MOBILE-ID · TRUSTED LTANS

Architecture and responsibility boundaries

Reference architecture for WSO2, Keycloak, API Services, adapter, Core and evidence infrastructure.

Explore the responsibility map

The reference design has eight layers and nine logical service groups. Tiles link to deeper content. Webhook Delivery belongs to product delivery; the Core LTANS Adapter is an integration boundary, not a native ADSS capability.

01 · Channels and applications

Business applications

DMS, ECM, ERP, eContract and sector systems.

Five portals

Admin, Operator, Member, Developer, Verifier.

REST and batch intake

Gateway APIs; configured SFTP/connectors.

02 · API gateway and security

WSO2 API Manager

API lifecycle, routing, quota and gateway policies.

HTTPS + OAuth2

Standard backend profile; operation/resource grants.

Enhanced / mTLS

Profile-specific, not a blanket client requirement.

03 · Identity and authorization

Keycloak IAM

Clients/service accounts, tokens and federation.

Token / claims

Issuer, audience, scopes and verified identity.

LTANS permissions

Organization, record, segregation and privilege.

04 · Services and adapter

Evidence

Profile-driven evidence records and revisions.

Verification

Policy/time/trust-context assessment.

Renewal

TIMESTAMP or HASH_TREE under prerequisites.

Policy

Profiles, retention, holds and disposition.

Storage

Bytes, evidence, reread grants and keys.

Trust Adapter

TSA, CA, OCSP/CRL and trust material.

Audit & Reporting

Audit, reports and usage reconciliation.

Webhook Delivery

Event delivery, retry, dedup and reconciliation.

05 · Events and orchestration

Kafka

Messages, IDs, metadata and references by design.

Outbox / Inbox

Durable publication, dedup and revision gaps.

Jobs / recovery

Authorized polling, retry and replay.

06 · Data and replicas

MariaDB / metadata

Logical schema ownership; deployment-specific topology.

Object / evidence stores

Provider-managed, BYOS or hash-only.

Backup / recovery

Reconcile bytes, metadata, evidence and keys.

07 · Trust and cryptography

TSA / RFC 3161

Tokens, imprint, policy and certificate path.

CA / OCSP / CRL

Certificate status under assessment context.

HSM / KMS

Scoped key management and crypto permissions.

08 · Operations and change

Java / WildFly

Reference runtime; not a topology commitment.

Observability

Correlation, logs, metrics and alerts.

Secrets / governance

Rotation, recovery and change management.

Vector export and publication scope

WSO2, Keycloak, Java/WildFly, MariaDB and Kafka are reference components requiring environment confirmation. The diagram does not establish server counts, independent deployments or accepted XMLERS/ERS interoperability.

REST and Core LTANS Adapter System Architecture Microservice ownership