Changelog

Add support for API versioning - introducing version 2 of BankID OIDC

Returns any BankID Error codes triggered during user session in error_description on callback to merchant.

Here is an example where BID-20b0 was observed on the session:

https://example.org/callback?error=access_denied&error_description=bankid_error_codes%3A20b0&state=6c1ae8be-add4-4e62-80f7-dce31a3b4bfd

Moves static error page path from https://login.bankid.no/error/* to https://login.bankid.no/err/*

(Version 2) Change format of AMR claim from an uppercase String to an array of lowercased Strings.

(Version 2) Introduce new claim api_ver in Tokens to indicate the BankID OIDC API version used to generate tokens.

1

Fixed issue in Fraud Data RS service.

1

Internal improvements and bug fixes.

1

Removed 1881 integration in additional user information step.

2

Updated the consent screen for sharing NNIN.

1

Fixed a bug in JWKS uri responses where the EC keypairs occasionally returned less bytes than expected.

2

Update error messages to include a longer reference ID and the date. 

1

Fixed a bug where users could get stuck if cancelling BankID Biometrics and cancelling the following BankID authentication in the same session.

1

PDF documents uploaded to Sign Document RS will be automatically converted to PDF/A to be compliant with BankID Document Signing.

1

Internal improvements and bug fixes

1

Bring back support for legacy logout method using only redirect_uri query param. We recommend all merchants using our logout endpoint to switch to RP-initiated logout.

2

Internal improvements and bug fixes

1

Fixed an issue causing occasional 404 responses to OpenID Configuration and JWKS endpoints.

1

Upgrade internal components

1

Upgrade internal components

1

Trust CA certificates for preprod, current and production x5c validation, see Key validation public certificates

2

Mobile keyboard overlaps "Next" button in NNIN view

1

Support key rotation (disabled)

2

Fix, ignore unrecognized request parameters

3

Improve user experience on wrong/invalid NNIN

4

Use text "National ID number" instead of "User ID"

1

Signing sessions now have a minimal timeout of 5 minutes.

2

Unified loading spinners across user interfaces.

3

Updated redirect chain to use automatic form POST instead of GET redirect in some places.

4

Favicon is back.

1

Added support for display parameter in the Authorization Request to provide merchants ways to display BankID user interface that is more consistent with the type of user agent. E.g. better fit for mobile apps or window popups.

1

Added BankID method selector and NNIN input with new look-and-feel

2

Updated look-and-feel of error pages

1

Added chgpwd scope used to initiate an end-user change of password in the BankID netcentric web client

2

Support signing sessions up to 1 hour before timeout

3

Internal improvements and bug fixes

1

Added sid to tokens. See depreciation notice session state replaced by sid in tokens

2

Internal improvements and bug fixes

1

Changed path for IDP view

2

Internal improvements and bug fixes

1

Add BankID Proof token

2

Internal improvements and bug fixes

1

Add favicon to BankID OIDC client

2

Changes related to supporting old and new domains

3

Internal improvements and bug fixes

1

Signdoc RS returns HTTP 403 Forbidden instead of HTTP 500 if missing scope signdoc/read_write

2

Changes related to supporting old and new domains

3

Internal improvements and bug fixes.

1

Fixed issue causing BankID on mobile not working on Safari on Mac and iOS browsers.

2

Internal improvements and bug fixes.

1

Support encryption of login hint by using encryption key from "jwks_uri_enc" in OpenID configuration

2

Internal improvements and bug fixes.

1

Resolved issue that caused resource servers to respond with 401 Unauthorized even if the access token used is valid

2

Internal improvements and bug fixes.

1

Userinfo now returns all given names

2

BankID OIDC now returns error with value invalid_request instead of server_error
when sign scope was used, but sign_id or sign_txt was missing from the request.
HTTP response status is changed from 302 to 303 for consistency.

3

BankID OIDC now returns error with value invalid_scope instead of server_error
when sign scope was used, but client does not have access to the signing service.
HTTP response status is changed from 302 to 303 for consistency.

4

Add support for encryption of login_hint

5

Internal improvements and bug fixes.

1

Scheduled maintenance: https://bankid-services.statuspage.io/incidents/076b2wwy996j

2

Internal improvements and bug fixes.

1

BID signing view is now bigger and resizable to improve user experience.

2

Removed Norwegian Nynorsk, i.e. "nn", from ui_locales_supported in OpenID configuration as it was never supported.

3

Internal improvements and bug fixes.

1

Internal bug fix

1

Fixed bug causing birthdate claim to be off-by-one day for some users.

2

Internal improvements

1

Fixed bug that was causing birthdate claim to be absent from tokens for users that was authenticating through OIDC for the first time.

2

Internal improvements

1

Maintenance update to internal systems. All authorization and authentication services was affected.

Estimated downtime: 5-15 minutes.

1

Fixed spelling mistake in originator claim in tokens:
OrginatorId is renamed OriginatorId

This change was reverted on 2020-05-14 due to it's backwards incompatible changes in token payload.

2

Added support for specifying OTP mechanism in login hint

3

Internal improvements and bug fixes

1

Internal improvements and bug fixes