Skip to main content

Validating Accredited Data Recipients

Data Holders have a duty to periodically check the current status of Accredited Data Recipients and act accordingly if the ADR has lost its accreditation. See how this is achieved with SecureAuth.

Validation of Accredited Data Recipients in a Nutshell

Data Holders have the responsibility to periodically check the accreditation status of Accredited Data Recipients (ADRs) and their Software Products (SPs). SecureAuth ensures that, in case the accreditation can no longer be found, all arrangements for the ADR are marked as expired, access and refresh tokens are revoked, and the client's status in SecureAuth will change to Inactive, meaning that this application can no longer request data from the Data Holder.

SecureAuth polls the CDR registry for the current status of both ADRs and their SPs registered as SecureAuth clients regularly, as required by the CDR specification, and caches the result. SecureAuth then runs ADR validation based on its cache in the following scenarios:

  • Client registration

  • Client authorization

  • Arrangement revocation

ADR Validation in Practice

In accordance with the CDR specification, SecureAuth periodically checks the CDR Registry to verify ADRs and their Software Products. CDR Registry returns data using the Refresh ADR Metadata endpoint. The result is cached by SecureAuth.

ADR_Validation_in_Practice.svg

If the status is removed for ADR Software Product, SecureAuth will invalidate all consents granted to this SP and remove its client application. This means that the SP users will no longer be able to request data from Data Holder.

The following validation occurs every time an Accredited Data Recipient makes a request to the Data Holder, to ensure Data Holder compliance with CDR standards before processing the request. ADR represents the Accredited Data Recipient while ADR SP represents the ADR's Software Product.

ADR_Validation_in_Practice_2.svg

  1. Data Recipient sends a request to the Data Holder (for example authorization request)

  2. Data Holder uses SecureAuth to check the Data Recipient status within the registry. To that end, SecureAuth checks the workspace cache for the current status.

  3. Depending on the status of ADR and the Software Product, SecureAuth makes a decision:

    • If the status is active for both, SecureAuth processes the request.

    • If the status is active or suspended for ADR and inactive for ADR Software Product, SecureAuth will only facilitate consent withdrawal requests.

    • If the status of the ADR SP is removed, SecureAuth will block the request and return an error.

Disable ADR Validation

ADR validation is enabled in CDR-compliant workspaces by default. You have the option to disable it if it's necessary to run a test scenario.

  1. In your CDR workspace, go to OAuth > Authorization Server.

  2. Disable the Enable ADR Validation check box.

  3. Save. SecureAuth will no longer validate requests made by clients registered in this workspace. Keep in mind that such workspace is no longer CDR compliant.

In this section: