Why is understanding the differences so important?

Without a proper understanding of both, it could lead to misapplying the protocols—such as using OAuth for authentication without OIDC—which can introduce serious security vulnerabilities like impersonation attacks. This misunderstanding may also lead to flawed or insecure implementations. A clear separation of concerns between authentication and authorisation not only helps in choosing the correct protocol but also supports the development of scalable, maintainable architectures. It ensures reliable integration with identity providers (IdPs), social login platforms, and federated identity systems.

Let’s now examine the key differences between the two standards.

OAuth 2.0 is an authorisation framework that allows third-party applications to access a user’s resources with limited permissions without requiring direct access to the user’s credentials. Its primary role is to handle authorisation, not authentication. As such, it does not provide any user identity information. The protocol issues an Access Token, which grants access to protected resources, but it does not define or include an ID Token. OAuth 2.0 is best suited for use cases where an application needs to interact with APIs or access user data on behalf of the user.

In contrast, OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds standardised authentication capabilities. It enables clients to verify a user’s identity and securely retrieve basic profile information in a consistent, interoperable way. OIDC introduces the ID Token, a JSON Web Token (JWT) that contains identity claims such as the user’s name, email, and other profile details. Unlike OAuth 2.0, which only issues an Access Token, OIDC provides both an Access Token and an ID Token, with the latter specifically intended for identity verification. OIDC is ideal for scenarios where applications need to authenticate users and access their personal profile data.

Which Protocol is right for you?

Selecting the right protocol depends on the purpose your application is meant to serve. Here are some general guidelines to help you determine whether OAuth 2.0 or OIDC is the better fit. If your application’s primary focus is to manage access to user resources without needing to confirm who the user is, then OAuth 2.0 is the appropriate choice. It is ideal when authentication is handled elsewhere, and all you need is secure access control using tokens, especially in scenarios involving APIs or backend services. On the other hand, if your application requires user login, identity verification, or access to personal details like name and email, OpenID Connect (OIDC) is more suitable. OIDC is also the better option when implementing Single Sign-On (SSO) across multiple systems.

Singpass has adopted the OpenID Connect (OIDC) protocol.

To modernise how users authenticate across digital services in Singapore, Singpass uses OpenID Connect (OIDC) to ensure smoother integration for both public and private platforms through a consistent and widely accepted approach. OIDC not only helps confirm who the user is but also supports secure access to services across web and mobile environments. It introduces ID tokens that carry trusted identity details, making interactions more secure while reducing the risk of impersonation. For developers, the protocol removes complexity by offering reliable tools and predictable structures, speeding up integration. All of this makes the application able to meet growing demands around digital identity and privacy.

Interested in learning about the basics of OpenID Connect (OIDC)? Check out this related blog here:

The Basics of OpenID Connect (OIDC)

Follow us on LinkedIn for the latest happenings/updates.

The post OIDC vs OAuth2.0 appeared first on Netrust.

Singpass login has become the de-facto option for authentication for Singapore residents. Given the ease at which a user can authenticate with Singpass, it is the obvious choice when presented with multiple login options on a site.  Singpass uses a protocol called OpenID Connect(OIDC) to achieve this seamless and secure authentication session with our applications.

How exactly does your application use OIDC to authenticate you?

The OpenID Connect protocol (OIDC), is an identity protocol that builds upon the mechanisms of OAuth 2.0. OAuth 2.0 provides a resilient foundation that allows you to securely transmit JSON Web Tokens (JWT) containing your details over the internet using signatures (JSON Web Signature – JWS) and encryption (JSON Web Encryption – JWE). To provide reliable authentication, the OIDC protocol defines the attributes that should be within the JWT to identify the authenticated user as well as making it mandatory for it to be a JWS to be able to verify the source of the authentication.

How does OpenID Connect Work?

Before diving into the details, let’s familiarise ourselves with a few key terms:

OpenID Provider (OP) or Identity Provider (IdP): A system that creates, maintains, and manages identity information and also provides authentication services to relying applications.

Relying Party: An application or website that outsources its user authentication function to an IDP.

Identity Token (ID token): It contains at a bare minimum an identifier for the user and information about how and when the user authenticated.

OpenID Connect provides three types of flows for authenticating users – implicit flow, authorisation code flow and a hybrid flow

Implicit Flow: The ID token is returned directly to the application’s front end through the redirect URI.

Authorisation Code Flow: The ID token is not returned directly, applications are given an authorisation code that can be consumed to retrieve the ID token from a backend server.

Hybrid Flow: The ID token is returned directly to the application’s front end through the redirect URI along with an authorisation code.

Out of these, authorisation code flow is the most secure implication.

So how does the authorisation code flow work? 

1. User lands on a page that requires them to login before they can view resources – the user clicks on the “LOGIN” button.
2. The relying party redirects to the identity provider (eg. Singpass), specifying where the user should be redirected to after authentication along with other parameters relevant to the OIDC protocol
3. The user performs authentication on the identity provider page
4. If the login is successful, the identity provider redirects to the relying party along with an authorisation code
5. The relying party sends the authorisation code through a back channel to the identity provider’s server and receives an ID token in exchange.
6. The relying party validates the ID token and retrieves the user’s details from the token.

What is the benefit of using the OIDC Protocol?

1. SSO

The OIDC protocol allows applications to integrate with an identity provider and perform single sign-on. This enhances the user’s experience, allowing them to log in once and access the different applications supported within the SSO session.

2. Widely adopted and Standardized

It allows applications that support OIDC to be interoperable and easily integrated into various identity providers. Being a widely adopted standard, many libraries are available in various technologies that further simplify the integration.

3. Security

The standard ensures that the credentials the application receives can be verified with the use of signatures to ensure that the source of the identity is legitimate. Additionally, it provides relying parties and identity providers the option to encrypt users’ credentials so that they will be secure in transit.

Conclusion

OpenID Connect enables businesses to build more secure, user-friendly applications that leverage modern authentication standards. Whether you’re building server-side applications, single-page applications, or complex hybrid systems, OpenID Connect provides the flexibility and security needed to manage user identities effectively.

Follow us on LinkedIn for the latest happenings/updates.

The post The Basics of OpenID Connect (OIDC) appeared first on Netrust.

Digital signing is becoming increasingly popular as more and more transactions move online. It is a secure and efficient way to sign documents electronically, saving time and reducing the need for physical signatures. In Singapore, Singpass provides a solution for digital signing, allowing users to sign documents digitally with ease. In this blog post, we will discuss how to use Singpass for digital signing using nSignHub and the benefits of doing so.

What is Sign with Singpass?

Sign with Singpass is a feature of the Singpass system that allows users to sign documents electronically. It provides a secure and convenient way to sign documents online, eliminating the need for physical signatures. Sign with Singpass uses a digital certificate to verify the identity of the signatory and ensures the integrity of the signed document.

What is nSignHub?

nSignHub is a cloud-based electronic signing workflow solution that allows users to send, sign, track and manage signature processes using a browser or mobile device.

It allows users to utilize the following for their workflow requirements

• Tracking of documents in the workflow
• Signing using electronic, digital signatures including Sign with Singpass
• E-Sign documents with nSignHub digital witness certificates for added security
• Audit reports on signing activities during the workflow

Signing with Singpass using nSignHub!

Signing with Singpass has never been so easy with nSignHub.
Using our intuitive interface and signature selection fields, users can utilize digital signing with Singpass at a click of a button.

Three components must be by your side before utilizing this feature
1. Purchase Your nSignHub Account
2. Your mobile phone that has the Singpass mobile application installed
3. The document that you intend to sign with

4 Easy Steps to Sign with SingPass

1. Upload your document using your nSignHub Account

2. Click on Sign With Singpass and scan the QR code with your Singpass Mobile Application

3. Click on Approve on your Singpass Mobile Application

4. Verify your signed document in your nSignHub account

With this feature release, we enable nSignHub users & external parties to utilise Secure Electronic Signatures on nSignHub.

This enables them to sign using legally binding signatures on all documents when utilizing nSignHub.

So try out nSignHub today for your Sign with Singpass requirements for your organisation!

Reach out to us at https://www.netrust.net/contact-us/ or drop us an email at sales@netrust.net now.

Follow us on LinkedIn for the latest happenings/updates.

The post Fast, Secure and Hassle-Free: Sign with Singpass appeared first on Netrust.

In William Shakespeare’s Hamlet, Act 1 Scene 3, Polonius gave his son Laertes the advice ‘This above all: to thine own self be true,’. This is advice we all can get behind, however when signing documents today your personal identity would typically get mixed up with your professional identity. What are some options available to sign documents solely, in your professional capacity, today?

• Handwritten Signatures – Your unique drawn signature on paper, the same signature is typically used for both personal and professional capacities. Typically, your designation is written down if it is meant for work.
• Electronic Signatures – The platform creates a digital signature (Big plus here!) to protect the document after you have applied the drawn signature. The digital signature itself does not contain information unique to yourself, and is hence not a Secure Electronic Signature (SES).
• Sign with Singpass – Digital signatures backed by the Singpass, available if you can use Singpass Mobile. At no cost, however, it only lets you sign in your personal capacity^[1].

All of these are great and are still in use today, but why settle for just these options when you can use nSignBasic to get distinct identities?

Netrust is Singapore’s only commercial IMDA-accredited CA. We can issue digital identities in your personal capacity, professional capacity or even representing the organization you are working for. It can be stored in different formats such as a PFX file, in a FIPS USB token or a HSM just to name a few. Signatures are done using nSignBasic also fulfills SES requirements in the Electronics Transactions Act. For more information on nSignBasic please refer to our other blog post, nSignBasic – The New Face of Document Signing.

But that’s not all we have to offer. Organizations that require a large number of certificates or need certificates to be issued on demand to a system can integrate with our REST API^[2]. Such use cases would typically be getting certificates issued for internal staff. In conjunction with other software, certificates can also be used to authenticate users! Who says certificates can only be used for SSL? nSignBasic is the cornerstone of your digital identity requirements, and the sky is the limit on possible use cases.

Get your digital identity with us now! Check out nSignBasic for more information. You can also buy it online immediately. For other enquiries such as a large number of certificates or getting certificates issued programmatically feel free to contact our sales team at sales@netrust.net.

Do you just need to get a document signed with Singpass? You can use nSignSG, a free service from the #NetrustGivesBack initiative to get it done fuss-free.

Follow us on LinkedIn for the latest happenings/updates.

[1] Information is accurate at the time of publication.

[2] Subject to RA agreement with Netrust.

The post To thine own self be true; Signing professionally using nSignBasic appeared first on Netrust.

We’re on the brink of the Digital Era and soon approaching the post-Digital Era. Many things are slowly being replaced by technology. When ordering food, we will order it through food delivery applications. We book transportation through ride-hailing transport services instead of hailing a taxi from the street. Clearly, technology is an essential tool that we cannot avoid, it plays an important part in the majority of our lives because of the convenience and security it provides. Somehow, when it comes to signing there is a lack of this practice and the use of technology to perform Digital Signing.

Sharing with local tertiary students

A conversation I had with a student from the local tertiary school during my sharing on Digital Signing & Identity.

Student: “I have a question for you. You shared on digital signing but I am just a student and not in the working world yet. When is the right time & where should I start with digital signing?”

Mark: “You have to start right now. From submission of your Final Year Project Reports to something as simple as a Student Acknowledgement Form. All can be digitally signed. The reasons are it is more secure and it ties a unique digital identity to the work you accomplished”.

What is Digital Signing?

A digital signature is a unique feature embedded in a document in digital form like a fingerprint. A trusted Certificate Authority will be tasked to issue a digital certificate to the individual. The individual will then associate the digital certificate to the document to obtain a digitally signed document.

One key feature of digital signature is that it is used to secure digital documents. Preventing malicious personnel to tamper with digital documents received online. When a digital signature is applied to a specific document, the digital certificate is combined with the data being signed to form a unique fingerprint. These two components of the digital signature are unique, and this makes them more practical than wet signatures/electronic signature because their origin can be authenticated. This cryptographic operation helps in performing the following functions:

– Proving the authenticity of the document and its source
– Ensure that the document has not been tampered with
– Verifying the personal identity

If you would like to know more about the digital signature on digital documents, you could also refer to a post by my colleague Malgene: https://www.netrust.net/2022/05/25/securing-pdfs-with-digital-signatures/.

nSign Suite of Digital Signing Solutions: nSignSG

nSignSG is one of the signing solutions from nSign Suite. It is a live signing platform which is available free for the members of the public to perform digital signing with Sign with Singpass.

4 simple steps to Start Signing using Singpass Mobile App on nSignSG.

• Acknowledge
• Upload the Document
• Sign using SingPass Mobile App
• Complete & Download File.

Related Post: https://www.netrust.net/2021/09/29/enabling-sign-with-singpass-with-nsign/

Head over to nSignSG to try out the Sign with Singpass service with your documents and your Singpass Mobile App.

If there are any further enquires or unique signing requirements e.g. Sign with Singpass integration and/or the nSign Suite of Signing solution, do contact us here.

Follow us on LinkedIn for the latest happenings/updates.

The post Digital Signing – Where Do I Start? appeared first on Netrust.

Signing up for a new credit card; Logging in to HealthHub to check your vaccination status; Filling up registration forms on a kiosk. What do they have in common? All these processes have been simplified with the advent of Singpass services. The days of manually filling up forms are over as creating a new account is as easy as just one click of a button. Likewise, one no longer has to manually key in credentials for logging into a government website. All it takes is just a scan of the QR Code using your Singpass mobile app and Voilà, you are now logged in to the system and free to use its services.

The pitfalls of implementing Singpass Services

As convenient and seamless as it seems from an end user’s perspective, it is not the same for the developers who were integrating their application to enable Singpass services. The whole implementation process can be tough and tedious as it demands knowledge and skills from various domains, including but not limited to authentication protocols like OpenID Connect (OIDC) and 0Auth2.0, Public Key Infrastructure (PKI), Cryptography, and Web Technology.

The implementation of just one Singpass service could already take up a significant amount of time, such as understanding the concepts involving the relevant services. However, Netrust’s Singpass Authentication Module (SAM) allows a business application to integrate directly via its simple REST API without worrying about complying with Singpass’ standards and requirements.

My colleague Harpreet, discussed the general functionalities of SAM and its involvement in supporting Singpass in his recent blog post titled ‘Incorporating Singpass into Your Digital Services’. Let us further dive into how SAM fulfills the technical requirements of Singpass.

Technical and Security requirements from Singpass

Referencing the diagram, in the out-of-band interactions with Singpass, knowledge of technology such as JSON Web Token (JWT), JSON Web Keys (JWK), and JSON Web Key Store (JWKS) is required. A business application is required to handle cryptographic functions and processes like signing, verification, encryption, and decryption of the JWTs.

The cryptographic keys involved are the Elliptical Curve (EC) keys. To provide ease of key exchanges, both parties (Client and Singpass) also have to set up a Public Accessible JSON Web Key Set (JWKS) endpoint and retrieve the other parties’ public keys for cryptographic purposes. This allows key rotations to be done with minimal downtime across all parties.

What does Netrust’s Singpass Authentication Module (SAM) do?

With that said, SAM ticks all the new requirement changes and implementation as it hosts the JWKS endpoints and provides an automated exchange of the signing and encryption keys involved.

Apart from this basic functionality, SAM is also a one-stop solution that supports the enablement of multiple Singpass services like Login with Singpass/Corppass, MyInfo, MyInfoBiz, and Verify. This allows business applications the flexibility of integrating with multiple Singpass services at present or to do so in the future.

Over the years since Singpass services went live, there have been multiple iterations to the Singpass service to improve processes, workflow and security. An example is the authentication protocol migration from (SAML) to National Digital Identity (NDI) OIDC and Singpass Corppass (SPCP) OIDC to NDI OIDC. It is also important to note that different Singpass services are currently using different authentication protocols, e.g. MyInfo on SPCP OIDC and login with Singpass on NDI OIDC. As such, maintaining the differing implementations across the different services is a resource-consuming task. Clients can save themselves the trouble of constantly updating their codes to fulfil the ever-changing requirements of Singpass with SAM. With the Singpass API definition changes being transparent to the applications, minimal to no changes are required for applications.

If you are looking to improve your eServices’ process and workflow by incorporating Singpass services with minimal effort, SAM is your go-to solution. SAM will take care of all the out-of-band integration and supports all the latest technology and security requirements, providing the ease for clients to constantly keep up with the changes.

