subject may be either identity (or a combination of): documents against the e.g. a private first via patterns 2 or source issuer QGCIDM QID 3. A traditional online database. identifier or account (e.g. verification of a public identifier e.g. A one-time password TMR CRN). [See or invitation code sent Note 2] by the client IDM to a Retrieving previously verified additional attributes mobile number or of a subject by registered mobile app providing the or postal subjects identity address or human attributes which messenger. have been verified previously by a A knowledge-based trusted entity (e.g. authentication process the IdP) as a [See Note 3] means to authenticate the subject to their record at the authoritative source. [See Note 1] Options to maintain Options to maintain Options to maintain Options to maintain currency/revocation: currency/revocation: currency/revocation: currency/revocation: Periodic re-query Periodic re-query Periodic re-query Periodic re-query through the through the through the through the claimant claimant claimant claimant EOI EOI EOI EOI Can be achieved Periodic Periodic re-query Periodic re-query through a resource using shared using shared delegation model identifier (a identifier for person-to-self transactional Push events e.g. sharing where an identifier might bulk load from access token need to be authoritative provides ongoing established by the source API access authoritative source in some cases) Push events e.g. bulk load from authoritative source Notes: This requires the Attribute Provider to have an identity resolution process to resolve a remote identity to a local identity record. See the patterns below regarding linking
subject may be either (or a combination of): A traditional online account (e.g. A one-time password or invitation code sent by the client IDM to a previously verified mobile number or registered mobile app or postal address or human messenger. A knowledge-based authentication process [See Note 3] identity documents against the source issuer database. e.g. a private QGCIDM QID identifier or verification of a public identifier e.g. TMR CRN). [See Note 2] Retrieving additional attributes of a subject by providing the subjects identity attributes which have been verified previously by a trusted entity (e.g. the IdP) as a means to authenticate the subject to their record at the authoritative source. [See Note 1] first via patterns 2 or 3. Options to maintain currency/revocation: Periodic re-query through the claimant EOI Can be achieved through a resource delegation model for person-to-self sharing where an access token provides ongoing API access Options to maintain currency/revocation: Periodic re-query through the claimant EOI Periodic using shared identifier (a transactional identifier might need to be established by the authoritative source in some cases) Push events e.g. bulk load from authoritative source Options to maintain currency/revocation: Periodic re-query through the claimant EOI Periodic re-query using shared identifier Push events e.g. bulk load from authoritative source Options to maintain currency/revocation: Periodic re-query through the claimant EOI Periodic re-query Notes: This requires the Attribute Provider to have an identity resolution process to resolve a remote identity to a local identity record. See the patterns below regarding linking
2.-Federated-identity-blueprint-Pattern-library-v100.docx