DigiLocker eKYC

DigiLocker is operated by NeGD (National e-Governance Division). Linking an employee's DigiLocker account to Sanchalan gives us a verified eKYC record (name, DOB, eKYC photo) without needing an AUA license. We use it as the legal identity proof for first-time face-template enrollment from the mobile app.

What's shipped

• attendance_digilocker_links table — Aadhaar-correlation hash, name+DOB match flags, encrypted access token, sanitised claims.
• DigiLockerClient service: PKCE OAuth2 flow, eKYC XML parser (XXE-defused).
• DigiLockerController: status / start / callback (web) + mobile-start / mobile-exchange (token).
• POST /api/v1/enrollment/face-template/digilocker: self-enrollment gated by a fresh (≤15 min) link with name + DOB matching the employee record.
• Mobile screen DigiLockerEnrollScreen — full PKCE flow via flutter_web_auth_2, embeds the DigiLocker photo + a live face frame, averages, submits.

End-to-end flow

What we store / what we don't

Why DigiLocker for parliament use cases

• No AUA license required. DigiLocker uses the user's own Aadhaar consent — Sanchalan is just a relying party, not authenticating against UIDAI ourselves.
• Voluntary by design. The user signs in with their DigiLocker credentials; non-coercive.
• Stronger than HR-mediated alone. The match between the DigiLocker photo and the live capture is cryptographically tied to the user's verified eKYC record.
• Suits MPs. No AUA / §7 awkwardness. DigiLocker is widely accepted for member-of-public use cases.
• Operational simplicity. Just a client_id + client_secret pair, no ASA gateway, no annual UIDAI audit.

Operator setup

1. Apply for an "agency" registration on DigiLocker (Partner Onboarding portal). Receive client_id + client_secret.
2. Register two redirect URIs:
   • Web: https://attendance.rajyasabha.digital/api/digilocker/callback
   • Mobile: sanchalan-attendance://dl/cb
3. Populate .env:

   DIGILOCKER_ENABLED=true
   DIGILOCKER_BASE_URL=https://digilocker.meripehchaan.gov.in
   DIGILOCKER_CLIENT_ID=…
   DIGILOCKER_CLIENT_SECRET=…
   DIGILOCKER_REDIRECT_URI=https://attendance.rajyasabha.digital/api/digilocker/callback
   DIGILOCKER_AADHAAR_SALT=$(openssl rand -hex 32)

4. Recreate the app container so config is reloaded.
5. Verify GET /api/digilocker/status → {"enabled":true,"has_client_id":true}.
6. Pilot with a small group (10–20 employees) before announcing wider availability.

Wire format reference

POST /api/v1/digilocker/mobile/exchange

// request
{
  "code":          "...",         // from the redirect's ?code=...
  "code_verifier": "..."          // PKCE — 43-128 url-safe chars
}

// response (link persisted)
{
  "link_id":     42,
  "employee_id": 21,
  "name_match":  true,
  "dob_match":   true,
  "has_photo":   true,
  "photo_b64":   "..."            // ONCE — never persisted server-side
}

POST /api/v1/enrollment/face-template/digilocker

// request
{
  "link_id":     42,              // must be ≤15 minutes old, name+dob match
  "embedding":   "...",           // base64 of 512-d float32 (LE)
  "model":       "mobilefacenet",
  "frames_used": 2,
  "consent": {
    "version":       "1",
    "text_url":      "/static/face-consent-v1.html",
    "signature_b64": null
  }
}

// response (201)
{
  "template_id":     1234,
  "version":         1,
  "enrolled_at":     "2026-04-27T19:30:00.000000Z",
  "identity_proof":  "digilocker_eaadhaar"
}

What happens on a name/DOB mismatch

The link is still persisted (with name_match=false / dob_match=false) for forensic record, but POST /enrollment/face-template/digilocker returns 403. The user must visit HR to enroll in person, or fix the discrepancy in their DigiLocker / employee_register record.

Threat model