Skip to Content

Italian Government Identity (SPID, CIE, eIDAS)

Auris stores tenant configuration for SPID, CIE, eIDAS and national identity providers. A saved configuration or successful metadata check is different from a working citizen login.

The current government-identity service retains configuration and metadata, but the SPID/CIE runtime login and broker flow is fail-closed pending native federation. Do not present these methods as ready for production sign-in. eIDAS configuration is also stored without an operational cross-border login promise. No launch date is established by this guide.

Overview

MethodWhat to verify before a project
SPIDService-provider participation, protocol, metadata, assurance level and a supported runtime integration
CIEProvider onboarding, requested assurance level, callback configuration and runtime availability
eIDASThe applicable provider/node integration and a verified end-to-end flow; a saved configuration is insufficient

For CIE, level 1 uses credentials, level 2 adds a temporary code, and level 3 uses the physical card with a compatible reader or NFC device. Consult the Ministry’s digital identification guidance  for current requirements.

SPID service-provider participation has its own onboarding process. Follow the official service-provider instructions  and AgID SPID guidance ; installing Auris does not complete that process.

Required Permission

Administrative government-identity routes require admin:all. Set x-tenant to the tenant realm associated with the authenticated administrator. The API checks tenant binding and resolves the tenant record; a caller-supplied realm does not grant access to another organization.

Inspect configuration without changing it

Run this example in a trusted administrative environment. Obtain apiOrigin, accessToken and tenantRealm from secure configuration. Never put an administrator token in public browser code.

const response = await fetch(new URL('/api/italian-identity/status', apiOrigin), {
  headers: {
    Authorization: `Bearer ${accessToken}`,
    'x-tenant': tenantRealm,
  },
})
if (!response.ok) throw new Error(`Status request failed: ${response.status}`)
const result = await response.json()
if (!result.success) throw new Error('Status request was not successful')
// Inspect result.data privately; it describes stored configuration, not runtime readiness.

Configuration surfaces

API familyPurpose
/api/italian-identity/statusAggregated tenant configuration status
/api/italian-identity/spidSPID configuration
/api/italian-identity/spid/metadataSPID metadata surface
/api/italian-identity/spid/idpsSPID identity-provider configuration data
/api/italian-identity/cieCIE configuration
/api/italian-identity/eidaseIDAS configuration
/api/italian-identity/national-idpsNational provider configuration

Use the Console to edit configuration. Keep signing material and provider credentials in the designated secure fields, and use a test environment before changing a tenant used by real users.

Going Live

  1. Confirm provider onboarding and the assurance level required by your service.
  2. Confirm that the deployed Auris release supports the complete runtime flow. Stop if it only stores configuration.
  3. Test sign-in, cancellation, invalid assertions, expired credentials and the wrong tenant in an approved test environment.
  4. Verify callbacks, account linking, required attributes and authorization after sign-in.
  5. Agree on operational ownership and failure handling before using production credentials.

Next step

For an application that needs a supported login flow today, start with hosted login and authentication settings. To assess government-identity requirements and current implementation boundaries, request an Auris integration discussion .

Architecture