Finnish IDs is an eID offered by a number of Finnish banks and banking groups. Finnish IDs is a part of the Finnish Trust Network (FTN). FTN is a network to simplify the usage of Finnish eIDs where IN Groupe is registered as an identification service broker.
Enable Finnish IDs in your services
The Finnish IDs consists a set of Finnish banks and eIDs. These are:
-
Osuuspankki
-
Nordea
-
Danske Bank
-
Ålandsbanken
-
S-Pankki
-
Aktia
-
POP Pankki
-
Säästöpankki
-
Oma Säästöpankki
-
Mobiilivarmenne
IN Groupe is an ID broker and offers all banks through our E-Ident/FTN service. Upon configuration you will be setup with all banks.
Note:
As per Traficom requirements, customers must use the OpenID Connect protocol with signed request object and encrypted ID Token.
Signed request object details: OpenID Connect - Signed request
Encrypted ID Token details: OpenID Connect- Encrypted ID Token
Read more about FTN here.
Information about the end user
|
Type |
OIDC |
Comments |
|---|---|---|
|
Address |
address Requires: scope=address |
End user's address in JSON format |
|
Birth date |
birthdate Requires: scope=profile |
End user's birth date. |
|
Family name |
family_name Requires: scope=profile |
End user's surname. |
|
SATU |
fi_satu Requires: scope=ssn |
Finnish unique identification number (sähköinen asiointitunnus). |
|
HETU (SSN) |
fi_ssn / ssn Requires: scope=ssn |
End user's Finnish personal identity code (henkilötunnus). Read more about SSN handling. |
|
Bank |
fi_tupas_bank Requires: scope=openid |
The end user’s bank used in the identification process. |
|
Personal identifier |
fi_tupas_pid / pid Requires: scope=openid |
Personal identifier set by IN Groupes FTN. |
|
Given name |
given_name Requires: scope=profile |
End user's first/given name. |
|
Full name
|
name Requires: scope=profile Note: The name value is constructed of the given_name + family_name. |
End user's full name |
|
Level of Assurance |
acr |
Accepts acr_values as urn:eident:acrp:level:high or urn:eident:acrp:level:substantial or urn:eident:acrp:level:low
Always returns: urn:eident:cert:eidas:high
|
|
Organisation name |
organisation_name Requires: scope=organisation |
The organisation name connected to the user's legal person ID. Read more. |
|
Organisation/VAT number |
organisation_number Requires: scope=organisation |
The organisation number (VAT) connected to the user's legal person ID. Read more. |
|
Distinguished name |
dn Requires: scope=cert |
The distinguished name from the end user's certificate (For MobileID) |
|
Phone number |
phone_number Requires: scope=phone |
End user's phone number (For MobileID) e.g. +358507654321 |
Handling of SSN
The social security number (SSN) of an end user can be returned if you are allowed to receive this. This will be determined when you enter into an agreement with IN Groupe or the issuing bank. The SSN is returned as the fi_ssn and ssn claim.
Information about organisation
User experience
Bank ID dialogue
Step 1 (select bank - optional page). Note: The picture below is an illustration of this page in pop-up and standalone UI options:
Step 2:
The end user is directed to the bank's identification client. See each individual bank's look and feel when testing the service. When directing the user to the bank's client, the identification is redirected entirely to the bank's identification page.
End user routed directly to the bank's client
You may also design your own bank selection page and skip the page in step 1 above. If designing your own bank selection page, set the amr_values parameter to fi_tupas and the forcebank parameter to the user-selected bank. The different forcebank parameters can be found on the OIDC page.
Bank logos
If needed, the different bank's logo can be found at these links:
-
Danske bank: https://danskebank.com/news-and-insights/image-bank
-
Nordea: https://www.nordea.com/en/press-and-news/press-photos/nordea-master-brand/
-
OP: https://www.op.fi/op-financial-group/to-the-media/photo-bank
-
S-Pankki: https://seeklogo.com/vector-logo/265951/s-pankki
-
Säästöpankki: https://www.saastopankki.fi/en/media/image-bank
-
Ålandsbanken: https://online.alandsbanken.fi//images/betalknapp/betalknapp.gif
-
Mobiilivarmenne https://mobiilivarmenne.fi/en/
Service Provider Name
If an OIDC signed request is provided with parameter eident_context then this value can be used as Service Provider name for Danske Bank, Ålandsbanken, S-Pankki and Aktia. This service provider name will be shown on bank’s login page. If a value is not provided, then it will show merchant’s name as service provider name.
eident_context should be Base64 encoded JSON in below format-
{
“display_name” : “<ServiceProviderName>”
}
Address Lookup
FI Tupas/BankID FI can perform address lookup for an end-user during identification for any bank supported in E-Ident FTN. The identity provider will lookup for the address and return the address in JSON format in idToken.
To use this feature address scope must be provided with ssn scope and optionally login_hint parameter in the request. Once the required request parameters are provided then address of the end user will be fetched and returned in the idToken with AUTHENTICATION_RESULT as pass, if address is available.
If address data is not available for the end user or if some error occurs while fetching address data then it will return RESULT_EXPLANATION with reason and AUTHENTICATION_RESULT as fail. All the other claims will still be returned as it is.