Response

A successful FIDO2_0 response (accompanied by a 200 OK) will look similar to the following::

<?xml version='1.0' encoding='UTF-8'?>
  <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
    <S:Body>
      <ns2:authorizeResponse xmlns:ns2="http://soap.skfs.strongauth.com/">
        <return>
        {
          "Response": "Successfully processed authorization response",
          "txdetail": {
            "txid": "254900MS6G5FQCUJMZ97-TELLARO-1631149799",
            "txpayload": "ewogICAgIm1lcmNoYW50TmFtZSI6ICJTdHJvbmdLZXkiLAogICAgImN1cnJlbmN5IjogIlVTRCIsCiAgICAidG90YWxQcmljZSI6ICIxNDk5NSIsCiAgICAiY2FyZEJyYW5kIjogIkFtZXgiLAogICAgImNhcmRMYXN0NCI6ICJ4LTEyMzQiLAogICAgInR4aWQiOiAiMjU0OTAwTVM2RzVGUUNVSk1aOTctVEVMTEFSTy0xNjMxMTQ5Nzk5IiwKICAgICJ0eGRhdGUiOiAiVGh1IFNlcCA4IDE3OjAyOjU2IFBEVCAyMDIxIgp9",
            "nonce": "XI7FATRRSWSp2JtAhnbl5g",
            "txtime": 1624381242480,
            "challenge": "OPbSt3YkbaFF8SWvyLO93H3hI7R7Xp4s6PAlZvjcmtQ"
          },
          "FIDOAuthenticatorReferences": [{
            "protocol": "FIDO2_0",
            "id": "WBQ0-B9MOEC2LwUn4Vi2K5uA_iDhg3oj7ZJiWG9A5ViFQO6yW1xtf9RGPX-f-Zx3BuS0xavJRey8mJuazZDOAGTnWc3JGH7UGTQzrcwhgizmDJ4t1MrLLjAYQrp64ML_LS9bpWe6_iaAhNHJTDhbeJcgB-Dfigu22xRfSdWbDNacloqveMoSUXuXO8ogJA0AWSq9nxL9MjI7YYV7Z3KOtg36JBe8crPuleQ5Ru_0L30",
            "rawId": "WBQ0-B9MOEC2LwUn4Vi2K5uA_iDhg3oj7ZJiWG9A5ViFQO6yW1xtf9RGPX-f-Zx3BuS0xavJRey8mJuazZDOAGTnWc3JGH7UGTQzrcwhgizmDJ4t1MrLLjAYQrp64ML_LS9bpWe6_iaAhNHJTDhbeJcgB-Dfigu22xRfSdWbDNacloqveMoSUXuXO8ogJA0AWSq9nxL9MjI7YYV7Z3KOtg36JBe8crPuleQ5Ru_0L30",
            "userHandle": "",
            "rpId": "strongkey.com",
            "authenticatorData": "WnTBrV2dI2nYtpWAzOrzVHMkwfEC46dxHD4U1RP9KKMBAAAAZA",
            "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiT1BiU3QzWWtiYUZGOFNXdnlMTzkzSDNoSTdSN1hwNHM2UEFsWnZqY210USIsIm9yaWdpbiI6Imh0dHBzOi8vZmlkb3Rlc3Quc3Ryb25na2V5LmNvbSJ9",
            "aaguid": "00000000-0000-0000-0000-000000000000",
            "authorizationTime": 1624381243333,
            "uv": false,
            "up": true,
            "signerPublicKey": "MIIBMzCB7AYHKoZIzj0CATCB4AIBATAsBgcqhkjOPQEBAiEA_____wAAAAEAAAAAAAAAAAAAAAD_______________8wRAQg_____wAAAAEAAAAAAAAAAAAAAAD_______________wEIFrGNdiqOpPns-u9VXaYhrxlHQawzFOw9jvOPD4n0mBLBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpZP40Li_hp_m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP____8AAAAA__________-85vqtpxeehPO5ysL8YyVRAgEBA0IABNbmOKMRGG_vuXnLIcw7t4euIlQkBBUYDLVzOZEhLonbm9QYdb51r1nY7GuSRC69SgZ8eQwQ-4U0nobMrVrHcjM",
            "signature": "MEYCIQCpAyCmCF0Wh84FxDN6TTeUe5nM-LJAUkd4S8kFq-oQqwIhAIaznWJadSphIMXuoDWMUHrjczGEYRfoilvC9VMfRWpD",
            "usedForThisTransaction": true,
            "signingKeyType": "ECDSA",
            "signingKeyAlgorithm": "SHA256withECDSA"
          }],
          "responseCode":"FIDO-MSG-0016",
          "skfsVersion":"4.13.0",
          "skfsFQDN":"example.strongkey.com",
          "TXID":"1-1-169-1679354369053"
        }
        </return>
      </ns2:authorizeResponse>
    </S:Body>
  </S:Envelope>

