KNF:OpenID-Connect

Entree Federatie supports OpenID Connect (OIDC) for Service Providers or Relying Party (RP) in OIDC terminology:

• For OIDC, more standard implementations are available that can easily be integrated into an (existing) application; connecting to Entree Federatie therefore is easier as with SAML.
• OIDC is a RESTful API-like service; it is less complex than SAML.
• In mobile apps OIDC is the defacto standard.

.well-known endpoint

• Staging: https://oidcng.entree-s.kennisnet.nl/.well-known/openid-configuration
• Productie: https://oidcng.entree.kennisnet.nl/.well-known/openid-configuration

Preparation with OpenID Connect

If you want to use OpenID Connect you will have to make sure your software supports this protocol. Several software products already support OpenID Connect out of the box. If your software is amongst these, you can continue to to the paragraph about Claims and attributes below.

We strongly advise you not to build your own OpenID Connect implementation, but use one of the products off the shelf. The official OpenID website provides an overview of certified implementations.

More information: http://openid.net/connect/

If you want to use OpenID Connect you will have to make sure your software supports this protocol. Several software products already support OpenID Connect out of the box. If your software is amongst these, you can continue to to the paragraph about Claims and attributes below.

We strongly advise you not to build your own OpenID Connect implementation, but use one of the products already available. The official OpenID website provides a nice overview of certified and uncertified implementations.

Claims and attributes

Most services require extra information about the authenticated user, such as lastname, email address or a known identifier. In OpenID Connect (OIDC), this extra information comes in the form of claims, whereas in SAML, claims are called attributes. In Entree Federatie, the user authenticates at his Identity Provider (called OpenID Provider in OIDC) - this all happens using SAML. Entree Federatie translates the incoming SAML attributes to OIDC Claims and provides them at the userinfo endpoint for your Service Provider (called Relying Party in OIDC) to consume.

Entree Federatie has a data minimisation policy, which means you only receive those claims that are strictly needed to make your service work.

When you connect to Entree Federatie you can use OpenID Connect or SAML as a protocol to authenticate a user using Entree Federatie. Different standards result in different protocols and in their turn tend to use a jargon specific to that standard. This is also the case with OpenID Connect and SAML. This page depicts how to translate the commonly used SAML attributes to OpenID Connect claims and vice versa.

Please note: The access token has a lifetime, which is by default configured at 1 hour. After the lifetime of the access token has expired, it's no longer possible to retrieve the claims.

An list of SAML attributes together with their details and properties can be found on our page about attributes. Those SAML attributes are provided by institutions connected to Entree Federatie as Identity Provider. You can use any of those attributes in your service (Entree Federatie translates them to OpenID Connect claims).

Het WAYF scherm overslaan

Met OIDC het WAYF (inlog)scherm overslaan: https://developers.wiki.kennisnet.nl/index.php?title=KNF:Scoping#OIDC_Authenticatie_verzoek_met_login_hint