You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/auth-method-howto-oidc-nets-eid-broker.md
+88-30Lines changed: 88 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,44 +3,44 @@
3
3
FoxIDs can be connected to Nets eID Broker with OpenID Connect and thereby authenticating end users with MitID and other credentials supported by Nets eID Broker.
4
4
5
5
How to configure Nets eID Broker in
6
-
-[test environment](#configuring-nets-eid-broker-demotest-as-openid-provider-op) using Nets eID Broker demo
6
+
-[test environment](#configuring-nets-eid-broker-test-as-openid-provider-op) using Nets eID Broker test
7
7
-[production environment](#configuring-nets-eid-broker-as-openid-provider-op) using Nets eID Broker admin portal
8
8
9
-
> You can test the Nets eID Broker demo login with the [online web app sample](https://aspnetoidcsample.itfoxtec.com) ([sample docs](samples.md#aspnetcoreoidcauthcodealluppartiessample)) by clicking `Log in` and then `Nets eID Broker TEST`.
9
+
It is possible to [only request CPR number](#only-request-cpr-number-once) on the first login and not subsequently logins.
10
+
11
+
> You can test the Nets eID Broker test login with the [online web app sample](https://aspnetoidcsample.itfoxtec.com) ([sample docs](samples.md#aspnetcoreoidcauthcodealluppartiessample)) by clicking `Log in` and then `Nets eID Broker TEST`.
10
12
> Take a look at the Nets eID Broker sample configuration in FoxIDs Control: [https://control.foxids.com/test-corp](https://control.foxids.com/test-corp)
11
13
> Get read access with the user `[email protected]` and password `TestAccess!` then select the `Production` environment and the `Authentication` tab.
12
14
13
-
## Configuring Nets eID Broker demo/test as OpenID Provider (OP)
14
-
15
-
This guide describes how to connect a FoxIDs authentication method to Nets eID Broker demo in the test environment.
15
+
## Configuring Nets eID Broker test as OpenID Provider (OP)
16
16
17
-
Nets eID Broker has a [MitID demo](https://broker.signaturgruppen.dk/en/technical-documentation/open-oidc-clients) where all clients can connect without prior registration. All redirect URIs are accepted.
18
-
Her you can find all needed to register a client with Nets eID Broker.
17
+
This guide describes how to connect a FoxIDs authentication method to Nets eID Broker test in the test environment.
18
+
All redirect URIs are accepted and therefor all clients can connect without prior registration.
19
19
20
20
This connection use OpenID Connect Authorization Code flow with PKCE, which is the recommended OpenID Connect flow.
21
21
22
22
**Create an OpenID Connect authentication method in [FoxIDs Control Client](control.md#foxids-control-client)**
23
23
24
-
1. Add the name
25
-
2. Add the Nets eID Broker demo authority `https://pp.netseidbroker.dk/op` in the Authority field
26
-
3. In the scopes list add `mitid`(to support MitID) and optionally `nemid` (to support the old NemID)
27
-
4. Select show advanced
28
-
5. Optionally add an additionally parameter with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
29
-
6. Add the Nets eID Broker demo secret `rnlguc7CM/wmGSti4KCgCkWBQnfslYr0lMDZeIFsCJweROTROy2ajEigEaPQFl76Py6AVWnhYofl/0oiSAgdtg==` in the Client secret field
30
-
7. Add the Nets eID Broker demo client id `0a775a87-878c-4b83-abe3-ee29c720c3e7` in the Optional customer SP client ID field
31
-
8. Select to read claims from the UserInfo Endpoint instead of the access token or ID token
32
-
9. Click create
24
+
1. Add the **Name**
25
+
2. Add the Nets eID Broker test authority `https://pp.netseidbroker.dk/op` in the **Authority** field
26
+
3. In the **Scopes** list add `mitid` to use MitID and optionally the `ssn` scope to request the CPR number (consider [only request CPR number once](#only-request-cpr-number-once))
27
+
4. Select **Show advanced**
28
+
5. Optionally add an **Additionally parameter** with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
29
+
6. Add the Nets eID Broker test secret `rnlguc7CM/wmGSti4KCgCkWBQnfslYr0lMDZeIFsCJweROTROy2ajEigEaPQFl76Py6AVWnhYofl/0oiSAgdtg==` in the **Client secret** field
30
+
7. Add the Nets eID Broker test client id `0a775a87-878c-4b83-abe3-ee29c720c3e7` in the **Optional customer SP client ID** field
31
+
8. Select to **Read claims from the UserInfo Endpoint instead of the access token or ID token**
32
+
9. Click **Create**
33
33
34
34
That's it, you are done.
