Business identities (add-ons)
Signicat offers the following add-on services for authenticating with business identities:
Choosing an add-on depends on your business requirements. The add-ons differ from each other in data source and how you can manage the business identities. Here is an overview to help you choose:
The following diagram shows the relation between a person and the different identities they may use for MitID Business, MitID Private for Business and MitID Private ("regular" MitID):
The identity types in MitID Business, MitID Private for Business and MitID Private
MitID Business (add-on)
MitID Business is an add-on to the regular MitID authentication where employees in companies can log in with an identity tied to their employer, e.g. to log into a bank to pay invoices on behalf of a company.
MitID Business uses the NemLog-In Identity Service as a data source and the identity is issued by your company's administrator. The administrator handles and configures the business identities in NemLog-In.
With the the MitID Business add-on, your company can issue a business identity as either a dedicated business user or a business user on top of the existing private identity.
If you need more general information about MitID Business, see the MitID Business website.
MitID Business flow
The flow goes as follows:
- Employee authenticates with either their private or dedicated business MitID credentials.
- If the authentication flow includes CPR matching, this will occur after authentication.
CPR matching
CPR matching will fail if dedicated business credentials were used in step 1, as dedicated business identities have no associated CPR number.
- The employee is presented with a selection screen, where they can choose which of their business identities they want to use.
MitID Business
To learn more about attributes, scopes and claims supported by each authentication protocol for MitID Business, visit the Attributes reference page.
Prefilling a CVR number
As a service provider, if you know in advance which company you want the user to represent, you can accomplish this by prefilling the CVR number of that company. Then Signicat verifies that the prefilled CVR number matches one of the companies that the user holds signatory rights in. The user is only allowed to represent that company during their login.
You can prefill the CVR number as follows (for OIDC): login_hint=organisation:{cvr}
MitID Private for Business (add-on)
The "MitID Private for Business" add-on (Privat til Erhverv) allows your users to log in with their private MitID user on behalf of the companies they hold signatory rights in as a management representative (ledelsesrepræsentant).
"Private for Business" uses Virk as a lookup source on your private identity.
First, the user is authenticated with MitID, which is used to validate their CPR number. Once the CPR number is validated, Signicat does a lookup towards the Danish Virk to check which companies and organisations the user has signatory rights in. The user is then presented with a view that lets them select which of these entities they wish to represent.
As a service provider, you can control certain aspects of the flow:
- If the user can represent the organisation alone or not. Default is that they can represent themselves.
- By prefilling a CVR number, the user is required to have signatory rights and is only permitted to log in or sign on behalf of that company (see Prefilling a CVR number).
In the example below, a user has authenticated with MitID and their CPR number has been validated. The user can choose to represent themselves (Helle Jensen) or one of the companies they have signature rights in, e.g. Jensen Services (CVR: 23456789).
Private for Business
If the user then selects to represent Jensen Services, organisation number, organisation name, audit source and audit timestamp are added to the response.
For more details about the additional business fields, see the Attributes reference page.
Prefilling a CVR number
As a service provider, if you know in advance which company you want the user to represent, you can accomplish this by prefilling the CVR number of that company. Then Signicat verifies that the prefilled CVR number matches one of the companies that the user holds signatory rights in. The user is only allowed to represent that company during their login.
You can prefill the CVR number as follows (for OIDC): login_hint=organisation:{cvr}