Civipass

Description

Civipass connects a WordPress site to the official user authentication service (OAuth 2.0) of the Greek General Secretariat for Information Systems (GSIS). People sign in with their TaxisNet credentials on the GSIS pages — the site never sees them — and come back signed in to an account linked to their tax number.

The GSIS offers this service to public sector bodies (ministries, municipalities, regions, universities, legal entities of public law, chambers and other bodies of the wider public sector). Each body applies through the Interoperability Centre’s request application (EDA) and receives its own credentials. Civipass shows the exact return address to declare in that request.

Features

• “Sign in with TaxisNet” button on the login screen, as a shortcode ([civipass_login]) and as a block.
• Pilot (test.gsis.gr) and production (oauth2.gsis.gr) environments, each with its own credentials, and a button that checks them.
• Accounts are recognised by tax number. New accounts can be created on first sign-in (off by default), always with a role that cannot manage the site.
• People link their existing account from their profile. The tax number and names of a linked account are never edited by hand: they come from the GSIS at every sign-in, and the person can fetch them again with “Update details from TaxisNet” on their profile or with the [civipass_refresh] shortcode. Only staff who edit the account can unlink it.
• The GSIS does not give an e-mail address: new people enter one and confirm it by e-mail before it is saved.
• Signing out of the site also signs out of the GSIS, so a shared computer cannot reuse the session.
• [civipass_field name="fullname"] shows the signed-in person their own details (afm_masked, firstname, lastname, fullname…).
• Administrators see each linked account’s tax number in the users list and can find an account by typing the 9-digit number in the search box; everyone else sees it masked.
• Bodies that the GSIS has granted the one-time-code variant of the service (oAuth2.0-OTP) enter its credentials and get a second button.
• Personal data export and erasure, and suggested privacy policy text.

Security

Civipass creates and signs in accounts on behalf of an outside identity provider, so it is built to be strict by default:

• Nothing reaches the GSIS until a person presses the button. The TaxisNet password is typed only on the GSIS pages; the site never sees or stores it.
• Every sign-in carries a random, one-time state that is tied to the browser that started it (cookie) and expires after ten minutes, so a callback cannot be replayed, forged or forced on someone else.
• The one-time code is exchanged for the person’s details server to server, with certificate checks on, no redirects, a short timeout and a size limit. The answer is read with external entities and network access turned off.
• Accounts that can manage the site (administrators, editors and anyone with similar capabilities, also on multisite) cannot sign in with TaxisNet unless an administrator turns that on explicitly; they keep their password. New accounts never get such a role.
• The tax number and the GSIS client secrets are stored encrypted (libsodium). The key can be moved to wp-config.php, so a copy of the database alone reveals nothing. A keyed hash is used to find an account by tax number.
• User names are random, so the tax number never appears in author archives or other public addresses. Names that came from the GSIS cannot be changed by hand, through the profile screen, the REST API or wp_update_user().
• Sign-in attempts and callbacks are rate-limited per address (per /64 for IPv6).
• Every form and action checks a nonce and the user’s capabilities, and every value is sanitised on input and escaped on output.
• A test server can only be used on sites marked as local, development or staging (WP_ENVIRONMENT_TYPE), so a forgotten setting can never send a live site’s sign-ins elsewhere.

Civipass Pro, sold separately, adds features that bodies need in production, such as sign-in for public administration employees and a sign-in log.

External services

This plugin connects to the user authentication service (OAuth 2.0) of the General Secretariat for Information Systems (GSIS) of the Ministry of Digital Governance, Greece. Nothing is sent before a person presses a “Sign in with TaxisNet” button or an administrator presses “Test the connection”.

• When a person signs in, their browser is sent to https://test.gsis.gr/oauth2server/ (pilot) or https://oauth2.gsis.gr/oauth2server/ (production) with the site’s client ID and return address (the oAuth2.0-OTP service uses the same addresses with its own client ID). After they sign in and consent there, the site sends the GSIS the one-time code, its client ID and secret, and receives the person’s tax number, first name, last name, father’s name, mother’s name and year of birth.
• When a person who signed in this way signs out, their browser is sent to the GSIS sign-out page of the same environment.
• “Test the connection” sends the client ID and secret with a made-up code to the token address above.

GSIS: https://www.gsis.gr/ — service description and terms: https://www.gsis.gr/dimosia-dioikisi/ked/webservices/oauth20