| Table of Contents |
|---|
...
As discussed in Swedish BankID - SSO before acting as a BankID Relying Party one has to obtain the CA root certificate for communicating with the BankID service provider and the client authentication certificate.
SSO
...
BankID Adapter
Installing
The SSO CIBA BankID Adapter, used with Swedish BankID, is a standalone application which is deployed alongside Ubisecure SSO. It can be deployed to the same or different server. Currently, it is suggested that the adapter is deployed into the same server with Ubisecure SSO. Download the JAR file and on Linux for example, place it under
...
| Note | ||
|---|---|---|
| ||
Although the adapter is currently deployed to the same node as Ubisecure SSO (install on one node only if in HP), it is suggested to secure the adapter by configuring it to use HTTPS in order to avoid exposing of sensitive information. This suggested step allows moving adapters to different servers than Ubisecure SSO. You can refer to Spring Boot Server SSL configuration instructions for more details. |
Adapter configuration properties
The following configuration properties can be set using the configuration prefix:
...
Keys are stored in base64 encoded PKCS12 keystores in ubiloginPKCS12 attribute of the ubiloginKeyCredential objects.
The DNs for ubiloginKeyCredential objects used by the server can be found from the ubiloginKeyCredentialDN attribute values in cn=Server,ou=System,cn=Ubilogin,<LDAP suffix> entry.
After adding the certificates to the trust store modify application configuration to include the new kid in clients[n].key-aliases list.
...
| Endpoint | Secured | Description |
|---|---|---|
/oidc/bc-authorize | yes | OpenID Connect CIBA backchannel authentication endpoint |
/oidc/token | yes | OpenID Connect token endpoint with additional CIBA parameters |
/oidc/.well-known/openid-configuration | no | OpenID Provider configuration metadata endpoint |
/oidc/jwks | no | Exposes JWKs provided by the service |
/v3/api-device/authorize | yes | BankID device authentication endpoint |
/device/token | yes | BankID device token endpoint with specific BankID parameters |
/device/.well-known/oauth2-configuration | no | BankID provider configuration metadat endpoint |
/v3/api-docs | no | Swagger 3.0.1 schema of the API |
/swagger-ui/ | no | Swagger UI to explore the API |
/actuator/health | no | For health checks. This only checks that the adapter is up and running. No external requests are made. Health check of the BankID provider is not included |
/actuator/info | no | For adapter version information |
...
See OpenID Connect CIBA authentication method for more details on how to configure Swedish BankID as an external authentication method to Ubisecure SSO.
See Swedish BankID method for more details on how to configure Swedish BankID as a same device flow external authentication method to Ubisecure SSO.
Obtaining OpenID Connect Provider metadata for SSO Backchannel Authentication Adapter method configuration
...
| Endpoint | Description |
|---|---|
http(s)://localhost:<port>/oidc/.well-known/openid-configuration | OpenID Connect Provider metadata |
http(s)://localhost:<port>/oidc/jwks | ID Token signing keys and issuer metadata |
http(s)://localhost:<port>/device/.well-known/oauth2-configuration | Swedish BankID provider metadata |
An example OpenID Connect Provider metadata response:
...