MitID (DK)

• Enable MitID in your services
• Information about the end user​
• User experience
  
• MitID Erhverv ​
  

Enable ​MitID in your services

General information about MitID:

• https://digst.dk/it-loesninger/mitid/

Timeline

MitID was made available through the E-Ident service in October 2021. The E-Ident service are using the broker delivered by Signaturgruppen. From the beginning of October 2021, all users started to receive their MitID identity.​

​Information about the end user

The information returned about the end user is listed in the table below. The content may change as the MitID development proceeds.

Retrieve SSN (CPR)

The CPR number (Danish social security number)​ can be retrieved in this way:

• OIDC: Set the scope parameter to ssn
• SAML: Append the returnssn=true parameter to the identification request.

When this is set, the user will be prompted for their CPR number and this will be returned in the ID Token (OIDC) and Assertion (SAML). The CPR number will be returned in the dk_ssn and ssn claim in the ID Token and as the DK_SSN attribute in the SAML assertion. ​

CPR step-up flow

The CPR step-up flow can be used to request the CPR number for already authenticated users. If the CPR number is not already known when the user has authenticated, you can start CPR step-up using the current authentication transaction. The user is then prompted to enter CPR but does not have to re-authenticate. This does not add any additional cost to the transaction.

For OpenID Connect, start CPR step-up by starting an authentication with the parameters transaction_id and scope=ssn. For SAML, set returnssn=true and transaction_id. This will reuse the previous transaction for the step-up flow.

• For OIDC protocol, the transaction_id parameter value would be jti claim from ID token.
• For SAML protocol, the value for transaction_id could be found at '/Response/Assertion/@AssertionID' from assertion response. For eg. value of attribute AssertionID=TI2-617b5cdc6fb84f16a6022e328d970bb7 then transaction_id value would be 617b5cdc6fb84f16a6022e328d970bb7.

It leads to an error response if the CPR step-up flow is requested after the validity of the ID token or SAML assertion. The validity of an ID token and a SAML assertion is 15 minutes.

After the user has inserted the CPR number, you need to request a new ID token or SAML assertion.

Level of assurance and authenticator assurance level

The level of assurance for a specific identification may be set using the loa_value parameter and the authenticator assurance level may be set using the aal_value parameter. Both parameters accept these values:

• low
• substantial (default if not set)
• high 

If the loa_value is set, the aal_value will be ignored. If both the loa_value and the aal_value parameter is undefined in the request, the loa_value parameter will as default be set to substantial.  

The actual used values will be returned as loa and aal claims/attributes in the ID Token/SAML assertion. In addition, ial and mitid_amr claims are returned. See the table above for the possible values.

Note: The customer must validate that the returned values are as expected.

Return the user's NemID PID value

During the migration phase, it may be useful to know the MitID user's NemID PID value if the user has previously had a NemID. It is possible to request that during a MitID identification. To get the user's NemID PID value in return you need to: 

• For OIDC, add the scope nemid.pid to the identification request. The PID value will be returned in the nemid.pid claim.
  
• For SAML, add the request parameter return_nemid_pid=true to the identification request. The PID value will be returned in the NEMID_PID attribute. 
  

If the nemid.pid scope or return_nemid_pid parameter is set, the user will be requested to enter his/her CPR number and the ID Token/SAML assertion will include the user's NemID PID value. 

User experience

The user may be presented with a choice to log in using MitID as in the first picture below. When the user selects MitID he/she will be redirected to the Nets broker for MitID. For E-Ident customers using the Embedded UI option, the service will break out of iframe when the user is directed to MitID. 

Note: The E-Ident service was recently updated with a third UI option - pop-up UI. As the user is redirected to the Nets broker for MitID during the identification, pop-up UI may be an option to consider when adding MitID as an identification method. Read more about the pop-up UI.

