Awesome. Hi guys. I'm quite proud to be here today. I am Jan. I'm from L21s. We're a consultancy, software engineering, and I want to tell you two things before we kick off this talk. First of all, it's going to be a little technical in the end, so if you're interested, that's good. If you've never seen the terminal, maybe it's a little hard. Second of all, I know that AudiWallet is the new cool kid on the block, and everybody's talking about AudiWallets, but we had a very interesting experience with this card.
We had a large project where we integrated this with a health provider, and I always wondered, well, we do have this digital identity in our pockets with the electronic EID. Everything should be there, and it seems that everything is already at our fingertips. Nevertheless, it's very rarely seen in the wild, right? You see it in bureaucratic applications. There are some popular examples, but it's not that popular in the wild, especially in the private sector. I could never answer this question, and with this project we did, I think I could.
I brought from my experience the three reasons why AudiWallet is probably a good idea and why EID was not the best idea. First of all, we have a very complicated user experience, and this is for the end user, but this is also for the relying party or for the registrar. In the end, you need the Ausweis app, you need your transport pin, you need to exchange your transport pin, blah, blah, blah. This is a high entry barrier for people that are not digital native or not into this stuff. Then from the registrar or the relying party experience, it was even more bureaucratic, right?
Bundesverwaltungsamt, you have to get a certificate there. It's hard. Then there is also declining political support. I put the sticker there. Audi is coming, yes.
But still, if you now forgot your pin until 2024, you could just go to pinrücksetzbrief.de or whatever, and then you could get a new pin. This is not possible anymore for, I don't know, cost reasons or whatever. But in the end, if you lost your pin, you have to go to the citizen's office, and nobody knows or everybody knows. That's not fun. And then focus for today, it's also highly technical complex. So if you want to start that, you read the BSE's guidelines, and you really need intensive understanding of them to actually build this.
And also, it somehow needs deep technical integration in existing systems, right? So you have to AID, okay, but then what do you do with it? You have to save the data somewhere, you have to lock users in, whatever. And this is really, really technical. And I remember when we started the project, I was in Copenhagen with my girlfriend at the time, and I tried to understand what we actually need to do in the project, because I have never worked with AID before, and I couldn't wrap my head around it. The entire weekend, I was like, into the specs, and I was like, I don't get it.
And if I don't get something, I can't let it go. And this is why we, after the project, we did two things. So we said, or I said, I want to have a high level overview of what is actually happening if you do AID authentication.
And also, I want to have a proof of concept implementation that just works out of the box. So if I ever have to touch it again, I just check the implementation, and then I see, okay, this is how we did it then, or back then, and this is how it works. And this is what I want to want to go through to you today. So first of all, this is a simplified illustration, what is happening. And then afterwards, we're going to jump into the actual implementation. So it's nine steps, already simplified. But what you have is, you have some kind of business application, right?
Whatever you want to do, but you have front end. I put Angular here, but it could be something. And then first step is, it asks your user management, whatever it is, in that case, it's Keycloak, okay, I want to log in with AID. Then the user management creates, and this is point two, creates a secure link, it's a so-called TC token URL.
That, and this is point three, gets back to the business application. The business application then delegates to the AliceWise app, which has to be, if you're on a computer, it has to be running.
Otherwise, you get a connection refused in your browser, and you're like, okay, what's happening here? I don't know what that means. And then the AliceWise app talks to your user management again, and then talks to an AID server that you also need. So this AID server is, in this case, it's Gravenicus ID Punstar, which is, I guess, the most popular implementation, but there are other out there. And then the AID client, there you actually scan your AID. Then it talks to the AID server, it sends a SAML request, you can actually choose, right? It's either SAML or SOAP.
I'm a friend of standards, so we chose SAML. It sends a SAML request as a six to the AID server, and the AID server gets back the result. It verifies it with the registrar, if you're actually allowed to read the data you want to read. And then the AliceWise app then talks again to user management, and then your user management gets your token. And this is, well, I get it now, but when I read the specifications first, this picture would have helped me, because I was like, okay, what is happening here? What does it mean in the technical guideline?
And what you might have seen or what you might have thought is we have this user management, and it's Kikloke. Who knows Kikloke from you guys?
Yeah, there are a couple out there. Kikloke doesn't support AID by default, right? Because Kikloke is an open source product which knows nothing about German regulations. And what we do is we do love Kikloke, and we said, okay, when we want to do this proof of concept implementation, let's do it with Kikloke. Let's build Kikloke or extend Kikloke in a way that you can actually register and log in with showing your ID card. So you show your ID card, you get an account, and then when you come back, you show the ID card again, and you get logged in without getting a password, whatever.
You're just logged in. And then we published this plugin also on GitHub. You can see it. And this is where I put my laptop here. I'm going to go to this site now. And what you can see here is there's a GIF that actually shows what's happening, but I will show you in live. But what was the most important goal is that we have a process that actually works pretty much out of the box. So if somebody sees this, it should be, I mean, it's open source, and it's a proof of concept for those guys who sit there like I was when I was in Denmark and say, okay, how the hell is this working?
I need to see something where it's actually implemented. And it's not just written down, but I can see code. And this is what it's for. It's not production ready. You can't just use this. There are no limitations. But in the end, if you go here, you should be able to git clone it. And then I'm going to do that right now. So this is the terminal. I already cloned it. It's on my computer already. And then I just build it. It will take a second. And then I go back, and it says, okay, next thing I do is docker compose up.
