FortifiedID eID

The FortifiedID eID authenticator lets a user log in by presenting an SD-JWT verifiable credential from the FortifiedID mobile eID app. Access acts as the verifier and the browser UI automatically chooses app-switch on mobile devices or QR code on desktop devices.

Configuration

Note

Authenticator type: Eid

Common authenticator configuration can be found here.

The authenticator exposes the standard browser-side start, state, and cancel handlers. It also exposes public mobile endpoints under the authenticator context path so the eID app can fetch the proof request and post the signed presentation.

Properties

Name	Description	Default value	Mandatory
base_path	Base path for the authentication flow.	${globals.default_login_suffix}	true
context_path	Externally reachable context path for this authenticator instance, used when building mobile request URLs if audience is not set.	""	false
base_url	Externally reachable Access base URL, used together with context_path if audience is not set.	""	false
audience	Audience value expected in the key-binding JWT and preferred external URL anchor for mobile endpoints.	""	true
accepted_issuer	Static issuer DID that this authenticator trusts. Use it as a fallback or additional allowlist entry during issuer key rotation.	""	false
required_claims	Array of claim names that must be disclosed in the presentation. All disclosed claims are stored in global state after successful authentication.	[]	false
required_vc_type	Required SD-JWT VC type, matched against the credential vct claim.	https://service.idombud.se/eid/review/credentials/eid/v1	false
eid_server_base_url	Base URL for the eID server verifier-authorization endpoint.	""	false
eid_server_org	eID server organisation short name. Also exposed to the browser UI and mobile proof request.	""	false
verifier_client_id	OAuth client identifier used when Access fetches verifier authorization from the eID server.	""	false
verifier_keystore_path	Path to the PKCS#12 keystore used to sign verifier request JWTs and authenticate against the eID server.	""	false
verifier_keystore_password	Password for verifier_keystore_path.	""	false
internal_http_destination	HTTP destination used for verifier authorization and, by default, status-list lookups.	default	false
issuer_auth_check_interval_ms	How often Access checks whether cached verifier authorization should be refreshed.	60000	false
issuer_auth_early_refresh_ms	How long before expiry the verifier authorization should be refreshed.	60000	false
issuer_display_name	Display name shown in the mobile app's identification request.	""	false
deeplink_scheme	Deep link used to open the eID app on the user's device.	idombud://AUTHENTICATE	false
return_url	Return URL sent to the mobile app in the deeplink.	""	false
success_location	Optional browser redirect location returned after successful authentication.	""	false
poll_frequency	Browser polling interval in seconds while waiting for the mobile app.	2	false
allowed_polling_for_minutes	Maximum time the browser and mobile session may remain pending.	5	false
session_store_sweep_interval_ms	Interval for removing expired pending mobile sessions from the in-memory session store. Set to 0 to disable the periodic sweep.	60000	false
qr_animated_enabled	Enables animated QR data where the browser rotates the QR URL with timestamp and signature.	true	false
qr_animated_required	Rejects mobile request calls that do not include a valid animated QR timestamp and signature.	false	false
qr_refresh_sec	How often the browser should refresh animated QR data.	1	false
qr_window_sec	Accepted time window for animated QR values.	10	false
max_presentation_bytes	Maximum accepted mobile presentation body size in bytes.	65536	false
max_presentation_attempts	Maximum number of presentation attempts for one pending session.	3	false
clock_skew_seconds	Allowed clock skew when validating credential time claims.	60	false
kb_iat_window_seconds	Allowed age of the key-binding JWT iat value.	120	false
require_exp	Requires the credential to contain an expiry time.	true	false
revocation_enabled	Enables token status-list revocation checks.	true	false
status_list_http_destination	HTTP destination used when fetching token status lists.	internal_http_destination	false
status_list_reload_interval_ms	How long a cached token status list may be reused before Access reloads it.	3600000	false
status_list_cache_max_age_ms	Maximum accepted age for a cached token status list.	43200000	false
status_list_http_timeout_ms	Timeout for token status-list HTTP calls.	5000	false
require_credential_status	Rejects credentials without a status-list reference when revocation is enabled.	true	false
verify_status_list_signature	Verifies the status-list JWT signature against the issuer key.	true	false
custom_identifier	Tag used for event separation.	""	false

