Environment / Setup:
- eSignet deployed and exposed to the public network
- OTP authentication enabled initially — working as expected
- Biometric (Bio) authentication subsequently enabled
Issue:
After enabling bio-auth, authentication requests fail. On investigation, we found that the SBI (Secure Biometric Interface) is attempting to access the IDA (Identity Authentication) API to fetch the IDA FIR (Fingerprint Identity Record) certificate. This API is intended to be internal-only, but SBI — running on the client/public side — needs to reach it, and it is currently not exposed to the public network.
Root Cause (as identified on our end):
- The IDA FIR certificate API is scoped as an internal-only endpoint.
- SBI, which operates from the public-facing client side, requires access to this API to complete biometric authentication.
- Since this endpoint isn’t publicly exposed (by design, for security reasons), SBI’s calls fail, causing bio-auth to break in an open network deployment.
What we need help with:
- Is there a recommended/secure way to expose or proxy the IDA FIR certificate API for SBI consumption without fully opening up internal IDA APIs to the public network?
- Is there an alternate mechanism (e.g., certificate caching, local retrieval, a dedicated gateway/facade endpoint) intended for this exact scenario in public-network eSignet deployments?
- Are there existing configuration options or architectural guidelines for handling bio-auth in open/public network setups that we might be missing?
Any guidance, configuration references, or pointers to relevant documentation would be greatly appreciated.