Docker is a containerization solution that actually helps setting up key cloak and whatever is needed on your computer. And then you see there's some terminal output, blah, blah, blah, blah. And in the end, if everything goes wrong now, right now, yes, it does.
It says, okay, config exit with code zero. So this is just a short breakout. But if you ever work with key cloak, and you're tired of actually configuring it by hand, there's an awesome plugin from Adorsus, I guess, that actually helps you configuring key cloak with a YAML or JSON file. And then you start key cloak. And now key cloak is running where everything is already configured. And if I now go back to my browser, I see, okay, my second step I have to do is I have to open this URL. This is because there is a TLS certificate that needs to be trusted locally.
I already trust it, obviously, because I tested it beforehand. And then you need your ausvice app. And this is what I said, right? If it doesn't run, it's, I mean, not that good. This is running. And you already see there is a subtle developer mode hint there. So I now activate the developer mode in the ausvice app, which means you can simulate ID cards, right? Because the question is, okay, I don't have an ID card that I can just put there at the moment. I do have one, but not a test one. And you could audit them with the federal ministry, but this also works.
And then we described how to do that. There's also an official document for that, but it's unfortunately only in German. Yeah. And it's already configured on my end. And what we now need to do is, okay, we want to open our business application. You remember on the left side, there was the business application. We're going to open this now. And I'm going to go here and it runs on localhost 4200, whatever. I'm going to open it. And what you can see is this application is configured in a way that it redirects me to Keycloak and says, okay, you have to log in.
And normally I would say, okay, I'm Jan, blah, blah, blah. This is my password, but I don't need to do that now.
I can say, okay, or sign in with your ID. That sounds good. And if I do that, the ausvice app opens, and then we see that we, that we want to, you know, you can see who's actually requesting this, blah, blah, blah. And then with the card simulator enabled, you can just say, okay, go further. And then you can jump back to your application. So this is what I just showed you is where you actually hold your ID card on your reader, on your phone or whatever. And then you get back to the application. And what you can see is you're actually getting a token, right? So this is a Jot.
We can put that in Jot.io if we want. Now you can see if you ever, if you ever saw a Keycloak token, there's a secure token, Realm access, blah, blah, blah.
It, this, this looks fine and it locks, it locks us in. So another question is how does Keycloak look like? Because we now, oh, sorry, that was the wrong URL. I'm logging into the Keycloak admin console right now. And this is from the enterprise's perspective, right? So the enterprise now needs to know, okay, Erika Mustermann actually registered with my service. And if they, if they look it up, they see, okay, yeah, there's an Erika Mustermann right there. And it got an ID. And we have a name. This name actually comes from the simulated EID.
And what you can also see is this Erika Mustermann, it's linked to a user ID from the EID provider. If you, if you're into this field, this is the so-called restricted ID, which actually is used to recognize you the next time you log in. Because we don't want to create a new user every time, but next time you want to log in, you want to open your ID card and you want to get the exact, exact same account. And what we can do now to demonstrate this is I'm going to, I'm going to change her name. I'm going to capitalize the name.
And now she's called Erika Mustermann with the capital E and the capital M. And if we now go back, I'm not entirely sure. Let's refresh this token. We see there's Erika Mustermann with a capital E and the capital M, and there was a new login flow right now, but you didn't see it.
So, and if we actually would log in totally new, because our token expired, then it would be the same result. So Keycloak is now able to identify you based on your ID card. So what is the real world use case of this now?
I mean, you could log in your users this way. I don't know if you actually want to do that, but the important thing is all this digital identity wallet stuff is, is cool, but somehow needs to be integrated into the enterprise because this track is called beyond enterprise, but somehow the enterprise needs to do something with it, right? Register a user, or at least see that the data came from there, whatever. And this is, this is what we did here. And also I wanted to have, as I already said, the implementation where I could always come back and say, okay, how did it work? Yeah.
If you have any questions, I got two minutes left. If I, if I get that right, if you have any questions, feel free to shoot now or come to me after the talk. I hope it was not too technical.
Um, first of all, thank you very much. And I'm looking forward to see how you integrate the EODI wallet. Perhaps that would be a good session next year. It's absolutely the next step. Okay. Do we have any question in the room? Thank you. This was about the German EID. You see a future where you would create the same thing, the same kind of plugin for EODI. Yes. Yes. It's already in your roadmap.
So, um, we will, we will do that. Um, we, uh, if there's anyone, in my understanding, it's not final yet. Right.
So the, uh, it's the running, uh, who is actually going to win it, but, um, we could, uh, yeah, it's on a roadmap. I would like to do that. So if there's anybody who's interested in that to do this with us, give us a call. Let's talk. Any further question? Okay. A quick one. How complex is the actual process as a end government or as a business to register with the, uh, government agency, or do we actually implement this? You probably need some certificate and some it's a form.
So you fill out the form, you send it there, and then you, uh, talk to the, um, I forgot the name, but there's, there's an agency for that. And I mean, is it, is it complicated?
No, but is it, is it digital also? No. So if you do that, if you do that for one, it's okay. We did that for three environments and 30 or 40 different providers. That was a pain. You could actually send it by email, I guess. Not entirely sure. All right. Okay. Thank you very much again. Thank you.
