Developers

Request KYC assurance via OIDC

AuthServer remains the OpenID Connect provider. KYCServer owns step workflow and reviews. Client applications request assurance scopes like kyc:basic or kyc:address; AuthServer enforces and resumes authorization after completion.

OIDC scope driven Policy based Resume capable

Flow

The client only asks AuthServer for assurance. The client does not need KYCServer internals.

  1. 1
    Client requests assurance scope.Examples: kyc:basic, kyc:strong, kyc:address.
  2. 2
    AuthServer checks current KYC summary.Requirement is validated per step approvals.
  3. 3
    When missing, user is guided.AuthServer interstitial explains requirement; KYCServer opens earliest missing prerequisite step.
  4. 4
    Authorization resumes automatically.After KYC completion/review, AuthServer issues updated claims.

ASP.NET Core client

Request base KYC plus the required assurance scope.

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    })
    .AddCookie()
    .AddOpenIdConnect(options =>
    {
        options.Authority = "https://login.researchcave.local:7293";
        options.ClientId = "your-client-id";
        options.ClientSecret = "your-client-secret";
        options.ResponseType = OpenIdConnectResponseType.Code;

        options.Scope.Clear();
        options.Scope.Add("openid");
        options.Scope.Add("profile");
        options.Scope.Add("email");
        options.Scope.Add("kyc");
        options.Scope.Add("kyc:basic"); // advertiser
        // options.Scope.Add("kyc:address"); // publisher

        options.SaveTokens = true;
        options.GetClaimsFromUserInfoEndpoint = true;
    });

Policy-based challenge

Use endpoint policies and trigger challenge with stronger scope only when needed.

[Authorize]
public IActionResult Advertiser()
{
    var hasBasic = User.FindFirst("kyc_basic_verified")?.Value == "true";
    if (hasBasic) return View();

    var props = new AuthenticationProperties
    {
        RedirectUri = Url.Action(nameof(Advertiser), "Billing")
    };

    props.SetParameter("scope", "openid profile email kyc kyc:basic");
    return Challenge(props, OpenIdConnectDefaults.AuthenticationScheme);
}

Assurance mapping

Scopes map to required approvals this way.

var kycRequirements = new[]
{
    ("kyc:identity", "Identity information"),
    ("kyc:basic", "Identity information + identity document"),
    ("kyc:strong", "Basic + liveness selfie"),
    ("kyc:address", "Strong + proof of address")
};

Issued claims

When KYC scopes are granted, AuthServer can issue these claims into token/userinfo.

kyc_status kyc_assurance acr kyc_identity_info_approved kyc_identity_document_approved kyc_liveness_approved kyc_proof_of_address_approved kyc_basic_verified kyc_strong_verified kyc_address_verified kyc_approved_at kyc_expires_at