What is the change?
-
When MitID identification is requested at E-Ident with loginHint as CPR, then after successful identification by the end-user, MitID IDP performs a MatchCPR call to MitID endpoint to verify if the CPR matched for the user who was intended to identify and the user who identified.
-
In case of success with MatchCPR request, a new claim will be returned in E-Ident response as "authentication_result" : "pass"
-
In case of failure with MatchCPR request, 2 new claims will be returned in E-Ident response as "authentication_result" : "fail" and "result_explanation" : "LOGIN_HINT_MISMATCH"
-
If loginHint is UUID of MitID user, MatchCPR call will not made and instead UUID of the end-user from MitID response will be matched with UUID set as loginHint in the request, before generating the E-Ident response.
-
This feature is only applicable to MitID private users.
-
Also, this feature is not applicable for CIBA requests and MitID iFrame requests.
What this means to customers?
When a custumer has provided a loginHint (presetId) while initiating the request with EIdent MitID Private flow then customer can utilize the CPR match feature by default.
A CPR will be matched against provided loginHint (presetId) and accordingly a result will be returned. This will give an extra level of security by making sure the intended user has completed the identification.
Customers can expect an additional claim with name "authentication_result" in OIDC and "AUTHENTICATION_RESULT" in SAML for all MitID identifications and "result_explanation" in OIDC and "RESULT_EXPLANATION" in SAML for failed MitID identifications, in response.
IDToken update examples
Before the change:
{
"sub" : "mitid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"birthdate" : "dd.mm.yyyy",
"dk_ssn" : "xxxxxxxxxx",
"mitid_transactionid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"amr" : [ "mitid" ],
"mitid.uuid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss" : "https://www-ident-test.nets.no/oidc",
"pid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"nonce" : "noncexx/xx/xxxx",
"aal" : "https://data.gov.dk/concept/core/nsis/High",
"ssn" : "xxxxxxxxxx",
"aud" : "****",
"ial" : "https://data.gov.dk/concept/core/nsis/High",
"ssn_issuing_country" : "DK",
"mitid_amr" : [ "code_app" ],
"name" : "FirstName LastName",
"exp" : 1780574978,
"identity_type" : "private",
"iat" : 1780574078,
"jti" : "68f39d27a43da86d2cea9b19**",
"loa" : "https://data.gov.dk/concept/core/nsis/High"
}
After the change:
Success response
{
"sub" : "mitid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"birthdate" : "dd.mm.yyyy",
"dk_ssn" : "xxxxxxxxxx",
"authentication_result" : "pass",
"mitid_transactionid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"amr" : [ "mitid" ],
"mitid.uuid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss" : "https://www-ident-test.nets.no/oidc",
"pid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"nonce" : "noncexx/xx/xxxx",
"aal" : "https://data.gov.dk/concept/core/nsis/High",
"ssn" : "xxxxxxxxxx",
"aud" : "****",
"ial" : "https://data.gov.dk/concept/core/nsis/High",
"ssn_issuing_country" : "DK",
"mitid_amr" : [ "code_app" ],
"name" : "FirstName LastName",
"exp" : 1780574978,
"identity_type" : "private",
"iat" : 1780574078,
"jti" : "68f39d27a43da86d2cea9b19**",
"loa" : "https://data.gov.dk/concept/core/nsis/High"
}
Failure response
{
"sub" : "mitid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"birthdate" : "dd.mm.yyyy",
"dk_ssn" : "xxxxxxxxxx",
"authentication_result" : "fail",
"result_explanation" : "LOGIN_HINT_MISMATCH"
"mitid_transactionid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"amr" : [ "mitid" ],
"mitid.uuid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss" : "https://www-ident-test.nets.no/oidc",
"pid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"nonce" : "noncexx/xx/xxxx",
"aal" : "https://data.gov.dk/concept/core/nsis/High",
"ssn" : "xxxxxxxxxx",
"aud" : "****",
"ial" : "https://data.gov.dk/concept/core/nsis/High",
"ssn_issuing_country" : "DK",
"mitid_amr" : [ "code_app" ],
"name" : "FirstName LastName",
"exp" : 1780574978,
"identity_type" : "private",
"iat" : 1780574078,
"jti" : "68f39d27a43da86d2cea9b19**",
"loa" : "https://data.gov.dk/concept/core/nsis/High"
}
Planned date for pre-production: In pre-prod
Planned date for production: 2-Sep-2026
Need help/Have questions:
Please reach out to https://ingroupe.com/in-trust-services-support-contact-page/