Norwegian BankID

BankID overview

Token examples

Once a user has successfully authenticated with BankID, Idura Verify issues an ID token in JWT format to your application. The token contains a set of claims about the user and the authentication event itself. The examples below show the structure of the ID tokens issued for Norwegian BankID logins.

Kodebrikke authenticators

Triggered with acr_values=urn:grn:authn:no:bankid:high (or acr_values=urn:grn:authn:no:bankid)

The uniqueUserId identifies the legal person corresponding to the login, and is not considered sensitive.

Biometric authenticator (BankID app)

Triggered with acr_values=urn:grn:authn:no:bankid:substantial

Test users

Creating netcentric test users

Test users are created through the web page at https://ra-preprod.bankidnorge.no/#/search/endUser.

1. Go to the “TEST NUMBER GENERATOR” to generate a random, valid SSN. If you want to test BankID Biometric, please make sure that the “Synthetic” checkbox is unchecked before generating a new number. BankID Biometric app does not currently support synthetic SSN numbers, so you won’t be able to use them for testing.
2. It now says “Could not find any bankIDs for …”.
3. Fill out the first name, last name, and BankID friendly name.
4. Ensure that BankID app is enabled in the “HA services” section, if you want to use BankID Biometric.
5. Click “Order” to initiate the process.
6. Click the pencil icon and add a phone number and an email that you want to associate with the test user. You can use any values that match the correct email and phone number formats (note that the number of digits will differ per country). Random values are acceptable as you’ll be able to access the one-time codes via URLs, as shown in steps 5 and 11 of the Testing BankID Biometric section.
7. Once the process is complete, you will have a test user. User name is the generated SSN, one time password (OTP) is always “otp”, and password is always “qwer1234”.

You can test it out at our authentication demo site, which is a small sample hosted by Idura.

Renewing netcentric test users

If you run into issues with test users created earlier (e.g. errors when entering the one time password), your test user certificate might have expired.

This can be fixed by ordering a new netcentric BankID:

• Find your test user by entering its Personal ID Number number at https://ra-preprod.bankidnorge.no/#/search/endUser
• Fill in the form to order the new netcentric BankID, choosing BankID TestBank in HA Services, and click “Order”

Testing BankID Biometric

Start by creating a netcentric test user as described above.

You will then need to install the test version of the BankID App. Contact our support team to get access to the iOS (distributed via TestFlight) or Android version of the test app. In your request, please provide the email address linked to your Apple ID (for iOS) or your Google account for the Play Store (for Android) used for testing. Our team will get back to you with confirmation and download links for the test app.

The app must be activated before first use:

1. Press the Get started button
2. Enter the birth number (SSN) for the test user you created and press the Next button
3. Enter the phone number you associated to the test user and press the Next button
4. Open the following page and enter the birth number for the test number in the NNIN field to get your your SMS one-time code: https://toba-preprod.bankidapis.no/test/events Note: The page might need to be refreshed several times, and if multiple activations are done in a short period, old SMS codes may be shown. Only the newest activation code will at any point be valid
5. Type the one-time code that is shown on the website into the app and press the Next button
6. Check the Accept terms box and press the Approve button
7. On the Choose activation method screen, press Other alternatives, then press Activation codes
8. Press the Send code words button in the “Is this your email?” screen
9. Open the following page and enter the birth number for the test number in the NNIN field to get your your email code words: https://toba-preprod.bankidapis.no/test/events
10. Type the code words that are shown on the website into the app and press the Next button
11. Press the Next button in the “Log in using BankID to complete the activation” screen
12. Wait until BankID client has loaded in the browser. Pick BankID app in the method list if it is not already preselected.
13. Type “qwer1234” as personal password and click the Next button
14. A progress bar will appear and when finished you will be activated
15. Enable biometrics (which will take you through a flow where you must agree to the terms and conditions)
16. Run your first biometrics-based login to sign the biometrics terms

Data and consent for Norwegian BankID

Available data / scopes

Basic user information, full name, and date of birth are always made available. Additionally, you can request the user’s social security number (SSN) by including the ssn scope in your authorize request. (Note that your application must be configured to use dynamic scope strategy.) Norwegian law governs access to SSN. You request access as part of ordering Norwegian BankID in the dashboard.

Example (partial) authorize request with scopes

https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize?scope=openid ssn&...

Alternatively, you can send the scope in the login_hint

https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize?...&login_hint=scope:ssn&...

which can be useful if you are working with technology that does not let you control the scope value.

Consent model

Stø requires that end-users explicitly consent to sharing their SSN with your application.

Enabling SSN access for your application

To enable SSN access, both a dashboard configuration and a consent collection mechanism in your application UI are required.

1. Configure the dashboard

In the Idura Dashboard, navigate to the Norwegian BankID provider page. In the SSN consent section, select Already granted.

2. Collect consent from your end-users in your website or application

By selecting Already granted, you take responsibility for obtaining the user’s consent to release their SSN before they start the BankID login flow.

In practice, this means adding a step to your application where the user agrees to share their SSN — for example, an explicit consent checkbox, or a notice on the login screen that references your terms of service and privacy policy. The exact implementation is up to you and your legal team.

Consent storage and revocation

Idura stores SSN consent for 1 year per tenant. After that period, the user must provide explicit SSN consent again.

You can add a "forget-me" link on your website if you want to let users revoke the consent again. Use a normal authorize request as target, but add a prompt=consent_revoke query parameter to the request. Idura will then run a login flow (to be able to recognize the end user), and delete the granted consent.

You can learn more about authorize requests in our authorize URL builder.

Configuration

You can tweak core operational parameters and configure access to the optional user data on the Norwegian BankID eID provider page of the Idura Dashboard.

BankID Biometrics assurance level

BankID Biometrics assurance level is “Substantial”.

Learn more about assurance levels.

If you can only use assurance level “High” in your login flow, you must explicitly specify the login_hint=BID in your authorize requests to Idura Verify. Please note that using login_hint=BID will disable biometrics in the BankID app.

Modifying user flows

By default, the user flow is controlled by the user-defined settings of the BankID app: no additional configurations required. If necessary, you can adjust the user flow by adding a login_hint to the authorize URL.

The table below provides a list of options for using login_hint with Norwegian BankID, and the resulting user flows. Check our guide on prefilled fields to learn more.

Caller Authentication

Sikker samtale (“secure conversation”) lets an agent verify a caller’s identity with BankID during a phone call.

For details and integration instructions, see Caller Authentication with CIBA.

Ordering Norwegian BankID

To start accepting real users with Norwegian BankID, you must order your client credentials from Stø. The credentials consist of a client id and a client secret. You order them through the Idura dashboard.

The BankID OIDC Biometrics option is always included in the basis agreement.

To order:

1. In the Idura dashboard, switch to the production environment.
2. Open the Norwegian BankID provider page.
3. Fill out the order form. The form guides you through the required information.

After you submit, Idura reviews your order. Your signatories then receive the agreement for signing. Once everyone has signed, Stø issues your credentials. Expect around 10-13 working days from submission until you receive your credentials. The dashboard shows the status of your order.