Skip to main content

Quick start guide

Learn how to identify your end-users in a few steps.

This quick start guide shows you how to:

  1. Activate an eID in the Signicat Dashboard.
  2. Test an authentication flow.
  3. Configure an authentication protocol.
  4. Initiate an authentication flow with a protocol.
Note

For illustration purposes, we use Norwegian BankID as an example eID. The same steps apply to the other eIDs supported by Signicat.

Prerequisites​

If you do not have an account already, then you need to sign up to the Signicat Dashboard for free and complete the initial preparations. To do this:

  1. Sign up to the Signicat Dashboard and register your profile.
  2. Ensure that you have created an organisation.
  3. Create an account. To do this:
    1. Go to Signicat Dashboard > Organisation, then select + Add account.
    2. Enter an account name, choose the type of account that you want to create, then select Create.
  4. Create a domain. To do this:
    1. Go to Signicat Dashboard > Settings > Domains, then select + Add domain.
    2. To create a standard domain, enter a domain name. Then, select Add domain.
    3. To create a custom domain, follow the instructions in the Custom domains documentation.
Account types

We recommend that you create a sandbox account to test our services before going live. Sandbox and production accounts must be set up separately.

Domains and eIDs

For this guide you can use a standard Signicat domain.

It is important to note that certain eIDs may require you to add digital SSL certificates and custom domains for security purposes. You can learn more in the eID-specific documentation.

Add an eID in the Dashboard​

First, you need to add and activate the eID in your Signicat account. To do this:

  1. In the Signicat Dashboard, go to Products > eID and Wallet Hub > eIDs.
  2. To add a new eID, select Add new in the top right.
  3. Choose Norwegian BankID from the list. To activate it, click Add.

Now, you can view Norwegian BankID set as "Active" in the list of eIDs.

Production account

To activate an eID in a production account, you may need to first complete additional procedures. Learn more about these requirements in the eID-specific documentation.

Test the eID​

Once you have activated an eID, you can already run a test authentication flow, directly from the Signicat Dashboard. Testing helps you to better understand the user experience with an eID.

To test an authentication flow in the Signicat Dashboard, do the following:

  1. Go to Products > eID and Wallet Hub > eIDs.
  2. Select Test eIDs at the top right.
  3. Optional: When more than one eID is active in your account, a list with all your eIDs is displayed by default. Choose Norwegian BankID.
  4. Follow the steps on the Norwegian BankID site to authenticate with the following test credentials:
    • National ID number: 01100844350 or 10103933108
    • One Time Code: otp
    • BankID password: qwer1234
    Test users for Norwegian BankID

    Pre-generated test users for Norwegian BankID may become unavailable after a series of failed attempts. If this happens, you can generate more test users.

  5. Review the user data attributes returned by BankID.

Once you have completed a test authentication, we display the user attributes of your test user.

Connect with an authentication protocol​

The Signicat eID and Wallet Hub provides authentication as a service, thus acting as the single point of integration between your application and a selection of eIDs. To authenticate your end-users, you connect your application to the eID and Wallet Hub using an authentication protocol.

The role of Signicat

Note that you only need to connect to the eID and Wallet Hub servers. In the background, Signicat handles the connection to the eIDs separately, therefore acting as a message broker between your application and the eIDs.

Choose a protocol​

The eID and Wallet Hub supports the following authentication protocols:

When you build your integration, you need to implement your connection with one of these protocols.

Choosing a protocol

You should choose a protocol based on what you prefer, what your application supports and what you want to achieve.

OIDC and SAML are official identity standards, while the Authentication REST API is a solution developed and maintained by Signicat.

The Signicat Authentication REST API offers a lot of flexibility and supports headless and redirect integration flow(s) (grant type).

