Added 3DS flow support for NO BankID

What is the change?

3DS flow is supported by both OIDC and CIBA flow.

3DS flow requires below mandatory parameters-

scope = e3ds : When scope is provided as e3ds with other mandatory/optional scopes then it is considered as a 3DS flow.
binding_message : An approval represents a user’s explicit consent to a clearly defined subject, bound together with additional context, and approved through user authentication (eID).

When a request is a 3DS request then it is mandatory to pass a JSON-format base64-encoded binding_message.

Example-

{
"acr_values": "urn:eident:acrp:level:substantial",
"approvals": [
{
"subject": {
"type": "payment",
"amount": "100.00",
"currency": "EUR",
"creditorName": "Example Shop"
},
"context": {
"referenceId": "order-123456",
"risk": "low",
"merchantCategory": "5411"
}
}
]
}

acr_values : It is a mandatory parameter for 3DS flow. This can be provided as a single request parameter or as a part of binding_message. For a 3DS request only substantial and high level of acr is acceptable i.e. urn:eident:acrp:level:substantial or urn:eident:acrp:level:high
state : It is also a mandatory parameter for a 3DS request.
display : This is an optional but suggested parameter in the 3DS authorization request to control the UI rendering. It accepts maximum two space separated values from below list-

page -> full page UI
popup -> break out to popup window (for eIDs that cannot support iframe)
kiosk -> authentication flow renders with merchant branding only
modal -> authentication flow renders with minimal branding

3DS flow will return a JSON format binding_message in ID-Token which will contain authentication request information.

What this means to customers?

Customers can use 3DS flow for BankID NO card payment authentication by passing new scope e3ds which will also require binding_message, acr_values and state request parameters. It will also support new UI like Page, popup, kiosk and modal and will return JSON format binding_message in idToken.

IDToken update examples

{
"sub" : "no_bankid:xxxx-xxxx-x-xxxxxx",
"birthdate" : "dd.mm.yyyy",
"age_request_met" : true,
"amr" : [ "no_bankid", "cardpayment" ],
"iss" : "https://www-ident-preprod1.nets.eu/oidc",
"dn" : "CN=Test, Test",
"pid" : "xxxx-xxxx-x-xxxxxx",
"binding_message" : {
    "approvals" : [ {
      "subject" : {
        "amount" : "100.00",
        "creditorName" : "Example1 Shop",
        "currency" : "EUR",
        "type" : "payment"
      },
      "context" : {
        "referenceId" : "order-123456"
      }
    }, {
      "subject" : {
        "amount" : "20.00",
        "creditorName" : "Example2 Shop",
        "currency" : "EUR",
        "type" : "payment"
      },
      "context" : {
        "referenceId" : "order-78901"
      }
    } ],
    "acr_values" : "urn:eident:acrp:level:substantial"
},
"no_bid_pid" : "xxxx-xxxx-x-xxxxxx",
"given_name" : "Test",
"nonce" : "noncexx-xx-xx",
"no_ssn" : "xxxxxxxxxxx",
"ssn" : "xxxxxxxxxxx",
"aud" : "xxxx",
"acr" : "urn:eident:cert:eidas:substantial",
"ssn_issuing_country" : "NO",
"name" : "Test, Test",
"age_requested" : "ageverify16",
"exp" : 1784561031,
"iat" : 1784560131,
"family_name" : "Test",
"jti" : "xxxx-xxx-xxx-xx-xx"
}

Planned date for pre-production: 5-Aug-2026

Planned date for production: 2-Sep-2026

Need help/Have questions:

Please reach out to https://ingroupe.com/in-trust-services-support-contact-page/