Trust Marks¶

The Trust Marks (TM) are signed JWT RFC 7515 and represent the statements of compliance with a well defined set of requirements of trust and/or interoperability, or an agreement among the parties involved in the Federation.

The main aim of the TMs is exposing information that is not required by the OpenID Connect Core protocol, but turns out to be useful in the federative context.

Typical examples include the Entity's national or international identification code (fiscal code, IPA code, VAT number), institutional contacts and so forth, as defined at OIDC-FED. Further data may be added by the issuing subject.

During the registration process of a new Leaf Entity (onboarding), the TMs are issued and signed by the TA or its Intermediates (SA) or by Attribute Authorities (AA), if they are defined inside the attribute trust_mark_issuers, published inside the TA's Entity Configuration.

Each member Entity MUST expose, in its own configuration (EC), the TMs released by the issuing authorities.

In the CIE / SPID scenario, a TM is signed by the TA MinInterno / Agid or their Intermediates (SA) or by Attribute Authorities (AA).

The TA defines the subjects who are enabled to issue TMs that are recognizable inside the Federation, and this is done by the claim trust_mark_issuers, contained in its own Entity Configuration. The value of the claim trust_mark_issuers is composed by a JSON Object having as keys the TM identifiers, and as values the list of identifiers (URLs) or the Entities who are enabled to issue them.

In the following, a non-normative example of the object trust_mark_issuers inside the TA's Entity Configuration.

{
    "trust_mark_issuers":{
        "https://registry.agid.gov.it/openid_relying_party/public/":[
            "https://registry.spid.agid.gov.it/",
            "https://public.intermediate.spid.it/"
        ],
        "https://registry.agid.gov.it/openid_relying_party/private/":[
            "https://registry.spid.agid.gov.it/",
            "https://private.other.intermediate.it/"
        ]
    }
}

Each member Entity MUST expose in its configuration (EC), the TMs released by the issuing authority.

In the CIE / SPID scenario, a TM is signed by the TA MinInterno / Agid or their Intermediates (SA) or Attribute Authorities (AA).

The TA defines the subjects that are enabled to issue TMs that are recognizable inside the Federation, and it does it with the claim trust_mark_issuers, that is present in its Entity Configuration. The value of the attribute trust_mark_issuers is composed by a JSON Object whose keys are the TM identifiers and whose values are the list of the identifiers (URLs) of the Entities enabled to issue them.

The Trust Marks represent the first filter for establishing the trust among the parties. They are essential elements for starting the Metadata resolution. In their absence, an Entity is not recognized as a member inside the Federation.

Inside the SPID Federation, the Trust Marks have unique identifiers (claim id) in URL format, that adopt the following structure: https:// <domain> / <entity_role> / <trustmark_profile> / [extension /]

In the following, some non-normative examples:

• TM RP public: https://registry.agid.gov.it/openid_relying_party/public/

• TM SA private: https://registry.agid.gov.it/intermediate/private/full/

• TM AA: https://registry.agid.gov.it/oauth_resource/public/

The following table defines the <entity_role> that are recognizable inside the SPID and CIE id Federations:

The following table defines the <trustmark_profile> that are recognizable inside the SPID and CIE id Federations: