MOSIP / eSignet → openIMIS: Insuree Identity Verification & Enrollment Workflow

Content

1 Purpose
2 Trigger
3 Workflow Overview
4 Diagram
5 Workflow Steps
6 Interaction Table
7 Resources Summary
8 Security Considerations
9 Documents

Properties

Reference	https://standards.spdci.org/standards/dci-standards/id-systems-v1.0.0
Sector	Health / Social Protection
Components	MOSIP , openIMIS
github	https://github.com/openimis/sandbox/tree/develop/mosip_conn_esignet_officer/openimis-fe-insuree_js https://github.com/openimis/sandbox/tree/develop/mosip

Purpose

This workflow leverages eSignet — MOSIP's OAuth2/OpenID Connect-compliant authentication gateway — to allow an individual to authenticate and consent to share their civil/identity information with openIMIS during health insurance enrollment.

The use case describes an assisted, agent-driven enrollment: a designated enrollment officer facilitates onboarding by verifying the individual's identity through eSignet, collecting consented data, and submitting the application on the individual's behalf. This strengthens identity assurance and reduces enrolment fraud by replacing self-declared civil data with data verified in real time against a national ID system.

Key objectives:

Provide real-time, consent-based identity verification at enrollment, rather than self-declared demographic data
Give individuals explicit control over which data fields are shared with openIMIS
Establish a strong audit trail of consent and data provenance, aligned with DCI privacy principles

ℹ️ Note on workflow selection: A QR-code-based alternative (offline-capable, suited to low-connectivity areas) was also scoped during the sandbox project. Due to time and budget constraints, the community prioritized the eSignet OAuth2 workflow documented here, as it provides stronger real-time identity assurance and aligns better with national-level identity verification needs. The QR-code approach remains a relevant pattern for future work in connectivity-constrained deployments.

Trigger

An enrollment officer initiates beneficiary onboarding for national health insurance via openIMIS, and the individual's identity needs to be verified against a national ID system before enrollment is finalized.

Workflow Overview

Field	Value

Field

Value

Workflow Maturity

Implemented : tested end-to-end in sandbox (officer-assisted, real-time synchronization variant).

Referenced Standards

OAuth 2.0 Authorization Code Flow / OpenID Connect (OIDC) / DCI privacy principles: https://spdci.org

DCI Role Mapping

openIMIS = SP-MIS (Social Protection Management Information System)
MOSIP / eSignet = ID Provider (national foundational identity system — not a Social Registry)

Actors

Role	System	Description
Individual	Beneficiary / citizen	The person being enrolled. Authenticates with eSignet and grants (or denies) consent for specific data fields to be shared with openIMIS.
Enrollment Officer	openIMIS user	Facilitates the assisted enrollment: initiates the eSignet flow, guides the individual through authentication, reviews the verified data with the individual, and submits the enrollment application.
SP-MIS	openIMIS	Initiates the eSignet authentication request, exchanges the authorization code for an access token, retrieves consented identity data, pre-fills the enrolment form, and stores the enrollment with a reference to the MOSIP UIN.

Assumptions & Prerequisites

The individual is already registered in MOSIP and holds a valid UIN (Unique Identification Number).
The individual and the enrollment officer are online and have network connectivity to reach eSignet (this workflow is not offline-capable — see Note on workflow selection above).
openIMIS is registered as an OAuth2/OIDC relying party with eSignet (client ID/secret configured).
The individual has access to a channel (SMS, email, or in-person QR scan) through which the eSignet link can be delivered.
openIMIS enforces a no-edit policy on data retrieved from MOSIP: the enrolment officer can verify the data with the individual but cannot manually override fields sourced from MOSIP.

Validations

openIMIS (SP-MIS) must validate:

Authenticity and validity of the authorization code received from eSignet
Successful token exchange (valid, non-expired access token)
Completeness of the consented data fields required for enrolment

eSignet / MOSIP (ID Provider) must validate:

Individual authentication (PIN/password, biometric match, or OTP verification)
Explicit, field-level consent before releasing any data to openIMIS
Token scope limitations (only consented fields are released)

Diagram

Workflow Steps

Step 1 — Trigger eSignet Flow (openIMIS)

During enrollment, the officer accesses the national health insurance registration form in openIMIS and sends a dedicated eSignet link (via SMS, email, or QR code) to the individual. The link redirects the individual to MOSIP's eSignet portal.

