
|
555
|
+
|
|
556
|
+
### 2.0.2 (Dec 20, 2022)
|
|
557
|
+
- Removed version logging when SDK is created.
|
|
558
|
+
|
|
559
|
+
### 2.0.1 (Dec 20, 2022)
|
|
560
|
+
- Fixed npm publish.
|
|
561
|
+
|
|
562
|
+
### 2.0.0 (Dec 19, 2022)
|
|
563
|
+
- Typescript support.
|
|
564
|
+
- Breaking change: SDK imported using `require` will need to add a `default` at the end of the import.
|
|
565
|
+
```javascript
|
|
566
|
+
const RelyingPartyClientSdk = require('@idmvp/rp-nodejs-sdk').default
|
|
567
|
+
```
|
|
568
|
+
|
|
569
|
+
### 1.2.3 (Oct 24, 2022)
|
|
570
|
+
- Code formatting. See `.prettierrc.json`.
|
|
571
|
+
|
|
572
|
+
### 1.2.2
|
|
573
|
+
\<starting point\>
|
package/license
ADDED
|
@@ -0,0 +1,201 @@
|
|
|
1
|
+
|
|
2
|
+
ConnectID(R) SDK Licence Terms
|
|
3
|
+
Confidential
|
|
4
|
+
|
|
5
|
+
Version
|
|
6
|
+
1.0
|
|
7
|
+
Date
|
|
8
|
+
29 November 2022
|
|
9
|
+
(R)ConnectID is a registered trademark of eftpos Payments Australia Pty Ltd ABN 37 136 180 366
|
|
10
|
+
(C)2022 eftpos Digital Identity Pty Ltd
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
1 Introduction
|
|
14
|
+
(a) eftpos Digital Identity Pty Ltd (trading as ConnectID) (ABN 80 648 970 101) (Network Operator, we, us or our) of Level 1, 255 George Street, Sydney NSW 2000 has made available a software development kit (SDK) which can be used by Participants for the sole purpose of developing applications that integrate with our Digital ID Solution. For clarity, whilst the SDK is designed to assist Participants, Participants are not required to use SDK.
|
|
15
|
+
(b) If you download or choose to use the SDK, these terms describe the basis on which we will licence the SDK to you, so please read these terms carefully.
|
|
16
|
+
(c) By downloading or using the SDK, you agree to be bound by these terms and warrant and represent that you are a Participant. You must not use the SDK, if you do not agree to these terms.
|
|
17
|
+
(d) If you are agreeing to these terms or using the SDK on behalf of a business:
|
|
18
|
+
(i) you confirm that you have authority to agree to these terms on behalf of that business (if you do not have such authority, you must not use the SDK); and
|
|
19
|
+
(ii) while all of these terms apply to that business (and "you" and "your" means that business), clauses 3, 6.1(a), 7 and 10 to 12 also apply to you in your personal capacity (and "you" and "your" in those clauses also means you personally).
|
|
20
|
+
(e) If you are not using the SDK for a business, "you" and "your" means you personally.
|
|
21
|
+
(f) Further requirements applicable to the SDK may be set out in the SDK Documentation for the SDK, which you must comply with. You must also comply with any other agreement that governs your use of, or participation in, the Digital ID Solution.
|
|
22
|
+
(g) Capitalised terms are defined in clause 12.
|
|
23
|
+
|
|
24
|
+
2 Licence
|
|
25
|
+
(a) We grant you a non-transferable, non-sublicensable (subject to paragraph (c)) and nonexclusive licence to:
|
|
26
|
+
(i) install, use, copy, reproduce, adapt and modify the SDK; (ii) subject to paragraph (c):
|
|
27
|
+
(A) integrate Redistributables as part of an Application;
|
|
28
|
+
(B) copy and distribute Redistributables, solely as integrated in an Application, to third parties; and (iii) use the SDK Documentation,
|
|
29
|
+
for the purpose set out in section 1(a), provided you are, at all relevant times, a
|
|
30
|
+
Participant. The licence and the SDK is not for redistribution except the Redistributable as expressly contemplated by paragraph (ii) above and paragraph (c) below.