EID selection page (optional)

The below page is optional. Users may be sent directly to MitID by using the amr_values/forcepkivendor parameter on the identification request. The parameter value must be set to mitid and/or mitid:mitid_erhverv. Read more about the parameters for OIDC and SAML. ​The picture below is an illustration of the page for pop-up and standalone UI modes. ​

MitID client pages

Step 1 - enter user ID. This page may be skipped using the presetid/login_hint parameter: 

Next steps - this may vary dependent on the level of assurance and user preferences. It may be password, OTP, MitID app actions etc. Here illustrated with entering password:

Enter CPR page​​

The CPR-page is shown when:

• OIDC: Scope parameter contains SSN and appended to the identification request.
• SAML: returnssn parameter is set to true and appended to the identification request
  

​

Customized UI options

The MitID client UI may be customized by using one of four UI templates. The MitID client is in the square while the customer's logo is in the dotted square. Templates and customization:

• ​​Basic: Customers may set the background colour.​
  
• Split, Fluid Split and Topbar: Customers may set two different background colours, text color and supply a welcome text and an optionally CPR page text.
• In all templates, the customer logo may be added. The logo file should be 150 x 37 pixels.

Background colours must be given as hex format (example: #ffffff).

Here is an example of a customized page based on the "Split" template:

Preset ID and Login hint

Reference text

The user may be shown a reference text throughout the identification. To add a reference text, append the reference_text parameter to the identification request. The reference text will be displayed to user in either the MitID app or, in case MitID app is not used, in the MitID client.

The reference text may be up to 130 characters. A short description of the parameter can be found here:

• reference_text in OIDC
• reference_text in SAML

Transaction text signing

The transaction text signing feature from the Nets eID broker is offered during a MitID identification. During the identification, the user will be presented with the signing text. The text can either be in HTML or text format. 

Prerequisite for using the feature: 

• Only available using the OIDC protocol towards E-Ident
  
• The identification request must be signed. Read for more information about signed requests. 

To use the functionality, two parameters must be appended to the identification request: 

• transactiontext - max length 600 char
  
• transactiontext_type - html or text

Allowed HTML tags:

• html, body, head, style, title, div, p, ul, li, h1, h2, h3, h4, h5, h6, table, font, tr, th, td, i, u, b, center, a, q, small

Disallowed:

• CSS expressions and embedded script links for style tag.
• CSS expression attributes. 
• Any on- attributes, such as onload, onclick etc. 
• Script link attributes, such as src, dynsrc, lowsrc, javascript: etc.​

The ID token will include these new claims:

• transaction_text
• transaction_text_sha256​
  
• transaction_text_type

The ID token information is also available at the discovery endpoint. 

HTML signing

Note: The transaction text signing is not the same as the reference text functionality described above or the MitID signing functions through E-Signing.

MitID logo and design

MitID design requirements and logos can be downloaded from the Nets eID broker here. ​

MitID Erhverv for companies

MitID Erhverv makes it easier for companies to administer user rights, and it is more flexible when business and associations log in to digital self-service solutions, for instance to check their Digital Post, report VAT, etc. ​

To enable MitID Erhverv you need to explicitly set the amr_values/forcepkivendor parameter in the identification request. The parameter value must be set to mitid:mitid_erhverv ​and may be combined with other IDP selection values. Read more about the parameters for OIDC and ​ SAML.

M​​itID Erhverv flow

Both ID types, Private ID (MitID) and Business ID (Erhverv), can be supported in one single authentication request. After successful authentication, the user can select the applicable ID type.

Note: Business ID also includes identities of type “Private MitID on behalf of companies".

​The request parameter "amr_values" will control the selectable ID types.

• Setting amr_values=mitid:mitid_erhverv: Business ID
• Setting amr_values=mitid,mitid:mitid_erhverv: Private ID and Business ID​​
  
  

​MitID Erhverv client pages

​Step 1 – enter user ID.​​

Step 2: Next steps may vary dependent on the level of assurance and user preferences. It may be password, OTP, MitID app actions etc. Here illustrated with scanning QR code:

Enter CPR page:

​The CPR-page is shown when:

• ​OIDC: identification request scope parameter contains SSN.
• SAML: identification request returnssn parameter is set to true.

ID Type selection page:

Option 2: Implement MitID CPR step-up to ensure users only must input CPR when this information is required. See documentation here: https://www.nets.eu/developer/e-ident/eids/Pages/mitid.aspx#mitidcprstepup