Over the years, Netrust has worked closely with Singpass as a partner and is vastly experienced with the integration of its services. We have successfully helped both clients in the public and private space to enable their business application’s consumption of Singpass services across different environments (On-premise, commercial, and government cloud platforms.

Should you have any further queries regarding any of the Singpass service integration or Singpass Authentication Module (SAM), do contact us here.

Follow us on LinkedIn for the latest happenings/updates.

References:
https://api.singpass.gov.sg/library/login/developers/overview-at-a-glance

https://www.netrust.net/2021/12/01/incorporating-singpass-into-your-digital-services/

https://api.singpass.gov.sg/library/verify/business/introduction

https://api.singpass.gov.sg/library/login/business/introduction

https://api.singpass.gov.sg/library/myinfo/business/introduction

https://api.singpass.gov.sg/library/myinfobiz/business/introduction

The post Enhancing Your Business’ Workflow Process with Singpass Authentication Module (SAM) appeared first on Netrust.

Introduction: From checking your CPF statements to logging into NS portal to book an IPPT session, every citizen or resident of this country is likely to have experienced Singpass authentication at least once. In fact, most probably use it on a regular basis.

From a simple platform that provided basic authentication in its early days, Singpass has bloomed into a service rich in features (such as two-factor verification and QR code scanning on the Singpass app). It has also become increasingly intuitive to use. In its current state, login can be as simple as clicking a login shortcut and verifying your identity with biometrics within the Singpass app.

How Netrust fits into the picture?

The complexities of authentication and keeping it secure are unseen by the common man. The Singpass Authentication Module (SAM) was developed by Netrust as a turnkey solution that handles these complexities for digital services integrating with Singpass.

SAM allows for digital services to integrate with its REST APIs while handling the implementation of all backend communication in accordance with Singpass’s specification. SAM deals with the management and operation of keys for signing and encryption while ensuring it complies with the authentication and authorization protocols used by Singpass.

• Netrust Authentication Module (NAM)

Since the inception of Singpass in 2003, Netrust has been supporting integration with Singpass under the name Netrust Authentication Module (NAM). NAM was used by both Singpass and government entities as a library that services could invoke to provide authenticity and integrity of the data being transmitted with the use of digital signatures.

• SAM SAML

In 2015, Singpass introduced SAML-based Federated Authentication (federated systems offer a single access point to several applications across various enterprises) and two-factor authentication. NAM reinvented itself as Singpass Authentication Module (SAM) and offered SAML integration to Singpass.

SAM allowed for government digital services to retrieve authentication and authorization attributes from both Singpass and Corppass without having to concern themselves with SAML concepts like profiles, assertions, and metadata. The data being received from Singpass/Corppass would be encrypted to provide confidentiality. SAM would decrypt the contents and verify the signature within the response (The X509 certificates being used by Singpass and government agencies for signing and encryption were issued from Netrust CA).

• SAM OIDC

With the advent of NDI, OpenID Connect (OIDC) has become the preferred protocol and has superseded SAML. SAM redesigned itself to include the following functionalities to provide OIDC integration to Singpass.

• • Construction of token endpoint request
  • Validation of token endpoint response
  • The decryption of id and access token
  • Verification of digital signature on id and access token
  • Parsing of result set from id and access token
  • Host JSON Web Key Sets (JWKS) endpoint
  • Retrieve JWKS from Singpass JWKS endpoint

NDI has also introduced Singpass mobile and expanded Singpass into a suite of services that are now available to both government entities and private businesses. From this suite, SAM has the ability to support Myinfo, Myinfo business, and Verify in addition to login with Singpass/CorpPass (Netrust also supports sign with Singpass, check that out here!).

Conclusion 

With technology and protocols ever-evolving, it is definite that Singpass will continue to evolve with the technology and security requirements of its time and you can rest assured that SAM will be right there with it every step of the way.

Should you have any further queries regarding Singpass Authentication Module (SAM), please email our sales team at sales@netrust.net.

Also check out these pages:

• • Code Signing Certificates
  • nSign Digital Signing Suite

The post Incorporating Singpass into Your Digital Services appeared first on Netrust.