response_type

String

Required

Its value must always be code.

client_id

String

Required

Identifier of the client assigned by TRIDENT to the signature application.

redirect_uri

String

Conditionally required

URL where the TRIDENT is requested to redirect the browser to provide the signature application with the authorization code corresponding to the authorization the user grants.

If a list of redirect URIs was configured in the TRIDENT for the signature application, this value must be one of them. This parameter can be omitted if only one redirect URI was registered for the application since this URI is considered the default redirect URI for the signature application in this particular case.

scope

String

Optional

Scope of the authorization requested by the application (see section 3.3 of [RFC 6749]). Only the service (which is the default) or the credential scopes can be requested.

code_challenge

String

Optional

The value that results from transforming a code_verifier value using the method indicated by the code_challenge_method parameter. The code_verifier value, in turn, must be a random secret value (namely, a high-entropy value with a minimum length of 43 characters and a maximum length of 128 characters) that must be included in the later token request so that the required access token is indeed exchanged for the authorization code grant that is eventually obtained in this operation. See RFC 7636 for more details.

code_challenge_method

String

Optional

Method used to calculate the code_challange parameter's value from the value that is to be put in the code_verifier parameter of the subsequent request to the Obtain an OAuth 2.0 access token operation. The only value supported is "S256". This means that the code_challenge value is obtained by calculating base64url_encode(SHA-256(ASCII(code_verifier)))), where code_verifier is a high-entropy random string between 43 and 128 characters (see [RFC 7636]).

state

String

Optional

Up to 255 random data bytes that the TRIDENT has to return in the response. This value can be used as a transaction identifier or any other application aim. Although this parameter is optional, we recommend its use to protect against cross-site request forgery attacks.

lang

String

Optional

Language in which the signature application prefers that the TRIDENT provides the browser the pages for getting authorization from the user. The language is specified as per [RFC 5646]. This parameter is optional. If this parameter is not included (or it is, but it specifies an unsupported language), the language set by the browser will be used. However, US English (en-US) will be used if the TRIDENT does not support this language.

credentialID

String

Conditionally required

Identifier of the credential bound to the signing key for which the signature application wants authorization. It must be used only if the scope of the OAuth 2.0 authorization request is credential (it is mandatory in that case).

numSignatures

Number

Conditionally required

Number of signatures for which the signature application asks authorization. This parameter can only be used if the scope of the authorization requested is credential and the hashes parameter is present . I f this is the case, including this parameter is mandatory to be granted authorization.

The value of this parameter must be equal to or less than the value of the multisign parameter for the signature credential (credentialID) for which the authorization is being requested (see Obtain a Signature Credential of a User for information on the multisign parameter).

hashes

String

Conditionally required

List (separated by commas) of the hashes of the data to be signed and for which the signature application requests signature generation authorization. Each hash must be encoded in base64. The number of elements in the list must be equal to the value of the numSignatures parameter.

This parameter can only be used if the scope of the authorization requested is credential, and when the numSignatures parameter is present .

hashAlgorithmOID

String

Conditionally required

Identifier (OID) of the algorithm with which the hashes were generated based on which the signatures will be generated. It must be used only if the hashes parameter is present (it is mandatory in that case).

response_type

String

Required

Its value must always be code.

client_id

String

Required

Identifier of the client assigned by TRIDENT to the signature application.

redirect_uri

String

Conditionally required

URL where the TRIDENT is requested to redirect the browser to provide the signature application with the authorization code corresponding to the authorization the user grants.

If a list of redirect URIs was configured in the TRIDENT for the signature application, this value must be one of them. This parameter can be omitted if only one redirect URI was registered for the application since this URI is considered the default redirect URI for the signature application in this particular case.

scope

String

Optional

Scope of the authorization requested by the application (see section 3.3 of [RFC 6749]). Only the credential scope can be requested.

code_challenge

String

Required

The value that results from transforming a code_verifier value using the method indicated by the code_challenge_method parameter. The code_verifier value, in turn, must be a random secret value (namely, a high-entropy value with a minimum length of 43 characters and a maximum length of 128 characters) that must be included in the later token request so that the required access token is indeed exchanged for the authorization code grant that is eventually obtained in this operation. See RFC 7636 for more details.

code_challenge_method

String

Required

Method used to calculate the code_challange parameter's value from the value that is to be put in the code_verifier parameter of the subsequent request to the Obtain an OAuth 2.0 access token operation. The only value supported is "S256". This means that the code_challenge value is obtained by calculating base64url_encode(SHA-256(ASCII(code_verifier)))), where code_verifier is a high-entropy random string between 43 and 128 characters (see [RFC 7636]).

state

String

Optional

Up to 255 random data bytes that the TRIDENT has to return in the response. This value can be used as a transaction identifier or any other application aim. Although this parameter is optional, we recommend its use to protect against cross-site request forgery attacks.

lang

String

Optional

Language in which the signature application prefers that the TRIDENT provides the browser the pages for getting authorization from the user. The language is specified as per [RFC 5646]. This parameter is optional. If this parameter is not included (or it is, but it specifies an unsupported language), the language set by the browser will be used. However, US English (en-US) will be used if the TRIDENT does not support this language.

login_hint

String

Required

Identifier of the user to be authenticated. It must be the user's email.

credentialID

String

Conditionally required

Identifier of the credential bound to the signing key for which the signature application wants authorization. It must be used only if the scope of the OAuth 2.0 authorization request is credential and if there is no parameter signatureQualifier present (it is mandatory in that case).

signatureQualifier

String

Conditionally required

Identifier of the signature type, and hence the signing key, for which the signature application wants authorization.

• eu_eidas_qes: Q ualified electronic signatures as per the EU eIDAS regulation .

• eu_eidas_aes: Advanced electronic signatures as per the EU eIDAS regulation .

This parameter must only be used if the scope of the OAuth 2.0 authorization request is credential and the credentialID parameter is not present (it is mandatory in that case).

numSignatures

Number

Conditionally required

Number of signatures for which the signature application asks authorization. This parameter can only be used if the scope of the authorization requested is credential, and both the hashes and the credentialID parameters are present . If this is the case, including this parameter is mandatory to be granted authorization.

The value of this parameter must be equal to or less than the value of the multisign parameter for the signature credential (credentialID) for which the authorization is being requested (see Obtain a Signature Credential of a User for information on the multisign parameter).

hashes

String

Conditionally required

List (separated by commas) of the hashes of the data to be signed and for which the signature application requests signature generation authorization. Each hash must be encoded in base64. The number of elements in the list must be equal to the value of the numSignatures parameter

This parameter can only be used if the scope of the authorization requested is credential, and both the numSignatures and the credentialID parameters are present .

hashAlgorithmOID

String

Conditionally required

Identifier (OID) of the algorithm with which the hashes were generated based on which the signatures will be generated. It must be used only if the hashes parameter is present (it is mandatory in that case).

account_token

String

Required

The whole point of this property is to identify the organization with whom the user who has to grant the authorization is dealing or interacting. It consists of a compactly serialized JWS object (as per RFC 7515) generated by the application with the HMAC function and using the client_secret's SHA256 hash value as a shared secret. I.e., as follows:

Where JWT_Header is as follows, as per RFC 7518 and RFC 7519:

JWT_Payload is the following JWT object, as per RFC 7519, where sub is the organization's identifier and azp is the signature application's client_id:

And JWT_Signature is as follows as per RFC 7518 and RFC 7519: