Federation & eIDs

Delegate authentication to external identity sources — other providers, directories, social logins, and EU electronic IDs.

• Identity providers — the broker model, JIT provisioning, account linking
• Mappers — claims and SAML attributes to user attributes and roles, sync modes, SAML attribute release
• OIDC & social brokers · SAML broker · LDAP / Active Directory
• EU eIDs: DigiD · eHerkenning · eIDAS
• EU Digital Identity Wallet (OpenID4VP) — sign in with a wallet's PID credential (Beta; Digital Credentials API and verify-only are Preview)
  • Step-up and profile — step-up lifetime, step-up without the first factor, binding by matching attributes, verified attributes kept on the profile (Preview)
  • Trusted lists — issuer trust from signed EU lists, with signer rotation and LoTE pointers (Beta; the new automation is Preview)
  • Credentials beyond the PID (EAA) — driving licence, diploma, qualification; per-credential trust; claims to roles (Preview)
  • Transaction confirmation — the user confirms a consent text or payment with the wallet; verifier_info; multi-signed requests (Preview)
  • DIDs — did:jwk, did:key and did:web issuers on an allow-list, and the issuer's did.json (Preview)
  • Credential issuance (OpenID4VCI) — issue SD-JWT VC and mdoc credentials to users' wallets (Preview)

The new wallet features are Preview: not yet tested with a real national wallet. For the application side, see Verified data for applications and the Verification API.