ELECTRONIC IDENTITY FOR THE ADMINISTRATION

Deployment in production of the new Mobile Key IDP

From around July 4, a new IDP, called Cl@ve Mobile, will be launched within the options available on the Clave gateway. This IDP makes it possible to simplify electronic access to public services, bringing together in a unified and simplified user experience the pre-existing IDPs of PIN key and permanent key. This unification process will proceed progressively as the use of the new IDP Cl@ve Mobile is implemented. At the moment, the three IDPs (Cl@ve PIN, Cl@ve Permanente and the new IDP Cl@ve Mobile) will coexist to facilitate the change.

In this context, citizens will not have to make any new registration in the cl@ve services, they will simply be able to authenticate themselves by confirming the authentication requests they will receive through the mobile app Cl@ve, which citizens will perceive as a new version of the hitherto available key PIN app.

You can see an example of interaction with the new system through this little presentation video. Cl@ve Mobile - YouTube I would ask you to use information only in your internal areas.

This new IDP Mobile Key is already active in the testing environment (SE) of the SGAD for all bodies that already had the IDP PIN Key enabled. You can test the full authentication cycle with Cl@ve Mobile from your production, which will offer a simple mechanism to perform tests in the testing environment.

Integration with the new RTD

As soon as to existing integrations that are carried out directly through the Key gateway and do not restrict any authentication request to a specific PDI, the integration will be transparent and, in principle, no further action will be required.

It is important to note that, although this is not the recommended option, we know that there are integrations with the Key gateway in which the organism has independently developed the connection with each of the IDPs, and to this end it restricts the IDPs shown in the identification requests. For this type of integration, if you do not want the mobile key IDP next to the pin key IDP, you will need to restrict the new Mobile Key IDP., in addition to PIs that were already restricted. To achieve this, the following parameter should be added to the SAML:

<eidas:RequestedAttribute FriendlyName="CLVMOVILIdP"
Name="http://es.minhafp.clave/CLVMOVILIdP"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
isRequired="false"/>

 

In this way, only PDIs that were previously shown will remain visible.