Entra ID (Azure AD) with BankID as step-up-method
PreviousActive Directory / LDAP with BankID as step-up-methodNextGoogle with BankID as step-up-method
Last updated
Last updated
In this scenario, the web resource DNP (Digitala Nationella Prov) will be protected by a SAML IdP (Integrity Web), using Skolfederationen as the integration layer.
Entra ID will be used for primary authentication. The integration between Integrity and Entra ID is federation-based (SAML2). Entra ID will pass user attributes necessary for DNP, and also an attribute (mfa_identifier) for the step-up verification to work.
Based on data passed in the initial SAML2 authnRequest from DNP to Integrity, a decision will be automatically made if the user should be prompted for step-up-authentication (BankID).
The identifier of the result of the BankID authentication will be compared to the mfa_identifier value, to verify that the step-up was performed by the correct person.
! This scenario could easily be copied and modified to fulfill other DNP login requirements:
Other DIGG-certified LOA3 step-up methods, such as Freja, SITHS, EFOS, AB Svenska Pass
Other primary authentication sources, such as Google, ADFS, AD, or a combination of many primary authentication sources.
There are some prerequisite for this use case. You will need the following:
BankID certificate. To be able to communicate with bankid backend.
Entra ID (Azure AD) administration rights.
Host (DNS) name of the Integrity service (external access)
Access to Skolfederationen metadata administration. To be able to upload metadata
eduPersonPrincipalName (eppn) stored on the Entra ID user object
Social security number (personnummer) stored on the Entra ID user object (only for teachers (lärare/skolpersonal))
Outgoing TCP/443 communication. To be able to communicate with BankID backend and metadata services.
Follow these steps to setup the basic configuration. Once done, perform the steps below.
Trust need to be established between the primary IdP (Entra) and the SP (Integrity Web).
Login to Entra ID as an administrator
Select Enterprise applications
Click New application
Click Create your own application
Enter a name of the app, Skolfederationen Integrity
Select the option Integrate any other application you don't find in the gallery (Non-gallery)
Create
Click on the application in the list of applications
In the Overview section, click 1.Assign users and groups
Allow all users access to the application
In the Overview section, click 2.Set up single sign on
Select SAML as the single sign-on method
Click Edit on the Basic SAML configuration
On the Identifier part, click Add identifier
Enter https://<your_integrity_dns_name>/saml/authn/integrity_skolfed_broker_sp
On the Reply URL part, click Add reply URL
Enter https://<your_integrity_dns_name>/saml/authn/integrity_skolfed_broker_sp
Click Save.
Example:
Click Edit on the Attributes & claims
Click Add new claim
Enter a name, urn:oid:1.3.6.1.4.1.5923.1.1.1.6
Select the source attribute, containing the eppn value on the user object in Entra.
Example:
Click Save
Click Add new claim
Enter a name, mfa_identifier
Expand Claim conditions
Select User type = Any, Scoped Groups = <select groups with teachers/skolpersonal>, Source = Attribute, Value = <select the source attribute containing "personnummer">
Example:
Click Save
In the Entra ID portal, select the application created in previous step
Select 2. Setup Single sign-on
In section 3. SAML Certificates, copy the App Federation Metadata URL value. This will be used in a later step.
In section 4, copy the Microsoft Entra Identifier. This will be used in a later step.
Open the file customer/config/globals.json
Navigate to the saml part
Set authenticating_idp_metadata to the App Federation Metadata URL value copied in previous step. Set authenticating_idp_entityid to the Microsoft Entra Identifier value copied in previous step.
Restart the Integrity service
Open a browser
Browse to https://fidustest.skolverket.se/DNP-staging/ (DNP test environment) or https://fidustest.skolverket.se/DNP/ (DNP production environment)
Select Inloggning med e-legitimation
Select your IdP
You should be redirected to Integrity and then to Entra
If already logged in to Entra, SSO should happen, otherwise enter your Entra credentials
You should be redirected back to Integrity and prompted with BankID authentication
Fulfill BankID authentication
You should now be redirected back to DNP. If successful, this should be presented.
Tip. Use a SAML tracer tool for your browser to view the data added.
Open a browser
Browse to https://fidustest.skolverket.se/DNP-staging/ (DNP test environment) or https://fidustest.skolverket.se/DNP/ (DNP production environment)
Select Inloggning utan e-legitimation
Select your IdP
You should be redirected to Integrity and then to Entra
If already logged in to Entra, SSO should happen, otherwise enter your Entra credentials
You should be redirected back to Integrity and redirected back to DNP. If successful, this should be presented.