|
|
31
|
+
(b) You must not use this SDK to develop another SDK or any applications for a framework, solution, platform, system or service other than our Digital ID Solution, including any other
|
|
32
|
+
digital identity solution or system, or other data sharing platform or system. For clarity, you must not use an Application that includes any Redistributables for such purpose either.
|
|
33
|
+
(c) You are authorised to distribute the Redistributables, in object code format (except for node.js which may be distributed in source code) as embedded in an Application on a royalty free basis during the term of your licence to the SDK only to the extent that:
|
|
34
|
+
(i) such Redistributables are necessary or desirable for the Application to operate and interface with the Digital ID Solution; and
|
|
35
|
+
(ii) the inclusion of the Redistributables in the Application is either the direct result of the compilation executed by the SDK, when applicable, or is as instructed or recommended by us in the SDK Documentation.
|
|
36
|
+
(d) You shall in no event transfer or purport to transfer to any third party the ownership of any Redistributables.
|
|
37
|
+
|
|
38
|
+
3 Restrictions
|
|
39
|
+
(a) You must only use the SDK as described in these terms and SDK Documentation, and you must not:
|
|
40
|
+
(i) use Our IPR in any manner that is not expressly permitted under these terms;
|
|
41
|
+
(ii) use Our IPR for any purpose that is unlawful or that would give rise to any civil or criminal liability for yourself, use or any third party;
|
|
42
|
+
(iii) use Our IPR in any manner that adversely impacts or limits:
|
|
43
|
+
(A) the stability or integrity of our systems or the Digital ID Solution;
|
|
44
|
+
(B) the ability of others to use the SDK or integrate with or use the Digital ID Solution; or
|
|
45
|
+
(C) our interests or reputation, or the reputation of any participant in the Digital ID Solution;
|
|
46
|
+
(iv) reverse engineer or de-compile the SDK, other to the extent provided for as part of the SDK;
|
|
47
|
+
(v) rent, lease, sell, assign, sub-licence, deliver or otherwise distribute the SDK or any accompanying SDK Documentation to any other person except as expressly permitted by these terms;
|
|
48
|
+
(vi) transfer or re-export the SDK or any accompanying SDK Documentation in violation of any applicable export restriction;
|
|
49
|
+
(vii) subject to clause 2, disclose to any third party or permit any third party to have access to, use, execute, alter, modify, customize or improve SDK, or any part thereof, or any alteration, modification, customization or improvement of the SDK;
|
|
50
|
+
(viii) remove, alter or obscure any identification, copyright, trademark or other proprietary notices, labels or Marks (if any) from the SDK or the SDK Documentation;
|
|
51
|
+
(ix) send or store infringing or unlawful material using the SDK;
|
|
52
|
+
(x) attempt to gain unauthorised access to, or disrupt the integrity or performance of, the Digital ID Solution or any data processed or transferred using the SDK or the Digital ID Solution;
|
|
53
|
+
(xi) propagate any virus, worms, Trojan horses, or other programming routine intended to damage any system or data;
|
|
54
|
+
(xii) use Our IPR for high risk activities where the use or failure of Our IPR could lead to death, personal injury or environment damage;
|
|
55
|
+
(xiii) use Our IPR, or permit them to be used, for purposes of evaluation, benchmarking or other comparative analysis of the Digital ID Solution without our prior written consent, or for the purposes of development of any application for such purpose; or
|
|
56
|
+
(xiv) use Our IPR as part of, to integrate with, or to create, a product competitive with the products offered by us, including the Digital ID Solution.
