Skip to content

Commit b2cc58a

Browse files
authored
Merge pull request #1130 from ITfoxtec/test
Test
2 parents d3e7333 + 12c50b4 commit b2cc58a

19 files changed

+118
-45
lines changed

FoxIDs.sln

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,9 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{CB8812
230230
docs\images\howto-oidc-google-scopes.png = docs\images\howto-oidc-google-scopes.png
231231
docs\images\howto-oidc-google-usertype.png = docs\images\howto-oidc-google-usertype.png
232232
docs\images\howto-oidc-identityserver-readredirect.png = docs\images\howto-oidc-identityserver-readredirect.png
233+
docs\images\howto-oidc-nets-eid-broker-claim-transform.png = docs\images\howto-oidc-nets-eid-broker-claim-transform.png
234+
docs\images\howto-oidc-nets-eid-broker-external-user.png = docs\images\howto-oidc-nets-eid-broker-external-user.png
235+
docs\images\howto-oidc-nets-eid-broker-profile.png = docs\images\howto-oidc-nets-eid-broker-profile.png
233236
docs\images\howto-saml-claim-mappings.png = docs\images\howto-saml-claim-mappings.png
234237
docs\images\howto-saml-context-handler-app-base-config-reg.png = docs\images\howto-saml-context-handler-app-base-config-reg.png
235238
docs\images\howto-saml-context-handler-app-base-config.png = docs\images\howto-saml-context-handler-app-base-config.png
@@ -284,11 +287,13 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{CB8812
284287
docs\images\upload-risk-passwords-seed-client.png = docs\images\upload-risk-passwords-seed-client.png
285288
docs\images\user-create-new-account-config.png = docs\images\user-create-new-account-config.png
286289
docs\images\user-create-new-account.png = docs\images\user-create-new-account.png
290+
docs\images\user-email-phone-username-user-identifier.png = docs\images\user-email-phone-username-user-identifier.png
287291
docs\images\user-external-auth-method-redemption.png = docs\images\user-external-auth-method-redemption.png
288292
docs\images\user-external-create-new-account-config.png = docs\images\user-external-create-new-account-config.png
289293
docs\images\user-external-create-new-account.png = docs\images\user-external-create-new-account.png
290294
docs\images\user-external-redemption.png = docs\images\user-external-redemption.png
291295
docs\images\user-login.png = docs\images\user-login.png
296+
docs\images\user-phone-user-identifier.png = docs\images\user-phone-user-identifier.png
292297
EndProjectSection
293298
EndProject
294299
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "FoxIDs.ConvertCertificateTool", "tools\FoxIDs.ConvertCertificateTool\FoxIDs.ConvertCertificateTool.csproj", "{AF16CC91-2EEA-4790-8672-9ACCA430991D}"

docs/auth-method-howto-oidc-nets-eid-broker.md

Lines changed: 88 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3,44 +3,44 @@
33
FoxIDs can be connected to Nets eID Broker with OpenID Connect and thereby authenticating end users with MitID and other credentials supported by Nets eID Broker.
44

55
How to configure Nets eID Broker in
6-
- [test environment](#configuring-nets-eid-broker-demotest-as-openid-provider-op) using Nets eID Broker demo
6+
- [test environment](#configuring-nets-eid-broker-test-as-openid-provider-op) using Nets eID Broker test
77
- [production environment](#configuring-nets-eid-broker-as-openid-provider-op) using Nets eID Broker admin portal
88

9-
> You can test the Nets eID Broker demo login with the [online web app sample](https://aspnetoidcsample.itfoxtec.com) ([sample docs](samples.md#aspnetcoreoidcauthcodealluppartiessample)) by clicking `Log in` and then `Nets eID Broker TEST`.
9+
It is possible to [only request CPR number](#only-request-cpr-number-once) on the first login and not subsequently logins.
10+
11+
> You can test the Nets eID Broker test login with the [online web app sample](https://aspnetoidcsample.itfoxtec.com) ([sample docs](samples.md#aspnetcoreoidcauthcodealluppartiessample)) by clicking `Log in` and then `Nets eID Broker TEST`.
1012
> Take a look at the Nets eID Broker sample configuration in FoxIDs Control: [https://control.foxids.com/test-corp](https://control.foxids.com/test-corp)
1113
> Get read access with the user `[email protected]` and password `TestAccess!` then select the `Production` environment and the `Authentication` tab.
1214
13-
## Configuring Nets eID Broker demo/test as OpenID Provider (OP)
14-
15-
This guide describes how to connect a FoxIDs authentication method to Nets eID Broker demo in the test environment.
15+
## Configuring Nets eID Broker test as OpenID Provider (OP)
1616

