More than just authentication (ENG)

Fortified ID Access is primarily a SAML IdP, an OIDC OpenID Provider, and an IdP broker, but it also brings broader capabilities for identity, session handling, and user context. This page highlights what organizations can do with Access beyond the core authentication role.

Persona selection

Some users need to choose between more than one identity or context before they sign in. A common example is a user who has one account as an employee and another as an administrator, but the same pattern can also apply to users with different roles, assignments, or organizational affiliations.

Fortified ID Access can be configured with a persona selector when a user can be mapped to multiple valid choices. This makes it possible to let the user actively choose which account, role, or context should be used for the session.

Examples include:

• choosing between an employee account and an administrator account
• choosing a work assignment or role before sign-in
• choosing between identities connected to different organizations

Step-up authentication

Some applications require a higher level of assurance than others. A user might already be signed in through SSO, but when opening a more sensitive application the organization may still want to require a stronger authentication step.

Fortified ID Access can support this through Step-up authentication, where the user performs an additional authentication step when an application or policy requires a higher level of assurance than the original sign-in provided.

Examples:

• A user is already signed in through SSO, but needs to verify with an electronic identity such as BankID when opening a more sensitive application.
• Access is used together with Microsoft Entra ID External Authentication, where the organization uses Conditional Access policies to control when users need to verify with an authentication method in Access, such as SITHS, Freja eID, or BankID.

Self-registration

In some scenarios, the user account does not exist yet when the user first arrives. Organizations may therefore need a way to create an account based on a verified identity and collect complementary user information as part of the onboarding flow.

Fortified ID Access can be part of a self-registration flow where a user first identifies with a trusted electronic identity, after which the organization creates the account and enriches it with additional user information. When needed, this can be combined with Fortified ID Control for data collection, approval steps, and account activation before access is granted.

Shared devices

Shared devices are common in healthcare, care services, schools, and other environments where several users work on the same computer, tablet, or mobile device during a shift. This creates high requirements for secure identification, traceability, and separation between user sessions.

Fortified ID offers solutions for profile selection and passwordless sign-in on shared devices, making it possible to support secure user switching and clearer user accountability even when several people use the same hardware.

Examples include:

• healthcare professionals sharing workstations or mobile devices during a shift
• care staff using the same device for access to care applications and journals
• school or municipal environments where several users share operational devices

Acting on behalf of another user

Some workflows require a user to sign in as themselves while performing actions on behalf of someone else. This is often needed when responsibilities are delegated or when support staff need to understand or correct a user-specific problem.

Fortified ID Access can support these scenarios by preserving the real authenticated identity while allowing the application flow to reflect the delegated or represented user context.

Examples include:

• a teacher resetting a student's password
• a help desk agent viewing the situation from a user's perspective
• an administrator acting on behalf of another user in a controlled workflow

A versatile platform

Fortified ID Access is not limited to a single authentication pattern. It provides a flexible foundation where organizations can combine multiple authentication methods and electronic identities, enrich the user identity with information from external sources, and apply authorization logic after sign-in.

This means the platform can help answer not only whether a user authenticated successfully, but also whether the user should receive access, in which role, and with what identity context.