Singpass Developer Docs
Developer Docs for Singpass
Developer Docs for Singpass
  • INTRODUCTION
    • Overview of Singpass
    • Understanding the basics of OIDC
  • Products
    • Login
      • Introduction
      • Key Principles
      • User Journey
      • Logo Download and Brand Guidelines
      • Singpass Button Guidelines (For developers and designers)
    • FAQ
      • Login
      • Myinfo
    • Myinfo
      • Introduction
      • Key Principles
      • User Journey
      • Logo Download and Brand Guidelines
      • Data Display Guidelines
      • Scheduled Downtimes
  • GETTING STARTED
    • Onboarding Checklist
    • User Journey
    • Create Singpass Application
    • Start Integration - Demo App
  • Technical Specifications
    • Singpass Authentication API
      • Overview of Singpass Flow
      • 1. Authorization Endpoint
        • Redirection on success
        • For Mobile Developers
      • 2. Token Endpoint
        • Authorization Code Grant
        • Client JWK Requirements
      • 3. Userinfo Endpoint
        • Requesting Userinfo
        • Validating the payload
      • .well-known Endpoints
        • OpenID Discovery Endpoint
        • JWKS Endpoint
      • Error Response
      • Frame busting for web views
    • Staging and Production URLs
  • Singpass Developer Portal (SDP)
    • User Guide
      • Obtain Access to SDP
      • Login to SDP
      • Toggle Staging vs Production
      • Create Staging App
      • Edit Staging App
      • Create Staging Test Account
      • Create Production App
      • Edit Production App
      • Consent to Singpass Service Agreement
      • View Singpass Service Agreement
      • Updating Billing Contact Information
      • Deactivate Production App
      • Activate Production App
      • How to View Production App Transactions
    • Understanding the App Config Fields
      • App Name
      • App Description
      • Site URL
      • Support Emails
      • Allowed Scopes
      • Redirect URL
      • Token-based Authentication
  • Data Catalog (Myinfo)
    • Understanding the Data
      • Local Registered Birth Records and Sponsored Child Records
      • CPF Contribution History (up to 15 months)
      • Notice of Assessment (Basic)
      • Notice of Assessment (Detailed)
    • Catalog
      • Personal
      • Finance
      • Education and Employment
      • Family
      • Vehicle and Driving Licence
      • Property
      • Government Scheme
  • TESTING
    • Testing with Singpass App
    • Myinfo Test Personas
  • MORE INFORMATION
    • Contact
Powered by GitBook
On this page

Was this helpful?

  1. INTRODUCTION

Understanding the basics of OIDC

PreviousOverview of SingpassNextLogin

Was this helpful?

(OIDC) is a simple identity layer on top of the OAuth 2.0 protocol. It

  • Allows clients to verify the identity of the end user based on the authentication performed by an Authorization Server

  • Allows clients to obtain basic profile information about the end user in an interoperable and REST-like manner

  • Allows clients of all types, including Web-based, mobile, and JavaScript clients, to request and receive information about authenticated sessions and end-users

OIDC Actors

There are several actors involved in the Open ID Connect protocol. The following sections will detail each actor involved in the communication.

OIDC Provider (OP)

Singpass is an OpenID provider and it is the “vouch for” party in an identity federation. That is, it gives assurances of the identity of the user to the other party. The OpenID provider is responsible for:

  • Managing users and their identities

  • Issuing tokens

  • Handling user administration

  • Authenticating the user

  • Vouching for the user's identity with the relying party

  • Revoking user’s authenticated sessions and tokens

Client or Relying Party (RP)

The business entity will implement the relying party (also client or consumer) which will be the “validating party” in a transaction. The relying party or client is responsible for:

  • Controlling access to services

  • Validating the various tokens issued by OpenID Provider

  • Validating the asserted identity information from the OpenID provider (typically by way of verifying a digital signature)

  • Providing access based on asserted identity

  • Managing only locally relevant user attributes, not an entire user profile

  • Each client must be registered with an OpenID provider.

The clients registered with Singpass OP must be confidential clients, which means every client must be registered with Singpass OP with their Client ID and JWT Assertion.

User Agent

The user agent is a web browser or mobile browser or mobile application via which the user (resource owner) will initiate the communication with the OpenID Provider and Relying Party:

  • Serves static or dynamic pages

  • Handles redirections

  • May store cookies, user, and session information

  • Should not be used to store confidential data like user identity or tokens

Resource Owner

The resource owner could be an end-user or an entity capable of granting access to protected resources. In most cases, it would be the user accessing agency applications.

Resource Server

The resource server will be hosted on the agencies' perimeter. It is the server that is hosting the applications protected by the relying party. Agencies' relying party will communicate with Singpass OP before granting access to protected resources hosted on the resource server.

Here are some additional resources for learning more about OAuth 2.0 and OIDC:

OpenID Connect 1.0
OIDC Actors Flowchart