17-
Nets eID Broker has a [MitID demo](https://broker.signaturgruppen.dk/en/technical-documentation/open-oidc-clients) where all clients can connect without prior registration. All redirect URIs are accepted.
18-
Her you can find all needed to register a client with Nets eID Broker.
17+
This guide describes how to connect a FoxIDs authentication method to Nets eID Broker test in the test environment.
18+
All redirect URIs are accepted and therefor all clients can connect without prior registration.
1919

2020
This connection use OpenID Connect Authorization Code flow with PKCE, which is the recommended OpenID Connect flow.
2121

2222
**Create an OpenID Connect authentication method in [FoxIDs Control Client](control.md#foxids-control-client)**
2323

24-
1. Add the name
25-
2. Add the Nets eID Broker demo authority `https://pp.netseidbroker.dk/op` in the Authority field
26-
3. In the scopes list add `mitid` (to support MitID) and optionally `nemid` (to support the old NemID)
27-
4. Select show advanced
28-
5. Optionally add an additionally parameter with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
29-
6. Add the Nets eID Broker demo secret `rnlguc7CM/wmGSti4KCgCkWBQnfslYr0lMDZeIFsCJweROTROy2ajEigEaPQFl76Py6AVWnhYofl/0oiSAgdtg==` in the Client secret field
30-
7. Add the Nets eID Broker demo client id `0a775a87-878c-4b83-abe3-ee29c720c3e7` in the Optional customer SP client ID field
31-
8. Select to read claims from the UserInfo Endpoint instead of the access token or ID token
32-
9. Click create
24+
1. Add the **Name**
25+
2. Add the Nets eID Broker test authority `https://pp.netseidbroker.dk/op` in the **Authority** field
26+
3. In the **Scopes** list add `mitid` to use MitID and optionally the `ssn` scope to request the CPR number (consider [only request CPR number once](#only-request-cpr-number-once))
27+
4. Select **Show advanced**
28+
5. Optionally add an **Additionally parameter** with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
29+
6. Add the Nets eID Broker test secret `rnlguc7CM/wmGSti4KCgCkWBQnfslYr0lMDZeIFsCJweROTROy2ajEigEaPQFl76Py6AVWnhYofl/0oiSAgdtg==` in the **Client secret** field
30+
7. Add the Nets eID Broker test client id `0a775a87-878c-4b83-abe3-ee29c720c3e7` in the **Optional customer SP client ID** field
31+
8. Select to **Read claims from the UserInfo Endpoint instead of the access token or ID token**
32+
9. Click **Create**
3333

3434
That's it, you are done.
3535

3636
> The new authentication method can now be selected as an allowed authentication method in a application registration.
37-
> The application registration can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or optionally define a [scope to issue claims](#scope-and-claims).
37+
> The application can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or define a [scope to issue claims](#scope-and-claims).
3838
3939
## Configuring Nets eID Broker as OpenID Provider (OP)
4040

4141
This guide describes how to connect a FoxIDs authentication method to the Nets eID Broker in the production environment.
4242

43-
You are granted access to the [Nets eID Broker admin portal](https://netseidbroker.dk/admin) by Nets. The Nets eID Broker [documentation](https://broker.signaturgruppen.dk/en/technical-documentation).
43+
You are granted access to the [Nets eID Broker admin portal](https://netseidbroker.dk/admin) by Nets. The Nets eID Broker [documentation](https://broker.signaturgruppen.dk/).
4444

4545
This connection use OpenID Connect Authorization Code flow with PKCE, which is the recommended OpenID Connect flow.
4646

@@ -66,16 +66,16 @@ This connection use OpenID Connect Authorization Code flow with PKCE, which is t
6666

6767
**2 - Then create an OpenID Connect authentication method in [FoxIDs Control Client](control.md#foxids-control-client)**
6868

