For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Changes for Norwegian BankID

This page describes the changes specific to Norwegian BankID that are required when migrating an existing OIDC integration from Signicat Enterprise to the new Signicat Digital Trust Platform (DTP).

Overview​

  • Norwegian BankID authentication works the same after migration.
  • Your end-users will experience the exact same authentication flow as before.
  • The end-user flow does not require any changes specific to Norwegian BankID.
  • The main migration changes affect:
    • OIDC configuration, including your endpoints and client credentials.
    • Returned OIDC claims, including the Norwegian national identity number.

Claims​

For an overview of the key claim changes, see the table below:

Note

The standard claims name, given_name, family_name, birthdate and gender remain unchanged.

For a complete list of Norwegian BankID claims, see the Attributes reference page.

Scopes​

When migrating Norwegian BankID, we recommend using the same set of scopes as in your current integration, while applying the mapping of the scope codes. For example, if you currently use openid, profile and signicat.national_id, we recommend that you replace signicat.national_id with nin thus resulting in openid, profile and nin. This ensures that you receive the equivalent user information.

Example: Scopes
openid profile nin
Our recommendation

We recommend that you only use additional Norwegian BankID scopes if your application already depends on them.

The exact claims returned depend on the requested scopes and your OIDC client configuration.

You can find an example of how an OIDC authentication response and the scopes used differ between Enterprise and our new platform below:

Example: Enterprise OIDC scopes
openid+profile+signicat.national_id
Example: Enterprise response
{
  "sub": "<enterprise_subject_id>",
  "birthdate": "2002-12-18",
  "name": "Petter Jensen Emdal",
  "signicat.national_id": "<national_identity_number>",
  "given_name": "Petter Jensen",
  "locale": "NO",
  "family_name": "Emdal"
}

Required application changes​

Update your application to read the Norwegian national identity number from the new platform claim nin, instead of the Enterprise signicat.national_id claim:

Enterprise claim
signicat.national_id

If your application uses the OIDC sub claim as an internal user identifier, then you must verify your identifier mapping before migration.

Note

The sub claim is still returned by our new platform, but the value may differ from the Enterprise value.

If you need to retrieve the identical subID value, then you can follow the Migrating from Enterprise documentation.

ACR Values​

The way in which you define the different flows of Norwegian BankID has also changed with this migration.

  • Previously, you defined the flow using separate method names for level of assurance (LoA) high or substantial transactions.
  • Now, you define the flow using ACR values.
Note

The default Norwegian BankID product uses a LoA high as its flow.

If you have not specifically purchased substantial as an option, then you may not be able to access the substantial flow.

NameValueDescription
nbid_idpBID or BISSpecifies the required Norwegian BankID type, where BID is BankID High with high LoA, and BIS is BankID Biometric with substantial LoA.

Note: If no value is provided, the end-user can select BID by default.

This parameter works with login_hint.
Setting Norwegian BankID flow in ACR values
acr_values=idp:nbid nbid_idp:BIS

Test before cutover​

Migrating Norwegian BankID authentication to our new platform has a low overall impact. End-users authenticate in the same way, and the returned OIDC response is largely unchanged.

Before production cutover, verify that your application can:

  • Complete a Norwegian BankID OIDC authentication flow in our new platform.
  • Read the national identity number from nin instead of signicat.national_id.
  • Read name, given_name, family_name, and birthdate.
  • Handle any changes to the sub value if it is used as an internal identifier.
  • Start the required Norwegian BankID flow using the appropriate acr_values (for example, acr_values=idp:nbid nbid_idp:BIS), if your application specifies a particular BankID type.
On this page