Transaction: openIMIS → Individual (link delivery, out-of-band channel)

Step 2 — User Authentication (MOSIP)

The individual logs into eSignet using their MOSIP credentials — PIN/password, biometric (fingerprint, iris, or face), or OTP.

Transaction: Individual → eSignet/MOSIP

Step 3 — Consent for Data Sharing

eSignet displays a consent screen listing the requested data fields (name, date of birth, UIN, etc.). The individual reviews and explicitly authorizes data sharing with openIMIS.

Transaction: Individual → eSignet/MOSIP

Step 4 — Token Exchange and Data Retrieval

eSignet returns an authorization code to openIMIS. openIMIS exchanges the code for an access token, then uses that token to retrieve the consented identity data from MOSIP.

Transaction: eSignet/MOSIP → openIMIS (authorization code) → eSignet/MOSIP (token exchange + data retrieval)

Step 5 — Data Capture and Storage (openIMIS)

openIMIS pre-fills the enrolment form with the retrieved, consented data. The enrollment officer verifies the data with the individual (with no possibility to edit data sourced from MOSIP) and completes the enrolment. openIMIS stores the enrollment with a reference to the MOSIP UIN for future verification.

Transaction: Internal SP-MIS processing

Interaction Table

#	Interaction	From	To	FHIR Resource / Action	Reference

#	Interaction	From	To	FHIR Resource / Action	Reference
1	Send eSignet link	openIMIS (SP-MIS)	Individual	Out-of-band delivery (SMS/email/QR)	Initiated by Enrollment Officer
2	User authentication	Individual	eSignet/MOSIP (ID Provider)	PIN/password, biometric, or OTP
3	Consent data sharing	Individual	eSignet/MOSIP (ID Provider)	Field-level explicit consent
4	Send authorization code	eSignet/MOSIP (ID Provider)	openIMIS (SP-MIS)	OAuth2 authorization code
5	Get access token	openIMIS (SP-MIS)	eSignet/MOSIP (ID Provider)	Token exchange
6	Get consented information	openIMIS (SP-MIS)	eSignet/MOSIP (ID Provider)	Retrieve identity attributes via OIDC	Scope-limited to consented fields
7	Pre-fill insuree form	openIMIS (SP-MIS)	openIMIS (SP-MIS)	Internal : auto-populate enrolment form
8	Verify data with individual	openIMIS (SP-MIS)	Individual	Confirmation : no edit capability	Enrollment Officer facilitates
9	Complete enrolment	openIMIS (SP-MIS)	Individual	Enrollment finalized, linked to MOSIP UIN

Resources Summary

Resource / Object	System	Purpose

Resource / Object	System	Purpose
MOSIP UIN	MOSIP	Unique national identifier, stored in openIMIS as a reference for future verification
OAuth2 authorization code	eSignet	Short-lived credential exchanged for an access token
OIDC access token	eSignet	Scope-limited token granting access to consented identity attributes only
Consented identity attributes (name, DOB, gender, UIN, etc.)	eSignet/MOSIP → openIMIS	Pre-fills the openIMIS enrolment/insuree form

Security Considerations

The OAuth2 flow enforces mutual TLS, short-lived tokens, and scope-limited data access.
All data sharing is consent-driven and field-level : the individual sees exactly which attributes are requested before authorizing release.
The workflow is compliant with GDPR-like privacy standards and the Digital Convergence Initiative (DCI) privacy principles.
openIMIS enforces a strict no-edit policy on MOSIP : sourced data to preserve data integrity and provenance.

Documents

Mosip Collab environments :

https://docs.google.com/presentation/d/1fdAmz-JGxc-u9tqcmxiiQoBbZ7jWJC4wdYpE9DuKNas/edit?usp=drive_link