69-
1. Add the name
70-
2. Add the Nets eID Broker demo authority `https://netseidbroker.dk/op` in the Authority field
69+
1. Add the **Name**
70+
2. Add the Nets eID Broker authority `https://netseidbroker.dk/op` in the **Authority** field
7171
3. Copy the two URLs: `Redirect URL` and `Post logout redirect URL`
72-
4. In the scopes list add `mitid` (to support MitID) and optionally other scopes like e.g, `nemid.pid` to request the NemID PID and/or `ssn` to request the CPR number
73-
5. Select show advanced
74-
6. Optionally add an additionally parameter with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
75-
7. Add the Nets eID Broker secret in the Client secret field
76-
8. Add the Nets eID Broker client id in the Optional customer SP client ID field
77-
9. Select to read claims from the UserInfo Endpoint instead of the access token or ID token
78-
10. Click create
72+
4. In the **Scopes** list add `mitid` to use MitID and optionally the `ssn` scope to request the CPR number (consider [only request CPR number once](#only-request-cpr-number-once))
73+
5. Select **Show advanced**
74+
6. Optionally add an **Additionally parameter** with the name `idp_values` and e.g. the value `mitid` to show the MitID IdP or e.g. the value `mitid_erhverv` to show the MitID Erhverv IdP.
75+
7. Add the Nets eID Broker secret in the **Client secret** field
76+
8. Add the Nets eID Broker client id in the **Optional customer SP client ID** field
77+
9. Select to **Read claims from the UserInfo Endpoint instead of the access token or ID token**
78+
10. Click **Create**
7979

8080
**3 - Go back to [Nets eID Broker admin portal](https://netseidbroker.dk/admin)**
8181

@@ -85,7 +85,67 @@ This connection use OpenID Connect Authorization Code flow with PKCE, which is t
8585
That's it, you are done.
8686

8787
> The new authentication method can now be selected as an allowed authentication method in a application registration.
88-
> The application registration can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or optionally define a [scope to issue claims](#scope-and-claims).
88+
> The application can read the claims from the authentication method. You can optionally add a `*` in the application registration Issue claims list to issue all the claims to your application. Or define a [scope to issue claims](#scope-and-claims).
89+
90+
## Only request CPR number once
91+
It is possible to let FoxIDs save the uses CPR number in external users. Then the users are only requested for there CPR the first time they login.
92+
93+
To make this happen we will configure the Nets eID Broker authentication method to login without requesting a CPR number and create a profile which do request the CPR number.
94+
On the first login FoxIDs subsequently initiate authentication with the profile to get the CPR number and save the users `sub` to CPR number relation in a claim on an external user.
95+
96+
In the Nets eID Broker authentication method.
97+
98+
*A) First create a profile*
99+
100+
101+
1. Only include the `mitid` scope in the **Scopes** list
102+
2. Select **Show advanced**
103+
3. Select the **Profiles** tab
104+
4. Click **Add Profile**
105+
5. Add a **Name** e.g., `Request CPR`
106+
6. Add `ssn` in the **Scopes** list
107+
7. Click **Update** - *Imported before you continue!*
108+
109+
![Authentication method profile](images/howto-oidc-nets-eid-broker-profile.png)
110+
111+
*b) Then start to create external users*
112+
113+
1. Select the **Create External Users** tab
114+
2. Add `sub` in the **Link claim type** field
115+
3. Select **Yes** in **Optional create/provision external users automatically**
116+
4. Select **Yes** in **Overwrite received claims**
117+
118+
![Authentication method external user](images/howto-oidc-nets-eid-broker-external-user.png)
119+
120+
*c) Setup claim transforms*
121+
122+
1. In the **Create user claim transforms** section in the **Create External Users** tab
123+
2. Add the claims `mitid.has_cpr` and `dk.cpr` in **Include claims from authentication method**
124+
3. Click **Add claim transform** and click **Match claim**
125+
1. In the claim transformation
126+
2. Add `_local:cpr_exist` in the **New claim** field
127+
3. Select **Add claim, if not match** in **Action**
128+
4. Add `dk.cpr` in the **Select claim** field
129+
5. Add `false` in the **New value** field
130+
4. Click **Add claim transform** and click **Concatenate**
131+
1. In the claim transformation
132+
2. Add `_local:request_cpr` in the **New claim** field
133+
3. Select **Add claim** in **Action**
134+
4. Add `mitid.has_cpr` and `_local:cpr_exist` in the **Concatenate claims** list
135+
5. Add `[{0},{1}]` in the **Concatenate format string** field
136+
5. Click **Add claim task** and click **Match claim and value and start authentication**
137+
1. In the claim transformation
138+
2. Select **If match** in **Action**
139+
3. Add `_local:request_cpr` in the **Select claim** field
140+
4. Add `[true,false]` in the **Match value** field
141+
6. Select this authentication methods `Request CPR` profile in the **Authentication method**
142+
6. Click **Add claim transform** and click **Match claim**
143+
1. In the claim transformation
144+
2. Select **Remove claim** in **Action**
145+
3. Add `mitid.has_cpr` in the **Remove claim** field
146+
7. Click **Update**
147+
148+
![Authentication method claim transform](images/howto-oidc-nets-eid-broker-claim-transform.png)
89149