Response Description

Value	Explanation
Response	A human readable message indicating the response status.

txdetail Description

Value	Explanation
nonce	This attribute displays the “number used once” that was randomly generated by the SKFS to mix-in with the base64url-encoded transaction payload (txpayload) to generate the message digest (“hash”) that represents the challenge (which is eventually signed by the user).
txid	A string with a maximum length of 256 characters that represents a business application-defined unique transaction identifier. It can be anything that is appropriate to the business application. Some examples are shown below: “123456789” “SFAECO-12345” “254900MS6G5FQCUJMZ97-TELLARO-1631149799”
txpayload	This is the base64url-encoded object containing the transaction signed by the user, that resembles the following: ewogICAgIm1lcmNoYW50TmFtZSI6ICJTdHJvbmdLZXkiLAogICAgImN1cnJlbmN5IjogIlVTRCIsCiAgICAidG90YWxQcmljZSI6ICIxNDk5NSIsCiAgICAiY2FyZEJyYW5kIjogIkFtZXgiLAogICAgImNhcmRMYXN0NCI6ICJ4LTEyMzQiLAogICAgInR4aWQiOiAiMjU0OTAwTVM2RzVGUUNVSk1aOTctVEVMTEFSTy0xNjMxMTQ5Nzk5IiwKICAgICJ0eGRhdGUiOiAiVGh1IFNlcCA4IDE3OjAyOjU2IFBEVCAyMDIxIgp9
txtime	This attribute shows the time the transaction was signed, in seconds from the UNIX “epoch”—January 01, 1970, at midnight.
challenge	This is the message digest (hash) generated by the the SKFS to represent the unique transaction signed by the user. The digital signature on this challenge is the unique “authentication code” required by the European Banking Authority’s Regulatory Technical Standards (RTS) for Strong Customer Authentication (SCA).

FIDOAuthenticatorReferences Description

NOTE: This is an array that may have zero or more objects, providing data that was defined by the FIDO Alliance and EMVCo, to transmit confirmed transactions to Payment Service Providers (PSP) or Account Servicing Payment Service Providers (ASPSP) a.k.a. Issuing Banks.

The transmission of this digitally signed transaction to PSPs/ASPSPs is not within the scope of FIDO/WebAuthn protocols (at this time), and must be handled by the business application through other channels.

Value	Explanation
protocol	The protocol that is being used to convey this data structure to ASPSPs. In the case of FIDO, it is currently FIDO2_0.
id	The identifier of the FIDO credential that digitally signed this transaction. Also known as credentialId within the JavaScript API—Web Authentication (WebAuthn).
rawId	An implementation of an ArrayBuffer containing the raw byte sequence of the credentialId.
userHandle	This attribute contains the user handle returned from the Authenticator, or null if the authenticator did not return a user handle. See §6.3.3 The authenticatorGetAssertion Operation.
rpid	This attribute contains the RFC-6525 origin that represents the RP’s DNS domain. Only credentials registered to this rpid will qualify for providing a transaction confirmation—the digital signature of the challenge, thus providing proof of authorization.
authenticatorData	A complex data structure with information an RP should use to determine if they will accept the transaction confirmation and use the digital signature to confirm the transaction by the user. NOTE: The SKFS relies heavily on this object to determine if the generated signature—and the Authenticator that generated it—conform to the security policy defined within SKFS.
clientDataJSON	A serialized representation of a JSON structure whose message digest (a.k.a. hash) is digitally signed by the FIDO authenticator in response to a request for transaction authorization. NOTE: This object represents the most important result of a FIDO signing operation;it is what provides cryptographic evidence that the right challenge was signed with the right credential registered at this RP.
aaguid	This attribute describes a unique Authenticator Attestation Globally Unique Identifier;a unique string chosen by the FIDO Authenticator manufacturer to identify a class of authenticators.
authorizationTime	This attribute shows the time the transaction was signed, in seconds from the UNIX “epoch”;January 01, 1970, at midnight.
uv	A boolean flag indicating whether the FIDO authenticator verified the user’s identity through either a biometric measurement, a PIN, or a pattern before applying the digital signature on the transaction with the FIDO credential’s private key.
up	A Boolean flag indicating whether the FIDO authenticator determined the presence of the user at the device that confirmed the transaction by applying the digital signature.
signerPublicKey	The base64-encoded public key of the user’s FIDO credential corresponding to the private key that applied the digital signature on the transaction.
signature	The base64-encoded digital signature that confirms the transaction.
usedForThisTransaction	A Boolean flag indicating whether this FIDO credential was used to confirm this transaction.
signingKeyType	The cryptographic algorithm used by this FIDO credential for this transaction.
signingKeyAlgorithm	The signing algorithm used by this FIDO credential to confirm this transaction.