|
|
57
|
+
(b) You acknowledge and agree that where the SDK is provided or made available to you on the basis of another agreement with the Network Operator or any member of the AP+ Group, and that other agreement includes restrictions on use of the SDK, those restrictions will apply in addition to these terms, and to the extent of inconsistency, the most stringent restriction will prevail.
|
|
58
|
+
|
|
59
|
+
4 Your Obligations
|
|
60
|
+
4.1 General
|
|
61
|
+
(a) You are solely responsible for:
|
|
62
|
+
(i) determining how you will use the SDK and ensuring that the SDK is fit for your purposes;
|
|
63
|
+
(ii) installing the SDK and implementing adequate backup procedures to protect against loss or error resulting from the use of the SDK; and
|
|
64
|
+
(iii) developing and managing your systems and any Applications (including providing end-user customer support and warranties in respect of your Applications) and for modifying your systems and Applications if we make any changes to these terms, the Digital ID Solution or the SDK.
|
|
65
|
+
(b) You must:
|
|
66
|
+
(i) from time to time, provide us on our reasonable request, details regarding your activities relating to the SDK, including without limitation, what software you have created or intend to create using the SDK so that we can confirm compliance with these terms;
|
|
67
|
+
(ii) implement appropriate security systems and protocols to ensure that Our IPR are protected at all times from misuse, damage, destruction or any form of unauthorised use, disclosure, copying, duplication or reproduction in whole or in part;
|
|
68
|
+
(iii) comply with applicable laws. Without limiting this paragraph (iii), you must ensure that your Applications are in strict compliance with applicable laws and do not infringe any rights (including intellectual property rights) of any third party; and
|
|
69
|
+
(iv) use the SDK in accordance with the SDK Documentation we provide to you and any other agreement under which the access to the SDK has been made available to you or which governs your use of the Digital ID Solution.
|
|
70
|
+
(c) You must ensure that each of your personnel and any third party who accesses and uses the SDK or any part of it, including any Redistributables, via you complies with all applicable provisions in these terms. You are liable for the acts and omissions of such persons in connection with such access and use as fully as if they were your acts or omissions.
|
|
71
|
+
4.2 Open source software
|
|
72
|
+
(a) The SDK may contain "open source" or "free software" components which are governed by their own licence terms. The licence terms and conditions for these components are set out in the licence files accompanying the components, as delivered with the SDK
|
|
73
|
+
(Open Source Elements). You must comply with the licence terms for such Open Source Elements and:
|
|
74
|
+
(i) must not modify the SDK so as to embed or link (in whole or in part) the SDK into or with any Open Source Elements in such a way that the licence terms relating to such Open Source Elements oblige you or the Network Operator to license such SDK (in whole or in part) under the licence terms of those Open Source Elements, and
|
|
75
|
+
(ii) these terms will in no event be deemed to be a permission to do the foregoing.
|
|
76
|
+
(b) The installation of third party components, including as applicable Open Source Elements, may be required to be able to use the SDK (Third Party Elements). You are solely responsible for procuring and obtaining usage rights in respect of any such Third Party Elements. We exclude all liability in connection with Third Party Elements to the maximum extent permitted by law.
|
|
77
|
+
|
|
78
|
+
5 Liability and warranties
|
|
79
|
+
(a) You warrant that you will use the SDK in accordance with these terms and the SDK Documentation.
|
|
80
|
+
(b) You acknowledge and agree that the SDK is a standard package provided free of charge to assist with developing Applications and consequently you agree that:
|
|
81
|
+
(i) the SDK has not been written to meet any specific requirements you may have;
|
|
82
|
+
(ii) the SDK and requirements and process for integration to the Digital ID Solution may be updated from time to time by us, and this may require updates or upgrades to Applications;
|
|
83
|
+
(iii) the SDK has not been tested in every possible combination and operating environment;
|
|
84
|
+
(iv) the SDK is provided "as is" and "with all faults";
|
|
85
|
+
(v) the SDK is not necessarily free from defects, errors, viruses or other harmful components; and
|
|
86
|
+
(vi) it is your responsibility to ensure that the SDK is satisfactory for its purpose and that your Applications are appropriately and securely integrated with the Digital ID Solution, and
|
|
87
|
+
accordingly, we exclude all liability to you to the extent permitted by law associated with your Applications and selection, use, results and performance of the SDK or any integration between your Application and the Digital ID Solution.