90150
## Scope and claims
91151
You can optionally create a scope on the application registration with the Nets eID Broker claims as `Voluntary claims`. The scope can then be used by a OpenID Connect client or another FoxIDs authentication method acting as a OpenID Connect client.
@@ -100,8 +160,6 @@ The most used Nets eID Broker claims:
100160
- `mitid.uuid`
101161
- `mitid.has_cpr`
102162
- `dk.cpr`
103-
- `nemid.pid`
104-
- `nemid.pid_status`
105163
- `mitid.age`
106164
- `mitid.date_of_birth`
107165
- `mitid.identity_name`
96.2 KB
Loading
108 KB
Loading
43.5 KB
Loading

src/FoxIDs.Control/FoxIDs.Control.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<PropertyGroup>
44
<TargetFramework>net9.0</TargetFramework>
5-
<Version>1.15.10</Version>
5+
<Version>1.15.11</Version>
66
<RootNamespace>FoxIDs</RootNamespace>
77
<Authors>Anders Revsgaard</Authors>
88
<Company>ITfoxtec</Company>

src/FoxIDs.ControlClient/FoxIDs.ControlClient.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<PropertyGroup>
44
<TargetFramework>net9.0</TargetFramework>
5-
<Version>1.15.10</Version>
5+
<Version>1.15.11</Version>
66
<RootNamespace>FoxIDs.Client</RootNamespace>
77
<Authors>Anders Revsgaard</Authors>
88
<Company>ITfoxtec</Company>

src/FoxIDs.ControlClient/Models/ViewModels/Parties/UpPartyProfileViewModel.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,13 @@ public abstract class UpPartyProfileViewModel
99
[Required]
1010
[MaxLength(Constants.Models.Party.ProfileNameLength)]
1111
[RegularExpression(Constants.Models.Party.NameRegExPattern)]
12+
[Display(Name = "Technical name")]
1213
public string Name { get; set; }
1314

1415
[Required]
1516
[MaxLength(Constants.Models.Party.DisplayNameLength)]
1617
[RegularExpression(Constants.Models.Party.DisplayNameRegExPattern)]
18+
[Display(Name = "Name")]
1719
public string DisplayName { get; set; }
1820
}
1921
}

src/FoxIDs.ControlClient/Models/ViewModels/Tracks/TrackSettingsViewModel.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ public TrackSettingsViewModel()
8383
public bool? CheckPasswordComplexity { get; set; }
8484

8585
[Required]
86-
[Display(Name = "Check password risk")]
86+
[Display(Name = "Check password risk based on global password breaches")]
8787
public bool? CheckPasswordRisk { get; set; }
8888

8989
[ValidateComplexType]

src/FoxIDs.ControlClient/Pages/Usage/Usage.razor

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@
255255
}
256256
else
257257
{
258-
<button type="button" class="btn btn-link mr-auto" @onclick="@(async () => await ShowUpdateUsageAsync(used))">
258+
<button type="button" class="btn btn-link mr-auto btn-wrap" @onclick="@(async () => await ShowUpdateUsageAsync(used))">
259259
Tenant: @used.TenantName@UsageInfoAndPriceText(used)
260260
<br />
261261
@{

0 commit comments

Comments
 (0)