Citizen digital identity for Atlantis
Federated sign-in through a double-blind identity exchange, and verifiable credentials in a wallet, running live on the internet and aligned with the technical profile of Australia's Trusted Digital Identity Framework.
Technically compliant with the AGDIS Data Standards 2024
The federation follows the OpenID Connect profile of Australia's Digital ID (AGDIS) Data Standards 2024, which carries forward the Trusted Digital Identity Framework (TDIF). Of 32 technical requirements, 30 are met in full. The other 2 are met for Poseidon ID but limited for Atlantis ID by its Auth0 plan.
Signed and encrypted request objects · private_key_jwt · PKCE · pairwise subjects · consent at the exchange · TDIF assurance levels with step-up · RP audit ID · single logout · no attributes kept by the exchange · tamper-evident audit. This is technical compliance, not accreditation. See every requirement.
Four messages
Real products, real standards.
Auth0 runs the identity provider (Atlantis ID); Keycloak runs the identity exchange, and a second identity provider (Poseidon ID). Everything speaks OpenID Connect, OpenID4VCI and OpenID4VP.
Shown in: Steps 1, 2 (E1 for Keycloak as an identity provider)
Double-blind and privacy-preserving.
You sign in to an agency through the exchange; another agency gets a different identifier for the same person, and neither learns which provider you used.
Shown in: Steps 2, 3
Phishing-resistant MFA.
Passkeys are bound to the site and can't be phished; they give TDIF credential level 2, and an agency can insist on it.
Shown in: Steps 1, 4 (E3, E4)
Verifiable credentials.
The identity provider issues a credential to the citizen's wallet; an agency trusts the issuer's published key, signs the citizen in and receives only the attributes it asked for.
Shown in: Step 5 (E6)
Identity proofing from the passport chip.
The wallet reads an Australian passport over NFC; the identity provider checks DFAT's signature and revocation list (ICAO 9303 passive authentication) and raises the identity to IP1 Plus, then IP2 with a second document. Agencies can insist on it.
Shown in: E8
The parties
Every party runs on its own domain. Open any of them; the monitor shows what happens as you go.
| Party | Address | Role | Runs on |
|---|---|---|---|
| Atlantis ID | id-atlantis.xyz | Identity provider portal and credential issuer (did:web:id-atlantis.xyz) | Node 22 service + Auth0 |
| Auth0 (Atlantis ID sign-in) | login.id-atlantis.xyz | Universal Login, passkeys, passwords, resets, Actions | Auth0 tenant on Essentials, custom domain |
| Poseidon ID | poseidon-id.xyz | Second identity provider, email and password | Keycloak 26.8.1 |
| Identity exchange | exchange-atlantis.xyz | Double-blind broker: provider choice, consent, pairwise identifiers | Keycloak 26.8.1 + Atlantis extensions |
| Agency A | agency-a-atlantis.xyz | Relying party through the exchange; linking, step-up, passkeys | Node 22 service |
| Agency C | agency-c-atlantis.xyz | Second relying party through the exchange; different identifier | Node 22 service |
| Agency B | agency-b-atlantis.xyz | Wallet sign-in only: OpenID4VP verifier | Node 22 service |
| Monitor | atlantis-demo.xyz | Live event flow, TDIF tags, tamper-evident audit chain | Node 22 service + collector |
| Atlantis Wallet | On the iPhone | Holds the SD-JWT credential, scans the QR codes, reads the passport chip over NFC | SwiftUI app on iPhone (iOS 18+) |