|
|
88
|
+
(c) Subject to paragraph (e), the SDK is provided without warranty and all express or implied guarantees, warranties, representations, statements, terms and conditions which are not expressly set out in these terms are excluded.
|
|
89
|
+
(d) In particular, and without limiting paragraph (c), we do not warrant that using the SDK will ensure compliance with the ConnectID Technical Specifications.
|
|
90
|
+
(e) Nothing in these terms excludes, restricts or modifies any guarantee, term, condition, warranty, or any right or remedy, implied or imposed by any law or legislation which cannot lawfully be excluded or limited, including the Australian Consumer Law which contains guarantees that protect the purchasers of goods and services in certain circumstances.
|
|
91
|
+
(f) If any guarantee, term, condition or warranty is implied or imposed in relation to these terms under the Australian Consumer Law or any other applicable legislation (a NonExcludable Provision) and we are able to limit your remedy for a breach of the NonExcludable Provision, then our liability for breach of the Non-Excludable Provision is limited to one or more of the following at our option:
|
|
92
|
+
(i) in the case of goods, the replacement of the goods or the supply of equivalent goods, the repair of the goods, the payment of the cost of replacing the goods or of acquiring equivalent goods, or the payment of the cost of having the goods repaired; or
|
|
93
|
+
(ii) in the case of services, the supplying of the services again, or the payment of the cost of having the services supplied again.
|
|
94
|
+
(g) Subject to paragraph (e), and our obligations under the Non-Excludable Provisions, and to the maximum extent permitted by law, our maximum aggregate liability for all claims arising under or relating to these terms or in relation to your use of Our IPR in each calendar year, whether in contract, tort (including negligence), in equity, under statute, under an indemnity, based on fundamental breach or breach of a fundamental term or on any other basis is limited to AUD $100.
|
|
95
|
+
(h) To the maximum extent permitted by law, we are not liable for
|
|
96
|
+
(i) any indirect or consequential loss, or loss of business, goodwill, reputation or for business interruption; or
|
|
97
|
+
(ii) any loss, damage, or injury wholly or in part resulting from any cause beyond our control including but not limited to any failure by you to follow any operating instructions in the SDK Documentation, your negligence, any environmental factor, or any damage necessitated or caused by your improper use, installation, repair or alteration of the SDK.
|
|
98
|
+
(i) A party's liability to the other is diminished to the extent that the acts or omissions (or those of a third party) contribute to or cause the loss or liability.
|
|
99
|
+
(j) You must indemnify us against any claim, proceedings, loss, damage, fine, penalty, interest and expense arising out of or in connection with your breach of clauses 3(a)(iii) or 4.1(b)(iii).
|
|
100
|
+
|
|
101
|
+
6 Intellectual Property Rights
|
|
102
|
+
6.1 Our IPR
|
|
103
|
+
(a) The:
|
|
104
|
+
(i) SDK and SDK Documentation;
|
|
105
|
+
(ii) any adaptions or improvements to the SDK or SDK Documentation (except for an
|
|
106
|
+
Application to the extent it does not include the SDK or SDK Documentation); and
|
|
107
|
+
(iii) all intellectual property rights associated with any of the materials referred to in paragraphs (i) or (ii),
|
|
108
|
+
(Our IPR) are and will at all times remain the sole and exclusive property of us or our licensors.
|
|
109
|
+
(b) All intellectual property rights and other proprietary rights in any Applications or other materials created by you using the SDK (SDK Outputs) are and remain your property.
