Google with BankID as step-up-method
PreviousEntra ID (Azure AD) with BankID as step-up-methodNextGenerate eduPersonPrincipalName (eppn) and store in Google
Last updated
Last updated
In this scenario, the web resource DNP (Digitala Nationella Prov) will be protected by a SAML IdP (Integrity Web), using Skolfederationen as the integration layer.
Google will be used for primary authentication. The integration between Integrity and Google is federation-based (SAML2). Google will pass user attributes necessary for DNP, and also an attribute (mfa_identifier) for the step-up verification to work.
Based on data passed in the initial SAML2 authnRequest from DNP to Integrity, a decision will be automatically made if the user should be prompted for step-up-authentication (BankID).
The identifier of the result of the BankID authentication will be compared to the mfa_identifier value, to verify that the step-up was performed by the correct person.
! This scenario could easily be copied and modified to fulfill other DNP login requirements:
Other DIGG-certified LOA3 step-up methods, such as Freja, SITHS, EFOS, AB Svenska Pass
Other primary authentication sources, such as Entra, ADFS, AD, or a combination of many primary authentication sources.
There are some prerequisite for this use case. You will need the following:
BankID certificate. To be able to communicate with bankid backend.
Google administration rights.
Host (DNS) name of the Integrity service (external access)
Access to Skolfederationen metadata administration. To be able to upload metadata
eduPersonPrincipalName (eppn) stored on the Google user object
Social security number (personnummer) stored on the Google user object (only for teachers (lärare/skolpersonal))
Outgoing TCP/443 communication. To be able to communicate with BankID backend and metadata services.
Follow these steps to setup the basic configuration. Once done, perform the steps below.
Trust need to be established between the primary IdP (Google) and the SP (Integrity Web).
Login to Google admin console (admin.google.com) as an administrator
In the left hand menu, select Apps->Web and mobile apps
Click Add app -> Add custom SAML app
Enter a name of the app, Skolfederationen Integrity
Continue
Click Download IdP metadata
Below Option 2, copy the Entity ID value. This will be used in a later step.
Continue
Enter ACS URL = https://<your_integrity_dns_name>/saml/authn/integrity_skolfed_broker_sp
Enter Entity ID = https://<your_integrity_dns_name>/saml/authn/integrity_skolfed_broker_sp
Leave the Name ID part unchanged
Continue
Click Add mapping
Select the Google Directory attribute field containing the eppn value
Enter App attributes = urn:oid:1.3.6.1.4.1.5923.1.1.1.6
Click Add mapping
Select the Google Directory attribute field containing the mfa identifier value
Enter App attributes = mfa_identifier
Finish
On the User Access part of the app configuration, click Expand (down arrow)
Change the Service status to ON For everyone
Move the downloaded Google IdP metadata file to the server folder customer/config/resources_external/saml_metadata/. Verify that the file name is GoogleIDPMetadata.xml. (If not, just change the file name to GoogleIDPMetadata.xml)
Open the file customer/config/globals.json
Navigate to the saml part
Set authenticating_idp_metadata_path to ${globals.base_dir}/config/resources_external/saml_metadata/GoogleIDPMetadata.xml Set authenticating_idp_entityid to the Google Entity ID value copied in previous step. Example:
Restart the Integrity service
Open a browser
Browse to https://fidustest.skolverket.se/DNP-staging/ (DNP test environment) or https://fidustest.skolverket.se/DNP/ (DNP production environment)
Select Inloggning med e-legitimation
Select your IdP
You should be redirected to Integrity and then to Google
If already logged in to Google, SSO should happen, otherwise enter your Google credentials
You should be redirected back to Integrity and prompted with BankID authentication
Fulfill BankID authentication
You should now be redirected back to DNP. If successful, this should be presented.
Tip. Use a SAML tracer tool for your browser to view the data added.
Open a browser
Browse to https://fidustest.skolverket.se/DNP-staging/ (DNP test environment) or https://fidustest.skolverket.se/DNP/ (DNP production environment)
Select Inloggning utan e-legitimation
Select your IdP
You should be redirected to Integrity and then to Google
If already logged in to Google, SSO should happen, otherwise enter your Google credentials
You should be redirected back to Integrity and redirected back to DNP. If successful, this should be presented.
