ConnectID security profile basics
Learn what the ConnectID security profile requires of an authorization server, and how SecureAuth supports it.
What ConnectID is
ConnectID is an Australian digital identity network operated by Australian Payments Plus and accredited as an identity exchange by the Australian Government. It lets a person verify their identity to a business using their bank.
The business receives confirmation of the specific details it asks for, such as name and date of birth, rather than the underlying identity documents.
ConnectID is built on FAPI 2.0, the OpenID Foundation security profile for APIs that expose highly sensitive data. For more detail, see Financial-grade API Security Profile Overview.
What ConnectID requires of an authorization server
ConnectID requires an authorization server to:
-
Let client applications authenticate using mTLS or DPoP.
-
Use only the authorization code flow.
-
Enforce pushed authorization requests (PAR) and Proof Key for Code Exchange (PKCE).
-
Support JWT Secured Authorization Response Mode (JARM) when a client requests it. JARM returns all response parameters in a JWT. You can encrypt the JWT to harden it further.
An authorization server can also use certificate-bound access tokens as an extra security layer. This is optional.
How SecureAuth supports ConnectID
The ConnectID certification recorded for the platform is against the FAPI 2.0 ConnectID Third Implementer's Draft, certified by Cloudentity on 6 May 2023. It is not a certification against the final ConnectID profile. For the certified conformance profiles, see Certifications.
You can configure any SecureAuth workspace to meet ConnectID's requirements. SecureAuth also provides a ConnectID workspace profile that already meets them. See Add new identity and authorization workspaces.