|
|
110
|
+
(c) Notwithstanding paragraph (b), you grant to us and each member of the AP+ Group a perpetual, sub-licensable, royalty free, irrevocable licence to any patents held by you or any of your personnel that cover or include the operation of any Applications or other SDK Outputs to the extent necessary or desirable to enable us, any AP+ Group member, and other participants in the Digital ID Solution to continue to utilise, commercialise or develop the SDK and/or the Digital ID Solution, and to otherwise provide, participate in, and integrate with, the Digital ID Solution.
|
|
111
|
+
6.2 System data
|
|
112
|
+
We may collect system, telemetry and analytical information and data concerning the use and performance of the SDK and Applications. AP+ Group may use, disclose and process this data and information for its business purposes, including development, enhancement and support of the SDK, the Digital ID Solution and other products and services. This does not permit us to disclose your Confidential Information to third parties other than our service providers for the purposes contemplated provided that the data does not relate back to or identify you or any third party.
|
|
113
|
+
6.3 Use of our Marks
|
|
114
|
+
(a) When you use Our IPR, you must attribute us as the source of those materials in accordance with the brand guidelines we provide you from time to time, including where required by using our Marks. We grant you a non-transferable, non-sublicensable and non-exclusive licence to use the Marks in accordance with these terms for such purpose.
|
|
115
|
+
(b) You acknowledge that we own or license the Marks, and you acquire no right, title or interest in the Marks.
|
|
116
|
+
(c) You must:
|
|
117
|
+
(i) use the Marks in accordance with the SDK Documentation and any guidelines or directions which we may provide to you from time to time;
|
|
118
|
+
(ii) not contest or in any way impair any of our rights to the Marks; and
|
|
119
|
+
(iii) not adopt "ConnectID" or any other Mark as part of the name of your business or apply it to any goods or services that you offer for sale.
|
|
120
|
+
(d) If we suspend or cancel your right to use the SDK and/or the SDK Documentation under these terms:
|
|
121
|
+
(i) you will lose all rights conferred by these terms with respect to the use of the Marks; and
|
|
122
|
+
(ii) you must immediately cease using the Marks or any marks identical to or deceptively similar to the Marks or the term "ConnectID", and destroy all materials bearing the Marks.
|
|
123
|
+
|
|
124
|
+
7 Confidentiality
|
|
125
|
+
(a) Each party may only use the Confidential Information of the other party for the purposes of performing their obligations, and exercising their rights, under these terms, and subject to the following must keep such Confidential Information confidential.
|
|
126
|
+
(b) Each party may disclose the Confidential Information of the other party:
|
|
127
|
+
(i) to the extent required by law;
|
|
128
|
+
(ii) in accordance with any licence and use rights granted under these terms, in which case the disclosing party must ensure that any such recipient keeps such information confidential on the same basis as required by this clause 7; or
|
|
129
|
+
(iii) with the prior written consent of the other party.
|
|
130
|
+
(c) In addition, the Network Operator may disclose your Confidential Information to members of the AP+ Group and its and their service providers and may use your Confidential Information in connection with the provision of the Digital ID Solution.
|
|
131
|
+
(d) Upon termination or expiration of these terms, each party must use commercially reasonable efforts to return to the other party or destroy all Confidential Information of the other party in its possession or control that it does not have an ongoing right to use under these terms.
|
|
132
|
+
(e) Nothing in paragraph (c) requires a party to return or destroy any Confidential Information of the other party to the extent that such Confidential Information:
|
|
133
|
+
(i) needs to be retained for the purpose of actual or potential litigation or other recordkeeping purposes; or
|
|
134
|
+
(ii) is on back-up, archival storage tapes or the like and it is not practical to do so.
|
|
135
|
+
|
|
136
|
+
8 Privacy
|
|
137
|
+
(a) In connection with your use of the SDK, you may give us personal information or you may grant us authorisation to access personal information through third parties. We understand that your personal information is important, and we take your privacy very seriously. Our privacy policy contains further details about our privacy handling practices. For clarity, our provision of the SDK in accordance with these terms constitutes an "Other Service" for the purposes of our Privacy Policy.
|
|
138
|
+
(b) You must only disclose personal information to us where you are permitted to do so by law.
|
|
139
|
+
|
|
140
|
+
9 Suspension and termination
|
|
141
|
+
(a) You may cease using the SDK at any time.
|
|
142
|
+
(b) We may by notice in writing immediately suspend or cancel your right to use the SDK and/or the SDK Documentation, either temporarily or permanently:
|
|
143
|
+
(i) if you breach any of these terms and such breach is not capable of remedy or is not remedied within 7 days after we notify you of that breach; or
|
|
144
|
+
(ii) if we suspend or discontinue the provision of the SDK as contemplated by section 10 below.
|
|
145
|
+
(c) In addition, your right to use the SDK, Redistributables and the SDK Documentation is immediately cancelled (without the need for notice) on the day you cease to be a Participant.
|
|
146
|
+
(d) If your right to use the SDK is suspended or cancelled:
|
|
147
|
+
(i) you must immediately cease using Our IPR (including Redistributables in an Application) and, in the case of cancellation, these terms will be terminated, including the licence granted to you in clause 2; and
|
|
148
|
+
(ii) you may continue to use and license Applications and SDK Outputs to the extent you own the intellectual property rights in the same, provided that any continued use or development, maintenance and/or enhancement of such Applications or SDK Output after the termination of this Agreement does not involve continued use of any of Our IP, including the SDK itself or any Redistributables.
|
|
149
|
+
(e) Subject to the rest of this clause 9, termination does not affect any accrued rights of either party.
|
|
150
|
+
|
|
151
|
+
10 Variations
|
|
152
|
+
(a) We may from time to time:
|
|
153
|
+
(i) amend these terms, the SDK Documentation or any other requirements relating to the SDK, including to introduce, remove or otherwise amend any terms; or
|
|
154
|
+
(ii) modify, suspend or discontinue, temporarily or permanently, the SDK, including to modify the manner of use of the SDK.
|
|
155
|
+
(b) We will provide you with:
|
|
156
|
+
(i) 90 days written notice of any suspension or discontinuance of the SDK or SDK Documentation under paragraph (a)(ii); and
|
|
157
|
+
(ii) 30 days written notice of any other actions under paragraph (a), if we determine in our reasonable discretion that any such action will negatively impact you.
|
|
158
|
+
(c) Your continued use of the SDK or SDK Documentation following any amendment or modification referred to in paragraph (a) will constitute your acceptance of the amendment or modification.
|
|
159
|
+
|
|
160
|
+
11 General
|
|
161
|
+
(a) If there is any inconsistency between:
|
|
162
|
+
(i) these terms; and
|
|
163
|
+
(ii) any other documents incorporated into them by reference,
|
|
164
|
+
priority will be given in the order set out above (with an item higher in the list having priority over a lower item).
|
|
165
|
+
(b) If any part of these terms is held to be unenforceable, the unenforceable part is to be given effect to the greatest extent possible and the remainder will remain in full force and effect.
|
|
166
|
+
(c) You agree to provide us with feedback relating to the SDK upon request. We may freely use any such feedback (including suggestions or ideas), including in future modifications of the SDK and the Digital ID Solution and to develop and market new products and services.
|
|
167
|
+
(d) Neither party will be liable for any failure or delay in performing any of its obligations under these terms if such delay is caused by circumstances beyond that party�s reasonable control.
|
|
168
|
+
(e) These terms are governed by the laws of New South Wales, Australia, and each party submits to the non-exclusive jurisdiction of the courts that exercise jurisdiction in New South Wales, Australia.
|
|
169
|
+
(f) These terms constitute the entire agreement between us and you in relation to your use of the SDK and supersede all other communications or displays whether electronic, oral, or written, between us and you in relation to such use.
|
|
170
|
+
(g) Your use of the SDK is conducted electronically and you agree that we may communicate with you electronically for all aspects of such use, including when sending you written notices. We may send any written notice given under these terms to the primary contact email address you have registered with us, or if you have notified us of any changes to your primary contact email address, to that changed address.
|
|
171
|
+
(h) The provisions of these terms which by their nature survive termination or expiry of these terms will survive termination or expiry of these terms, including clause 6.1 and 6.2.
|
|
172
|
+
(i) No waiver, delay or failure by a party to take any action will constitute or be construed as a waiver of that or any other term, condition, option, privilege or right.
|
|
173
|
+
(j) The word "including" when used in these terms is not a term of limitation.
|
|
174
|
+
(k) A reference to these terms includes any schedules and documents incorporated by reference
|
|
175
|
+
|
|
176
|
+
12 Definitions
|
|
177
|
+
Applications means a software application developed, maintained and/or enhanced by you using the SDK.
|
|
178
|
+
AP+ Group means Australian Payments Plus Limited (ABN: 19 649 744 203) and its related body corporates (as that term is defined in the Corporations Act 2001 (Cth)).
|
|
179
|
+
ConnectID Technical Specifications means any technical specifications developed or maintained by the Network Operator in connection with the Digital ID Solution.
|
|
180
|
+
Confidential Information means any information of whatever kind which a party discloses or reveals to the other party under or in relation to these terms that:
|
|
181
|
+
(a) is by its nature confidential;
|
|
182
|
+
(b) is designate by the disclosing party as confidential; or (c) the recipient knows or reasonably ought to know is confidential, including (where we are the disclosing party) Our IPR, but does not include information that:
|
|
183
|
+
(d) is published or has otherwise entered the public domain without a breach of these terms; or
|
|
184
|
+
(e) is independently developed or obtained without a breach of these terms.
|
|
185
|
+
Digital ID Solution means the digital ID solution developed and/or offered by the Network Operator.
|
|
186
|
+
Marks means the trade and service marks owned by the Network Operator or a member of the AP+ Group and licensed by us from time to time and identified in the Documentation as being licensed for your use.
|
|
187
|
+
Non-Excludable Provision has the meaning given to that term in clause 5(f) of these terms.
|
|
188
|
+
Open Source Elements has the meaning given in clause 4.2(a) of these terms.
|
|
189
|
+
Our IPR has the meaning given in clause 6.1(a) of these terms.
|
|
190
|
+
|
|
191
|
+
Participant means a:
|
|
192
|
+
|
|
193
|
+
(a) person with a current registration in the Digital ID Solution;
|
|
194
|
+
(b) person who warrants that they meet the eligibility criteria for participation in the Digital ID Solution and who has submitted their registration to participate in the Digital ID Solution and whose registration has not been rejected; or
|
|
195
|
+
(c) person with whom the Network Operator is undertaking a proof of concept in connection with the Digital ID Solution or with whom there are actively engaging in sales or accreditation conversations in respect of the Digital ID Solution.
|
|
196
|
+
Redistributables means the portion of the SDK which may be required to be incorporated in the Application for the Application to operate and interface with the Digital ID Solution.
|
|
197
|
+
|
|
198
|
+
SDK has the meaning given in clause 1(a) of these terms.
|
|
199
|
+
SDK Documentation means any user guides, specifications, policies, guidelines and other documentation provided to you in connection with the SDK.
|
|
200
|
+
SDK Outputs has the meaning given in clause 6.1(b).
|
|
201
|
+
Third Party Elements has the meaning given in clause 4.2(b).
|
package/package.json
CHANGED
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@connectid-tools/rp-nodejs-sdk",
|
|
3
|
-
"version": "4.0.
