Known issues in this release of the OpenID Connect Provider from BankID are further described below in terms of:
Restrictions
The following table summarizes restrictions in this release of OIDC Provider from BankID :
| No | Restrictions in 2018-04-13 Monaco (OIDC) |
| R1 | The TINFO service is currently supported only for xID, see compatiblity matrix. |
| R2 | Signing with the BankID IDP is currently not supported over OpenID Connect. Such support is planned for a future release. |
| R3 | The BankID anti-fraud service is currently not supported over OpenID Connect. Such support is planned for a future release. |
| R4 | Indirectly connected clients of the known-type via Intermediate Services are currently not supported. Such support is planned for a future release. |
| R5 | Some authentication method for OIDC Clients are not supported |
| R6 | Pure app-based applications using a completely embedded (API-based) user-experience is currently not supported. Such support is planned for a future release. |
| R7 | POST method is not supported by Authorize endpoint |
| R8 | Using the OIDC provider via iframes does not work out-of-the box on Safari v11.0.1 and later. The reason is Safari's recent policy to disallow setting of cookies from iframed 3rd-party javascript |
| R9 | Using the OIDC provider via iframes does not work out-of-the box on older versions of IE11 on Windows 7. |
| R10 | Offline Refresh Tokens via the offline_access scope is currently not provided |
| R11 | POST method is not supported by TINFO Userinfo endpoint |
Caveats
The following table summarizes caveats in this release of the OIDC Provider from BankID
| No | Caveats in 2018-04-13 Monaco (OIDC) |
| C1 | The nnin_altsub claim is never part of an Access Token regardless of the presence of this claim in the corresponding ID Token. Resource Servers that are entitled to receive nnin_altsub must be configred to for such access and retrieve this claim via introspection |
| C2 | The default userinfo endpoint in Keyacloack <oidc-baseurl>/protocol/openid-connect/userinfo is replaced by a corresponding userinfo endpoint for TINFO. The latter must be used and is reported in .well-knowi/openid-configuration. The default Keycloack userinfo still respons but does not contain any data that is not already part of the ID Token. |
| C3 | Access to certain scopes may be granted even if such scopes are not explicitly included in the request to Authorize or Token endpoints. This will happen if the OIDC Client is configured with access to such scopes, and such scopes are defined as default in the OIDC Provider. |
| C4 | Scopes requested via Authorize or Token endpoints may be silently ignored without any error to the OIDC Client if (i) the scope value is mis-spelled og (ii) the client in question is not configured for access to the scope(s) in question. To avoid mis-spelling, note that scopes values are case-sensitive. |
| C5 | JS Connector login window may not close on Internet Explorer / Edge browsers when Cross-domain messaging is used. If you follow the methods demonstrated in the example using cross-domain messaging from the redirect_uri to the JS Connector instance on the parent page, and you use window method, then you will most likely experience that Internet Explorer blocks the communication between the window and the parent. This can happen when the window being opened is on a different domain than the parent site. To work around this problem, you need to setup an endpoint on your domain as the doInit oauth_url parameter which then redirects to the proper Authorize endpoint. This way the window is opened on your own domain and cross domain messaging should work. |
| C6 | Missing or empty query parameteres when calling JS Connector doConnect in certain cases. This is probably due to doInit not being called before doConnect is called for some reason. The oidc-connector-loaded event waits for the page to be loaded before firing. For example, if you call doInit when the OIDC loaded event fires, then if the page load slowly you may have a small window where doConnect is triggered before the doInit call was made. A workaround could be to always call doInit before doConnect or go for synchronous loading. |
Bugs
The following table summarizes known bugs in this release of the OIDC Provider from BankID
| No | Bugs in 2018-04-13 Monaco (OIDC) |
| B1 | Error message on time-out must be improved |
| B2 | Language is sometimes not set according to the locale parameter |
| B3 | The error response from TINFO Userinfo is not according to standard |
| B4 | The update_at claim in ID Tokens for xID does not correspond to enrollment time for the xID Service |
| B5 | The state claim is missing in error responses from the Authorize endpoint. |
| B6 | Error responses from xID Useradmin and Useradmin must be improved |