Page Comparison

...

...

...

The OIDC Provider from BankID supports signing of the following data elementsSigned JWTs (JWS) are crucial to the OpenID Connect specification in order to ensure the authenticity and integrity of data exchanged between parties.

Encrypted JWTs (JWE) are also used to encrypt sensitive data when applicable. Cryptographic keys used for this purpose are published in the JWKs endpoint as JWKs. Note that these keys may change over time.

When integrating BankID over OpenID Connect you must always validate Tokens that are issued. You should also strongly consider encrypting sensitive data using encrypted request objects.

Validation of Signed Tokens

Following well established OpenID Connect standards, BankID will sign all Tokens issued:

• ID Tokens
• Default Access Tokens
• Default Refresh Tokens
• Responses from the TINFO service

...

• Userinfo response Token

You must validate JWT signatures and ensure that the signing key certificate was issued by the officially published root certificate.

...

Keys used for signing are all marked with 

...

with "use": "sig"

...

Verification

The OIDC provider from BankID verifies the following data elements.

Steps to validate a signed JWT Token

The steps required to securely validate a JWS Token (like ID Token):

1. Extract the key information from the JWS Token header: kid, alg 
2. Retrieve all JWK entries that BankID exposes from the JWKs endpoint.
3. Keys used for signing can be filtered by the use attribute on each JWK. This value should be sig.
4. Find the key used to sign the JWS Token by matching the kid, alg from (1) with the JWK entries.
5. Extract the public key and certificate chain (x5c) from the JWK entry.
6. Validate the origin of the key by verifying it's complete certificate chain (x5c) with our published root certificate.
7. Validate the JWS token using the key.

Note: Using a secure and community provided library to validate JWS tokens is highly recommended.

Signed Authorization Requests

BankID OIDC can support signing incoming Authorization Requests:

• request authorize parameter
• private_key_jwt client_assertion object

To support this validation, a jwks_uri must be registered for the given oidc client, such that BankID OIDC provider merchant (OIDC Client), so BankID can retrieve validation keys. 

Encryption

...

Contact us for more information.

Anchor
encrypted_auth_request encrypted_auth_request

Encrypted Authorization Requests 

The OIDC provider from BankID supports decryption of the following element(s):

...

encryption of incoming Authorization Requests through:

• request authorize parameter 

...

• login_hint encryption

...

• (deprecated)

This can be useful in order to ensure personal information is not leaking leaked in the user agent history. Remark that the encryption keys for login_hint are published through the BankID OIDC specific jwks_uri_enc while encryption keys for the request parameter are publish through the OIDC standard jwks_uri.  browser history or URL (for example through login_hint).

The login_hint encryption is deprecated as it is being replaced by the encrypted request parameter.

Keys used for encryption in JWKs are all marked with

...

"use": "enc".

Encryption algorithms supported are:

...

Encrypted request parameter

...

(recommended)

Steps to encrypt a request object

1. Generate a random content encryption key.
2. Encrypt the content encryption key using the appropriate public key from our JWKs endpoint.
3. Encrypt the request object using the content encryption key.
4. Create the JWT with the encrypted content and key.
5. Send the encrypted JWT as value in the request parameter in the Authorization Request.

Note: Using a secure and community provided library for your chosen platform is highly recommended.

Encrypted login hint (deprecated)

The encrypted login_hint should be formatted as a JWE Compact Serialization. The ciphertext is the encrypted plaintext login_hint.

The encrypted request parameter should be formatted as a JWE Compact Serialization. The ciphertext is the request parameter as a  signed JWT

Example

A typical login hint:

login_hint=BID:14025800177

 will using the encryption key in the Jwk JWK example, be:

...