|
|
3
|
+
"version": "4.0.5",
|
|
4
4
|
"description": "Digital Identity Relying Party Node SDK",
|
|
5
5
|
"main": "relying-party-client-sdk.js",
|
|
6
6
|
"types": "relying-party-client-sdk.d.ts",
|
|
7
7
|
"type": "module",
|
|
8
|
+
"license": "SEE LICENSE IN license file",
|
|
8
9
|
"scripts": {
|
|
9
10
|
"format": "npx prettier --write src",
|
|
10
11
|
"test": "node --import tsx --test src/tests/*.test.ts",
|
|
@@ -12,7 +13,7 @@
|
|
|
12
13
|
"test:conformance": "node --import tsx --test src/conformance/conformance.test.ts",
|
|
13
14
|
"prebuild": "rm -rf lib",
|
|
14
15
|
"build": "tsc",
|
|
15
|
-
"postbuild": "cp package.json lib && cd lib && node ../node_modules/add-js-extension/dist/bin.js . --once && replace-in-files --string='${process.env.SDK_VERSION}' --replacement=$npm_package_version relying-party-client-sdk.js && cd .."
|
|
16
|
+
"postbuild": "cp package.json README.md license lib && cd lib && node ../node_modules/add-js-extension/dist/bin.js . --once && replace-in-files --string='${process.env.SDK_VERSION}' --replacement=$npm_package_version relying-party-client-sdk.js && cd .."
|
|
16
17
|
},
|
|
17
18
|
"repository": {
|
|
18
19
|
"type": "git",
|
|
@@ -37,8 +38,8 @@
|
|
|
37
38
|
"@types/node": "^20.17.19",
|
|
38
39
|
"@types/openid-client": "^3.7.0",
|
|
39
40
|
"add-js-extension": "^1.0.4",
|
|
40
|
-
"eslint": "^9.
|
|
41
|
-
"prettier": "^3.5.
|
|
41
|
+
"eslint": "^9.21.0",
|
|
42
|
+
"prettier": "^3.5.2",
|
|
42
43
|
"replace-in-files-cli": "^2.2.0",
|
|
43
44
|
"tsx": "^4.19.3",
|
|
44
45
|
"typescript": "^5.7.3"
|
|
@@ -42,7 +42,7 @@ export default class RelyingPartyClientSdk {
|
|
|
42
42
|
this.signingKey = getCertificate(this.config.data.signing_key, this.config.data.signing_key_content);
|
|
43
43
|
this.caPem = getCertificate(this.config.data.ca_pem, this.config.data.ca_pem_content);
|
|
44
44
|
this.logger = getLogger(this.config.data.log_level);
|
|
45
|
-
this.logger.info(`Creating RelyingPartyClientSdk - version 4.0.
|
|
45
|
+
this.logger.info(`Creating RelyingPartyClientSdk - version 4.0.5`);
|
|
46
46
|
if (this.config.data.purpose) {
|
|
47
47
|
const purposeValidation = validatePurpose(this.config.data.purpose);
|
|
48
48
|
if (purposeValidation === 'INVALID_LENGTH') {
|
|
@@ -74,7 +74,7 @@ export default class RelyingPartyClientSdk {
|
|
|
74
74
|
globalAgent.options.key = this.transportKey;
|
|
75
75
|
globalAgent.options.ca = [this.caPem, ...rootCertificates];
|
|
76
76
|
custom.setHttpOptionsDefaults({ timeout: 10000 });
|
|
77
|
-
// 4.0.
|
|
77
|
+
// 4.0.5 is replaced with `postbuild` script in package.json (see replace-in-files)
|
|
78
78
|
this.logger.info(`Using ${this.config.data.transport_key_content ? 'transport_key_content' : 'transport_key'} config prop`);
|
|
79
79
|
this.logger.info(`Using ${this.config.data.transport_pem_content ? 'transport_pem_content' : 'transport_pem'} config prop`);
|
|
80
80
|
this.logger.info(`Using ${this.config.data.ca_pem_content ? 'ca_pem_content' : 'ca_pem'} config prop`);
|