AGOV as a trust basis for workplace sign-in (agov.ch/workplace)
AGOV can serve as a trust basis for enrollment and recovery processes for digital workplace sign-in. This enables authorities to separate the reliable identity of a person from the technical platform and from the actual workplace credential.
This supports cross-platform workplace architectures, reduces dependencies on individual platform and cloud providers and strengthens digital sovereignty.
Basic principle
AGOV authenticates the natural person and, where required for the use case, can provide an identity verified at the required assurance level. The authority remains responsible for determining whether that person is an employee, which internal user account is associated with them, and which devices, roles and permissions they may use. When a workplace is set up, the person can therefore authenticate with AGOV. The authority’s responsible HR, identity or access management system associates the person authenticated by AGOV with the internal employee or workplace account. The workplace infrastructure can then generate its own cryptographic credential and associate it with that account. Private cryptographic keys can be hardware-protected and non-exportable, for example by using a Trusted Platform Module (TPM). AGOV can be used again when a device is replaced, a credential is renewed or access is recovered in order to reliably authenticate the person again.
No permanent AGOV sign-in
AGOV does not have to be involved in every daily workplace sign-in. Once enrollment has been completed, the actual sign-in can take place using the workplace credential managed by the authority within its own workplace, directory and authentication infrastructure. A temporary outage of AGOV or a lack of network connectivity to AGOV therefore does not necessarily have to prevent the use of a workplace that has already been set up.
Business Account and business e-mail address
A Business Account is not a mandatory prerequisite for this architecture model. A Business Account remains the account of a natural person. According to AGOV, its declaration and the associated business e-mail address or e-mail domain confirm neither employment nor organisational affiliation, a role or an entitlement. The authority must therefore establish the association between the person authenticated by AGOV and their employee or workplace account using its own authoritative systems and processes. This also avoids a circular dependency for new employees: initial workplace setup must not depend on access to a business e-mail address if access to that e-mail address itself only becomes available after the workplace has been set up.
Windows
Under Windows, the required technical building blocks are available in principle. Windows supports custom Credential Providers. They provide the interface to the sign-in UI, collect or produce credential information and pass it to the relevant Windows authentication components for the actual authentication. Through the Microsoft Platform Crypto Provider, Windows also supports cryptographic keys protected by a TPM. Microsoft additionally documents key attestation for proving that a key used for a certificate is in fact protected by a trusted TPM. For certificate-based domain sign-in, Windows uses Kerberos with Public Key Cryptography for Initial Authentication in Kerberos (PKINIT). The availability of these individual Microsoft-documented building blocks does not, however, mean that an arbitrary TPM key can automatically be used for interactive Windows domain sign-in. The credential format, Credential Provider and Windows authentication mechanism to be used in a specific AGOV-supported workplace architecture must be defined and validated as part of its technical implementation. The target architecture can be designed so that Microsoft Entra, Microsoft Entra Connect and Microsoft Entra Kerberos are not required for enrollment or daily workplace sign-in. This does not mean that Windows Hello for Business inherently depends on Microsoft Entra. In addition to cloud and hybrid models, Microsoft explicitly supports on-premises Windows Hello for Business deployments using Domain Join, Active Directory, PKI and AD FS.
An AGOV-supported model is therefore not simply “Windows Hello for Business without Entra”. Its broader objective is to separate the trust basis for personal identity and enrollment from the specific workplace platform and make it usable across different operating systems.
Linux
The same principle can also be applied to Linux workplaces. Linux provides open authentication mechanisms as well as support for hardware-protected cryptographic keys, TPM2 and FIDO2. Their specific integration with PAM, directory services, Kerberos or other components is part of the respective workplace architecture.
Here too, the actual workplace credential remains under the control of the authority, while AGOV can provide the trust basis for the person’s identity during enrollment and recovery.
Clear separation of responsibilities
AGOV answers:
Which natural person is authenticating, and at what established level of identity assurance?
The authority answers:
Is this person an employee?
Which workplace account belongs to them?
Which devices, roles and permissions may they use?
The workplace infrastructure answers:
Which locally or organisationally managed credential does the person use during daily sign-in to prove that they may use this account?
AGOV therefore becomes neither a personnel or authorisation management system nor necessarily an online component required for each workplace sign-in.
Digital sovereignty
The architecture deliberately separates three layers:
- the reliable identity of the natural person;
- organisational assignment and authorisation;
- the technical workplace credential.
AGOV can support the first layer as a trust basis that can be used across organisations. The second and third layers remain under the control of the respective authority.
The same identity and enrollment logic can therefore in principle be used across different workplace platforms without tying the entire trust process to the identity stack of a single operating-system or cloud provider.
Status
The architecture described here is a possible AGOV usage model.
AGOV does not currently provide a ready-made Windows Credential Provider, a ready-made Linux PAM module or a turnkey replacement for Windows Hello for Business. The operating-system-specific components and their integration must be developed, tested and operated as part of the respective workplace architecture.