Example

{
  "id": "eid01",
  "type": "Eid",
  "config": {
    "base_path": "/login/authn",
    "context_path": "/login/authn/eid01",
    "base_url": "https://access.example.com",
    "audience": "https://access.example.com/login/authn/eid01",
    "eid_server_base_url": "https://eid.example.com",
    "eid_server_org": "example-org",
    "verifier_client_id": "access-verifier",
    "verifier_keystore_path": "/opt/fortifiedid/config/eid-verifier.p12",
    "verifier_keystore_password": "${secret:eid-verifier-keystore-password}",
    "issuer_display_name": "Example organisation",
    "required_claims": [
      "personalIdentifier",
      "givenName",
      "surname"
    ],
    "required_vc_type": "https://service.idombud.se/eid/review/credentials/eid/v1",
    "revocation_enabled": true,
    "require_credential_status": true
  }
}

Caution

Configure verifier_keystore_path, verifier_client_id, eid_server_base_url, and eid_server_org so Access can fetch verifier authorization and sign proof requests. accepted_issuer can be used as an additional static issuer allowlist entry.

Flow

When the browser starts authentication, Access creates a pending eID session and returns both a deeplink and QR data. Mobile and tablet users are sent to the eID app through the deeplink. Desktop users scan the QR code with the eID app.

The eID app fetches a signed proof request from Access, asks the user to present the matching credential, and posts the SD-JWT VC presentation back to Access. Access verifies the issuer, credential type, required claims, nonce, audience, key-binding JWT, expiry, and revocation status before completing the authentication.

Verification errors

Access does not expose internal verification codes to the browser. Failures such as an invalid signature, issuer, credential type, disclosure, key binding, nonce, audience, required claim, expiry, revocation, or unavailable status list are returned to the browser as AUTHENTICATION_FAILED.

User-driven states that require specific guidance remain distinct, including USER_CANCELLED and RATE_LIMITED. The internal error code and message are still written to system logging and event logging for troubleshooting.

Public mobile endpoints

The mobile app calls these endpoints directly under the authenticator context path.

Method	Path	Purpose
GET	{context_path}/mobile/request?id={sessionId}	Fetches the proof request, including nonce, audience, accepted issuers, required credential type, required claims, response URL, verifier request JWT, and verifier authorization JWT.
POST	{context_path}/mobile/presentation?id={sessionId}	Delivers the signed SD-JWT VC presentation in sdJwtPresentation.
DELETE	{context_path}/mobile/presentation?id={sessionId}	Cancels a pending session.

A mobile cancellation can also be sent as POST with header X-EID-Cancel: true. Cancellation requests must include X-Session-Binding-Token with the session nonce.

Data exposed to global state

After a successful authentication, Access stores the claims disclosed by the credential presentation in global state. The exact set of stored keys depends on the claims requested in required_claims and on what the credential holder discloses. The key names match the claim names from the presentation, for example:

• personalIdentifier
• givenName
• surname

Logging

Apart from system logging, event logging is done when starting, completing, failing, cancelling, or expiring a transaction.

Event ids are:

• WEB_100030("FortifiedID eID authentication started")
  • IDENTIFIER (user trace id)
  • CUSTOMER_IDENTIFIER (if configured)
  • SOURCE_ADDRESS (ip of the remote session)
  • AUTHENTICATOR_IDENTIFIER (id and display name)
• WEB_100031("FortifiedID eID authentication completed")
  • IDENTIFIER (user trace id)
  • CUSTOMER_IDENTIFIER (if configured)
  • SOURCE_ADDRESS (ip of the remote session)
  • AUTHENTICATOR_IDENTIFIER (id and display name)
  • givenName (if disclosed)
  • surname (if disclosed)
• WEB_100032("FortifiedID eID authentication failed")
  • IDENTIFIER (user trace id)
  • CUSTOMER_IDENTIFIER (if configured)
  • SOURCE_ADDRESS (ip of the remote session)
  • AUTHENTICATOR_IDENTIFIER (id and display name)
  • MESSAGE (error code)
• WEB_100033("FortifiedID eID authentication canceled or expired")
  • IDENTIFIER (user trace id)
  • CUSTOMER_IDENTIFIER (if configured)
  • SOURCE_ADDRESS (ip of the remote session)
  • AUTHENTICATOR_IDENTIFIER (id and display name)
  • MESSAGE (reason)