35
35
36
36
> The new authentication method can now be selected as an allowed authentication method in a application registration.
37
-
> The application registration can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or optionally define a [scope to issue claims](#scope-and-claims).
37
+
> The application can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or define a [scope to issue claims](#scope-and-claims).
38
38
39
39
## Configuring Nets eID Broker as OpenID Provider (OP)
40
40
41
41
This guide describes how to connect a FoxIDs authentication method to the Nets eID Broker in the production environment.
42
42
43
-
You are granted access to the [Nets eID Broker admin portal](https://netseidbroker.dk/admin) by Nets. The Nets eID Broker [documentation](https://broker.signaturgruppen.dk/en/technical-documentation).
43
+
You are granted access to the [Nets eID Broker admin portal](https://netseidbroker.dk/admin) by Nets. The Nets eID Broker [documentation](https://broker.signaturgruppen.dk/).
44
44
45
45
This connection use OpenID Connect Authorization Code flow with PKCE, which is the recommended OpenID Connect flow.
46
46
@@ -66,16 +66,16 @@ This connection use OpenID Connect Authorization Code flow with PKCE, which is t
66
66
67
67
**2 - Then create an OpenID Connect authentication method in [FoxIDs Control Client](control.md#foxids-control-client)**
68
68
69
-
1. Add the name
70
-
2. Add the Nets eID Broker demo authority `https://netseidbroker.dk/op` in the Authority field
69
+
1. Add the **Name**
70
+
2. Add the Nets eID Broker authority `https://netseidbroker.dk/op` in the **Authority** field
71
71
3. Copy the two URLs: `Redirect URL` and `Post logout redirect URL`
72
-
4. In the scopes list add `mitid`(to support MitID) and optionally other scopes like e.g, `nemid.pid`to request the NemID PID and/or `ssn` to request the CPR number
73
-
5. Select show advanced
74
-
6. Optionally add an additionally parameter with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
75
-
7. Add the Nets eID Broker secret in the Client secret field
76
-
8. Add the Nets eID Broker client id in the Optional customer SP client ID field
77
-
9. Select to read claims from the UserInfo Endpoint instead of the access token or ID token
78
-
10. Click create
72
+
4. In the **Scopes** list add `mitid` to use MitID and optionally the `ssn` scope to request the CPR number (consider [only request CPR number once](#only-request-cpr-number-once))
73
+
5. Select **Show advanced**
74
+
6. Optionally add an **Additionally parameter** with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
75
+
7. Add the Nets eID Broker secret in the **Client secret** field
76
+
8. Add the Nets eID Broker client id in the **Optional customer SP client ID** field
77
+
9. Select to **Read claims from the UserInfo Endpoint instead of the access token or ID token**
78
+
10. Click **Create**
79
79
80
80
**3 - Go back to [Nets eID Broker admin portal](https://netseidbroker.dk/admin)**
81
81
@@ -85,7 +85,67 @@ This connection use OpenID Connect Authorization Code flow with PKCE, which is t
85
85
That's it, you are done.
86
86
87
87
> The new authentication method can now be selected as an allowed authentication method in a application registration.
88
-
> The application registration can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or optionally define a [scope to issue claims](#scope-and-claims).
88
+
> The application can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or define a [scope to issue claims](#scope-and-claims).
89
+
90
+
## Only request CPR number once
91
+
It is possible to let FoxIDs save the uses CPR number in external users. Then the users are only requested for there CPR the first time they login.
92
+
93
+
To make this happen we will configure the Nets eID Broker authentication method to login without requesting a CPR number and create a profile which do request the CPR number.
94
+
On the first login FoxIDs subsequently initiate authentication with the profile to get the CPR number and save the users `sub` to CPR number relation in a claim on an external user.
95
+
96
+
In the Nets eID Broker authentication method.
97
+
98
+
*A) First create a profile*
99
+
100
+
101
+
1. Only include the `mitid` scope in the **Scopes** list
102
+
2. Select **Show advanced**
103
+
3. Select the **Profiles** tab
104
+
4. Click **Add Profile**
105
+
5. Add a **Name** e.g., `Request CPR`
106
+
6. Add `ssn` in the **Scopes** list
107
+
7. Click **Update** - *Imported before you continue!*
You can optionally create a scope on the application registration with the Nets eID Broker claims as `Voluntary claims`. The scope can then be used by a OpenID Connect client or another FoxIDs authentication method acting as a OpenID Connect client.
@@ -100,8 +160,6 @@ The most used Nets eID Broker claims:
0 commit comments