Breadcrumbs

MitID updated to perform CPR Match

What is the change?

  • When MitID identification is requested at E-Ident with loginHint as CPR, then after successful identification by the end-user, MitID IDP performs a MatchCPR call to MitID endpoint to verify if the CPR matched for the user who was intended to identify and the user who identified.

  • In case of success with MatchCPR request, a new claim will be returned in E-Ident response as "authentication_result" : "pass"

  • In case of failure with MatchCPR request, 2 new claims will be returned in E-Ident response as "authentication_result" : "fail" and "result_explanation" : "LOGIN_HINT_MISMATCH"

  • If loginHint is UUID of MitID user, MatchCPR call will not made and instead UUID of the end-user from MitID response will be matched with UUID set as loginHint in the request, before generating the E-Ident response.

  • This feature is only applicable to MitID private users.

  • Also, this feature is not applicable for CIBA requests and MitID iFrame requests.


What this means to customers?

Customers can expect an additional claim with name "authentication_result" in OIDC and "AUTHENTICATION_RESULT" in SAML for all MitID identifications and "result_explanation" in OIDC and "RESULT_EXPLANATION" in SAML for failed MitID identifications, in response.

IDToken update examples


Before the change:

{
"sub" : "mitid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"birthdate" : "dd.mm.yyyy",
"dk_ssn" : "xxxxxxxxxx",
"mitid_transactionid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"amr" : [ "mitid" ],
"mitid.uuid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss" : "https://www-ident-test.nets.no/oidc",
"pid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"nonce" : "noncexx/xx/xxxx",
"aal" : "https://data.gov.dk/concept/core/nsis/High",
"ssn" : "xxxxxxxxxx",
"aud" : "****",
"ial" : "https://data.gov.dk/concept/core/nsis/High",
"ssn_issuing_country" : "DK",
"mitid_amr" : [ "code_app" ],
"name" : "FirstName LastName",
"exp" : 1780574978,
"identity_type" : "private",
"iat" : 1780574078,
"jti" : "68f39d27a43da86d2cea9b19**",
"loa" : "https://data.gov.dk/concept/core/nsis/High"
}

After the change:

Success response

{
"sub" : "mitid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"birthdate" : "dd.mm.yyyy",
"dk_ssn" : "xxxxxxxxxx",
"authentication_result" : "pass",
"mitid_transactionid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"amr" : [ "mitid" ],
"mitid.uuid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss" : "https://www-ident-test.nets.no/oidc",
"pid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"nonce" : "noncexx/xx/xxxx",
"aal" : "https://data.gov.dk/concept/core/nsis/High",
"ssn" : "xxxxxxxxxx",
"aud" : "****",
"ial" : "https://data.gov.dk/concept/core/nsis/High",
"ssn_issuing_country" : "DK",
"mitid_amr" : [ "code_app" ],
"name" : "FirstName LastName",
"exp" : 1780574978,
"identity_type" : "private",
"iat" : 1780574078,
"jti" : "68f39d27a43da86d2cea9b19**",
"loa" : "https://data.gov.dk/concept/core/nsis/High"
}

Failure response

{
"sub" : "mitid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"birthdate" : "dd.mm.yyyy",
"dk_ssn" : "xxxxxxxxxx",
"authentication_result" : "fail",
"result_explanation" : "LOGIN_HINT_MISMATCH"
"mitid_transactionid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"amr" : [ "mitid" ],
"mitid.uuid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss" : "https://www-ident-test.nets.no/oidc",
"pid" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"nonce" : "noncexx/xx/xxxx",
"aal" : "https://data.gov.dk/concept/core/nsis/High",
"ssn" : "xxxxxxxxxx",
"aud" : "****",
"ial" : "https://data.gov.dk/concept/core/nsis/High",
"ssn_issuing_country" : "DK",
"mitid_amr" : [ "code_app" ],
"name" : "FirstName LastName",
"exp" : 1780574978,
"identity_type" : "private",
"iat" : 1780574078,
"jti" : "68f39d27a43da86d2cea9b19**",
"loa" : "https://data.gov.dk/concept/core/nsis/High"
}

Planned date for pre-production: In pre-prod

Planned date for production: 2-Sep-2026

Need help/Have questions:

Please reach out to https://ingroupe.com/in-trust-services-support-contact-page/