ESIA Authorization. Site login via Gosuslugi

What this solution does

ESIA Authorization Module for 1C-Bitrix

This component implements the client-side interaction with the Unified System of Identification and Authentication (ESIA) on websites running on the 1C-Bitrix platform. Full compliance of the licensee's information system with the requirements of the Ministry of Digital Development of the Russian Federation is ensured through a set of organizational and technical measures that extend beyond the scope of this module.

The solution is intended for organizations required to connect their website to ESIA in accordance with regulations: government and municipal institutions, medical facilities, banks, insurance companies, and others.

The package includes step-by-step implementation documentation: from obtaining a qualified electronic signature (QES) and certificates, configuring cryptographic protection, to registering the information system and connecting to the industrial ESIA environment. Cryptographic software (e.g., CryptoPro) must be purchased and installed by the customer.

Module capabilities:

User login to 1C-Bitrix via ESIA in compliance with all Ministry of Digital Development requirements.

Automatic creation of a user account upon first login through the Gosuslugi portal.

Secure data exchange between the website and ESIA.

Target audience for the ESIA module

Connecting a website to the Gosuslugi system is available only to organizations that comply with the regulations of the Ministry of Digital Development of the Russian Federation. Eligible categories include state and municipal institutions, medical organizations, banks and microfinance organizations, insurance companies, non-state pension funds, licensed professional securities market participants (brokers, dealers, asset management companies), and telecommunications operators.

The ESIA (Gosuslugi) authorization module is developed in accordance with the technical requirements imposed by the ESIA operator on the client part of information systems as of the date of the module's last update. Full compliance of the system with these requirements is verified by the operator during registration and the test connection phase.

The solution is compatible with PHP 8.1, supports adaptive design and the Composite framework, ensuring high performance and a modern user experience. Module components can be easily adapted to any website design without modifying the core. Extension points are provided for non-standard user mapping, handling duplicates, and storing additional data; implementation of such scenarios is performed separately based on specific requirements.

The module includes a user-friendly administrative interface for configuration, detailed logging for debugging, and support for both test and production environments.

The module automatically retrieves and stores user data upon login via ESIA (Gosuslugi). Responsibility for ensuring consent to process personal data rests with the information system owner. The solution is compatible with all versions of the 1C-Bitrix platform.

The module implements the client-side interaction with the Unified System of Identification and Authentication (ESIA) on websites managed by 1C-Bitrix. Upon clicking, the user is redirected to ESIA, completes authentication, and grants consent to view data. The system then returns the user to the website in an authenticated state.

Compliance of the information system with the requirements of the Ministry of Digital Development of Russia is ensured by a set of organizational and technical measures that go beyond the module's functionality. To launch ESIA authentication, in addition to installing the module, it is required to configure cryptographic tools and register the information system on the ESIA portal.

Technical features

Compatibility: the module is compatible with all versions of the 1C-Bitrix platform: Site Management.

The module implements the client-side interaction with the Unified Identity and Authentication System (ESIA) on websites running on 1C-Bitrix. Compliance of the information system with the requirements of the Ministry of Digital Development of Russia is ensured by a set of organizational and technical measures that go beyond the module's functionality.

Functional capabilities

User authorization

Full implementation of the OAuth 2.0 and OpenID Connect 1.0 protocols for interaction with ESIA.

User authentication via Gosuslugi accounts.

Automatic creation of a Bitrix user account upon the first login through ESIA.

Storage of the authorization token for subsequent requests to the ESIA API.

Verification of token validity, including monitoring for user revocation.

Retrieving user data

Depending on the organization type, the module can request and save the following data from ESIA to the site database:

Full name (FIO)

Date of birth

SNILS

INN

Contact details (email, phone)

Registered address

Passport

OMS policy

Important: The module operates exclusively with natural persons (individuals). Authorization of legal entities and officials is not supported in the current version.

The ESIA Authorization module enables site login via Gosuslugi. When deployed on the information system owner's server, the module collects, stores, and processes personal data. The information system owner is responsible for obtaining the subject's consent for data processing.

The module requires the 1C-Bitrix platform installed on Linux or Windows Server operating systems. Cryptopro CSP version 5.0 (CS3) is mandatory for operation. The PHP version must meet the requirements of the specific Bitrix version in use. A certificate for the enhanced qualified electronic signature (EQS) for the information system is required.

Configuration is managed through an intuitive administrative web interface. Available settings include the information system mnemonic, access scope, and the ability to switch between the ESIA test and production environments. All configuration data is stored in the standard Bitrix module settings repository.

Security is ensured by mandatory operation over the HTTPS protocol. All requests to ESIA are signed using a qualified electronic signature. The system validates the signature of ESIA responses, verifies the validity of access tokens, and maintains operation logs.

The module provides detailed logging of all authorization stages, including API requests to ESIA and cryptographic operation errors. These logs are used for debugging the integration. Support for various ESIA environments is included.

The authorization process begins when the user clicks the 'Login via Gosuslugi' button. The module generates and signs a request, then redirects the user to the ESIA portal. The user authenticates on the portal and grants consent for data retrieval and entry into the information system.

After successful authentication, the ESIA portal returns the user to the site and provides an authorization code. The module exchanges this code for a user authorization token via the ESIA API. Using the token, the system requests the permitted volume of user data.

Based on this data, the module creates a new user account or updates an existing one in the Bitrix database. Finally, the user gains access to the site.

The module supports operation in two environments: a test environment (esia-portal1.test.gosuslugi.ru) for development and debugging, and a production environment (esia.gosuslugi.ru) for industrial use. Switching between them is performed via the administrative interface.

The user interface allows customization of the ESIA login button. You can configure CSS styles and place the authorization button anywhere on the website.

Integration with business processes is implemented through Bitrix events, enabling additional actions to be performed after successful authorization and allowing processing of user data received from ESIA.

The module has the following limitations: it does not provide identification, authentication, or authorization of participants during interaction via SMEV, in accordance with ESIA recommendations. It operates exclusively with individuals; support for legal entities and officials is not available. The module does not manage the ESIA registration process, so users must have an active Gosuslugi account.

General iT can install and configure this module and check how it works on your website.