5.2. Checking Data Validity

After a registration form is submitted, the registration server checks data validity and asks the user to correct any errors. In case the data is valid, the process of registration of a new account is initiated. The registration server saves all the necessary data in this account and adds your identification (service provider identifier, realm). Then, the identification of the user starts with sending verification codes to e-mail and phone number.

The next step is informing your application of a successful registration.

In case of communication via OpenID Connect, the URL for sending information must be entered during the client registration process using the assertion_uris key that contains a list of addresses (encrypted in a JSON) to send the messages to.

Your application directly sends a HTTPS POST message to the interface determined by the URL. The message contains three parameters:

  • registration_nonce – a unique transaction identifier for matching with the original request,

  • MojeID user’s identifier:

    • sub – in case of the OpenID Connect protocol,

  • status – status with the value REGISTERED.

Your application first has to verify this message:

  • It has to check if the message was delivered to one of the addresses listed in the Requesting Creation of a MojeID Account of a MojeID Account section.

  • It has to check if the registration_nonce transaction was really created.

  • It must verify that the client certificate used to create the SSL tunnel is valid and signed by the CZ.NIC certification authority. If you do not have such a certificate, please send us the service provider identifier (clientID) to techsupport@mojeid.cz. We will create and send the certificate to you.

If you do not use HTTPS and you want to try logging in and creating accounts in the test environment, you do not need this certificate.

If you use HTTPS and you are in the test environment, you need this certificate to send notifications from registration. It is not needed for logging in (only general public data is transferred between MojeID and your server, so it is not necessary to check the “identity” of the requester).

The notifications are sent after registration, partial identification (verified e-mail and phone) and identification (entered PIN3, until 2024 only) to assert_url listed in the XRDS document in the realm. This works also in the test environment. If you want your application to be able to receive notifications, you need a realm with HTTPS. When the notification is received, it is necessary to response with a 'mode:accept\n' string, where the new lines are marked with \n.

Tip

The client certificate verification can be done by an HTTP server, e.g. Apache with the SSLVerifyClient configuration option.

If all the requirements are met, your application can match the MojeID identifier with its record of the user during the processing of this message for the purpose of authentication via MojeID.

Note

If this message cannot be sent securely using HTTPS, the registration continues without sending this message.