Configuration of TUPAS authentication method - SSO

Owned by John Jellema
2023-05-05


methods-tupas.ldif configuration file

TIP: From Ubisecure SSO Server version 6.0.1 on, this file will be created automatically to directory c:\Ubisecure\ldap (Windows environment) or /usr/local/ubisecure/ldap (Linux environment) when Ubisecure SSO Server is installed as instructed in the SSO Installation Guide. In that case the dn value is configured automatically during installation to match the current settings. If you create the file manually by using the configuration listing below, you need to replace the LDAP dn values with the correct settings. By default this is set to dc=localhost in the listing below; if your Ubisecure SSO Server's address would be uas.example.com, you would need to replace this with dc=uas,dc=example,dc=com.

# Note! This file is utf-8 encoded
 
# Tupas 2, Nordea
dn: cn=tupas.nordea.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.nordea.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 LEHTI
ubiloginConfString: rcvid 87654321
ubiloginConfString: url https://solo3.nordea.fi/cgi-bin/SOLO3011
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: Nordea
 
# Tupas 2, OKO
dn: cn=tupas.op.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.op.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 Esittelykauppiaansalainentunnus
ubiloginConfString: rcvid Esittelymyyja
ubiloginConfString: url https://kultaraha.op.fi/cgi-bin/krcgi
ubiloginConfString: vers 0003
ubiloginEnabled: FALSE
ubiloginTitle: OP
 
# Tupas 2, Aktia
dn: cn=tupas.aktia.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.aktia.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 03
ubiloginConfString: idtype 03
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 1234567890123456789012345678901234567890123456789012345678901234
ubiloginConfString: rcvid 4444444444444
ubiloginConfString: url https://auth.aktia.fi/tupastest
ubiloginConfString: vers 0003
ubiloginEnabled: FALSE
ubiloginTitle: Aktia
 
# Tupas 2, Danske
dn: cn=tupas.danske.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.danske.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 testi
ubiloginConfString: rcvid 000000000000
ubiloginConfString: url https://verkkopankki.danskebank.fi/SP/tupaha/TupahaApp
ubiloginConfString: vers 0003
ubiloginEnabled: FALSE
ubiloginTitle: Danske
 
# Tupas 2, POP
dn: cn=tupas.pop.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.pop.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 03
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 11111111111111111111
ubiloginConfString: rcvid 1111111111111
ubiloginConfString: url https://tupas.pop.samlink.fi
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: POP
 
# Tupas 2, SP
dn: cn=sp.pop.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: sp.pop.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 03
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 11111111111111111111
ubiloginConfString: rcvid 1111111111111
ubiloginConfString: url https://tupas.sp.samlink.fi
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: SP
 
# Tupas 2, Ålandsbanken
dn: cn=tupas.alandsbanken.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.alandsbanken.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 PAPAGAJA
ubiloginConfString: rcvid AABTUPASID
ubiloginConfString: url https://online.alandsbanken.fi/aab/ebank/auth/initLogin.do
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle:: Alandsbanken
 
# Tupas 2, Tapiola
dn: cn=tupas.tapiola.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.tapiola.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 03
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 PAPAKAIJU
ubiloginConfString: rcvid TAPTUPASID
ubiloginConfString: url https://pankki.tapiola.fi/service/identify
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: Tapiola
 
# Tupas 2, Handelsbanken
dn: cn=tupas.handelsbanken.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.handelsbanken.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 11111111111111111111
ubiloginConfString: rcvid 1111111111111
ubiloginConfString: url https://tunnistepalvelu.samlink.fi/TupasTunnistus/SHBtupas.html
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: Handelsbanken
 
# Tupas 2, S-Pankki
dn: cn=tupas.spankki.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.spankki.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 SPANKKI
ubiloginConfString: rcvid SPANKKITUPAS
ubiloginConfString: url https://online.s-pankki.fi/ebank/auth/initLogin.do
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: S-Pankki
 
# Tupas 2, Elisa
dn: cn=tupas.elisa.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.elisa.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 03
ubiloginConfString: idtype 12
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 eZXBX9asky5rhSaN9n8Xx79RvVHTMBur
ubiloginConfString: rcvid Elisa testi
ubiloginConfString: url https://mtupaspreprod.elisa.fi/tunnistus/signature.cmd
ubiloginConfString: vers 0001
ubiloginEnabled: FALSE
ubiloginTitle: Elisa
 
# Tupas 2, Test
# For use with Ubilogin TUPAS Emulator
dn: cn=tupas.test.1,cn=Server,ou=System,cn=Ubilogin,dc=localhost
changetype: add
cn: tupas.test.1
objectClass: top
objectClass: ubiloginAuthMethod
ubiloginAuthMethodType: Tupas 2
ubiloginClassname: com.ubisecure.auth.login.Tupas2LoginModule
ubiloginConfString: alg 01
ubiloginConfString: idtype 02
ubiloginConfString: keyvers 0001
ubiloginConfString: langcode FI
ubiloginConfString: macKey1 LEHTI
ubiloginConfString: rcvid 87654321
ubiloginConfString: url http://localhost:8080/tupasemulator/
ubiloginConfString: vers 0002
ubiloginEnabled: FALSE
ubiloginTitle: Tupas Test

Public Test Servers Using custtypes Value 08

At the time of writing, S-Pankki uses custtypes value 08 to indicate that the customer personal number (henkilötunnus) is for testing purposes only. S-Pankki test service operates differently than the production service. Ubisecure SSO Server version 5.0.7 and earlier do not support custtypes value 08, and as a result cannot use S-Pankki test service.
Ubisecure SSO Server version 5.1 and above support the use of S-Pankki test service.
The issue has been communicated to S-Pankki.

custtypes Value 08 Functionality Change From TUPAS 2.2 On

Ubisecure SSO Server version 5.1 and above support TUPAS 2.2 configurations.
TUPAS 2.2 support enables receiving both a business ID (y-tunnus) and personal number (henkilötunnus). This functionality can be enabled by using a custtypes value 08 to indicate that both business ID and personal number will be sent, and adding line tupasversion=2.2 to the configuration string of the TUPAS method (this indicates that the supported TUPAS version is 2.2 or greater, and can thus be used in Ubisecure SSO Servers supporting newer TUPAS versions as well). However, this feature is not currently supported by all banks.
Please contact Ubisecure Support for the latest information regarding bank compatibility and configuration for receiving both a business ID and personal number using TUPAS.

TUPAS 2.3 Support and SHA-256 Algorithm

Ubisecure SSO Server version 6.1.1 and above support TUPAS 2.3 configurations.
TUPAS 2.3 support enables the use of SHA-256 algorithm for MAC calculation (generates 64-character MAC, i.e, provides better security). Weaker MD5 and SHA-1 algorithms are no longer supported. In Ubisecure Management, this algorithm is configured with the alg field of the TUPAS 2 Configuration settings view (value 03 sets SHA-256 algorithm to use).
The transition period for this change is from 1st of April 2011 to 31st of December 2011.

Ubisecure Privacy Policy & Cookie Statement