Italian Government Identity (SPID, CIE, eIDAS)

Auris provides first-class support for Italy’s national digital identity infrastructure: SPID (Sistema Pubblico di Identità Digitale), CIE 3.0 (Carta d’Identità Elettronica), and eIDAS (the EU cross-border identity regulation). All three are configured in the Auris Console under Authentication → Government Identity and managed via the /api/italian-identity/ API family.

Overview

SPID

SPID is Italy’s public digital identity system, defined and governed by AgID (Agenzia per l’Italia Digitale). It is based on SAML 2.0. Citizens and businesses authenticate via one of 12 accredited Identity Providers (Poste Italiane, Aruba, InfoCert, TIM, Namirial, and others). Service Providers — your application — must register an SP metadata document with AgID and declare their organization type, assurance level requirements, and requested user attributes.

SPID defines three assurance levels (LoA): SpidL1 (username + password), SpidL2 (username + password + OTP — the recommended default), and SpidL3 (username + password + hardware token).

CIE 3.0

CIE is the Italian electronic national identity card. CIE 3.0 uses OIDC (OpenID Connect) against the Ministero dell’Interno’s identity server (idserver.servizicie.interno.gov.it). Three levels mirror SPID: L1 (browser redirect only), L2 (card NFC tap + PIN — the standard use case), L3 (card NFC + fingerprint reader). An optional QR code flow supports mobile NFC authentication without a desktop card reader.

eIDAS

eIDAS is EU Regulation 910/2014 establishing a cross-border digital identity framework. It allows citizens of any EU member state to authenticate on Italian public services using their national eID. Auris models eIDAS support as future-ready: the schema and API are in place and the configuration is preserved, but automated Keycloak synchronisation for eIDAS is scheduled for 2026–2027 when the Italian national eIDAS proxy node completes its certification. Three levels are defined: LOW, SUBSTANTIAL (the default), HIGH.

National IdPs

Beyond the three Italian standards, Auris ships 36 built-in identity provider templates covering EU (France Connect, BankID SE/NO, MitID, Suomi.fi, DigiD, itsme, BundesIdent, ID Austria, and others), Asia-Pacific (Aadhaar, SingPass, myGovID, JPKI), the Americas (Login.gov, Gov.br), and the Middle East (UAE PASS, Nafath). These use standard OIDC or SAML 2.0 connectors with no Italy-specific regulatory constraint.

Required Permission

All /api/italian-identity/* endpoints require the admin:all permission. Tenant is resolved from the x-tenant request header.

SPID Setup

https://app.yourdomain.com/spid/metadata

openssl req -x509 -nodes -sha256 -days 3650 \
  -newkey rsa:2048 \
  -subj "/C=IT/O=YourOrg/CN=app.yourdomain.com" \
  -keyout spid-sp.key \
  -out spid-sp.crt

https://auth.yourdomain.com/api/italian-identity/spid/metadata

SPID Attribute Mapping

Auris maps SPID attributes to internal user claims automatically. The default mapping covers 20 SPID attributes:

Additional attributes (registeredOffice, countyOfBirth, expirationDate, digitalAddress, domicile*) are mapped by default. Override the mapping via PATCH /api/italian-identity/spid by providing an attributeMapping object.

CIE 3.0 Setup

https://preproduzione.idserver.servizicie.interno.gov.it

CIE Attribute Mapping

The default CIE attribute mapping covers 11 fields:

eIDAS Setup

National IdPs

National IdPs are generic OIDC or SAML 2.0 connectors for government and public identity providers outside of the Italy-specific SPID/CIE standards. Auris ships 36 built-in provider templates. Use them for EU cross-border access and international deployments.

Adding a national IdP

Aggregated Status

The /api/italian-identity/status endpoint returns a single JSON object with the configuration and enabled state of all four systems:

{
  "success": true,
  "data": {
    "spid": {
      "configured": true,
      "enabled": true,
      "testMode": true,
      "enabledIdpCount": 5
    },
    "cie": {
      "configured": true,
      "enabled": true,
      "testMode": true
    },
    "eidas": {
      "configured": false,
      "enabled": false
    },
    "nationalIdps": {
      "total": 3,
      "enabled": 2
    }
  }
}

The Console overview page uses this endpoint to render the status dashboard.

Testing

SPID

Use the AgID SPID Validator at https://validator.spid.gov.it. This is the official AgID test IdP and accepts test users without a real SPID account.

1. Ensure Test Mode is on in your SPID configuration.
2. Enable the SPID Validator (AgID Test) IdP in the Console.
3. Navigate to your application’s login page — the SPID Validator button appears alongside production IdPs.
4. The validator lets you select a test identity level (SpidL1, SpidL2, SpidL3) and returns a synthetic SAML assertion with test attribute values.

CIE

Use the CIE pre-production environment (preproduzione.idserver.servizicie.interno.gov.it), which is active automatically when Test Mode is on. The Ministero dell’Interno provides test credentials for registered developers — request them during CIE application registration.

eIDAS

Contact AgID or your eIDAS middleware vendor for access to the eIDAS test node. The Italian national test node is available to registered service providers.

National IdPs

Use each provider’s official sandbox environment. The Test Mode toggle on each national IdP configuration is a convention marker — switch provider endpoints manually to the sandbox values when testing, then switch back to production endpoints before go-live.

Going Live

SPID Accreditation

SPID accreditation is managed by AgID. The process for private-sector service providers (Soggetti Privati) is:

1. Register your organization on the AgID SPID onboarding portal .
2. Submit your SP metadata URL. AgID validates the XML structure against the SPID Technical Rules (Regole Tecniche SPID).
3. Run the AgID conformance test suite against your pre-production environment using the SPID Validator.
4. Agree to the SPID Usage Agreement (Convenzione d’uso SPID) for private-sector SPs.
5. Await AgID approval and your official Entity ID confirmation.
6. Disable Test Mode in the Console once approval is received and production IdPs are tested.

CIE Go-Live

CIE service provider registration is handled by the Ministero dell’Interno via the CIE developer portal . After production Client ID approval, disable Test Mode in the Console to switch to idserver.servizicie.interno.gov.it.

Checklist

Before switching off Test Mode for any identity system:

• SP metadata URL is reachable publicly over HTTPS (SPID)
• SP certificate is valid (not expired, 2048-bit RSA minimum)
• ACS URL responds and handles SAML POST assertions (SPID)
• OIDC redirect URI is registered with the provider (CIE, National IdPs)
• Attribute mapping is correct and tested end-to-end
• AgID or provider accreditation approval received (SPID, CIE)
• Audit logs reviewed for any errors during test sessions