If you want to use an official identity protocol, we recommend using OIDC. When choosing, consider the following:

  • SAML 2.0 is much more complex to implement on your side since it relies on XML schemas to transmit user information and usually requires a federation agent already in place.
  • OIDC is an industry standard that only focuses on authentication and based on the OAuth 2.0 standard. You send direct calls between services using REST and JSON, accessible through APIs. With OIDC you do not need to manage user sessions on your own (like with the Authentication REST API).

Build a connection​

To understand how to connect with an authentication protocol, select the corresponding tab below.

OpenID Connect (OIDC)

The following sections describe how to set up authentication with OIDC. Instructions are generic and agnostic of any programming language. For a more detailed guide with language-specific examples, see the Code examples for OIDC.

To get started with OIDC, follow these steps:

  1. Register an OIDC client in the Signicat Dashboard
  2. Find your Discovery and issuer URL
  3. Build an authentication request

You can find more details about each step below.

1. Register an OIDC client

Before you can start authenticating users, you must register an OIDC client application in the Signicat Dashboard. An OIDC client comes with a Client ID. Depending on the authentication grant type (flow) you want to implement, you may associate a secret to the client.

To register your OIDC client application in the Signicat Dashboard, do the following:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > OIDC clients.
  2. Select Add client.
  3. Configure your OIDC client with these settings:
    • Primary grant type: Choose the grant type you want to implement. We strongly recommend AuthorizationCode (Authorization Code flow). Learn more about OIDC grant types in the to the OIDC specification and the OAuth 2.0 specification.
    • Create client from template: Optional. Allows you to use a template to prefill your client configuration. Skip this if you want to customise your configuration.
    • Client name: Enter a name for the client.
    • Redirect URI: Enter the URL where you want to redirect your end-user after they authenticate with an eID. Note that you can add several redirect URIs after you create the client.
    • Scope: Select the scopes for the type of data you want to retrieve with this client. openid is mandatory. profile and nin are necessary in most cases. You can see the definition of profile and other predefined scopes in the OIDC specification. You find scope definitions in the specific eIDs documentation.
  4. Select Create to create the new client.

Congratulations, you have created an OIDC client!

2. Find your Discovery and issuer URL

Depending on how you want to implement your app, you can find:

  • The discovery URL: https://<YOUR_SIGNICAT_DOMAIN>/auth/open/.well-known/openid-configuration. For example, if your domain is https://verybigcorp.signicat.com, your discovery URL is https://verybigcorp.signicat.com/auth/open/.well-known/openid-configuration.
  • The issuer URL: <YOUR_SIGNICAT_DOMAIN>/auth/open/. For example, your issuer URL would be https://verybigcorp.signicat.com/auth/open/.

3. Build an authentication request

To start an end-user authentication, your app must direct the end-user to the authorisation endpoint (https://<YOUR_SIGNICAT_DOMAIN>/auth/open/connect/authorize) with the appropriate set of parameters.

At minimum, an OIDC authorisation request includes:

  • client_id: The OIDC client ID of your OIDC client application registered in the Signicat Dashboard
  • response_type: The grant type code
  • redirect_uri: The URL where to redirect end-users after authentication
  • scope: Must include openid and any additional scopes for attributes supported by an eID
  • state: A random value to protect against CSRF
  • nonce: A random value to protect ID token integrity

Example authentication request (line breaks included for readability):

https://<YOUR_SIGNICAT_DOMAIN>/auth/open/connect/authorize?
    &client_id=sandbox-example-client-123
    &response_type=code
    &redirect_uri=https://myservice.example/redirect
    &scope=openid
    &acr_values=<ACR_VALUES>
    &state=af93kslz
    &nonce=bn28sjdp

Your next steps depend on the OIDC flow type you want to implement. After the end-user authenticates you can retrieve the results in the ID token and UserInfo endpoints.

Next steps

This guide introduced how the eID and Wallet Hub works in a nutshell. Next, we recommend learning more about OIDC and exploring the eIDs documentation.

OIDC
Find out more about OIDC, the authentication protocol based on the OAuth 2.0 protocol
Supported eIDs
View and learn how to integrate with the eIDs
On this page