The BankID OpenID Connect platform supports digital signing as an extension of the authorization flow. Both SEID-SDO and PAdES signature envelopes are available. 

Abbreviations

  • SEID-SDO: Norwegian for “Samarbeidsprosjekt om eID og eSignatur Signert DataObjekt”
  • PAdES: PDF Advanced Electronic Signatures

Feature overview

Three different integration flows are available for signing on the BankID OIDC platform. Each flow offers a subset of features summarized in the table below.
The two full flow alternatives gives support for the most advanced use cases through utilization of the SignDoc resource server. The simplified flow is an easier integration alternative, but is limited to text signing.


Simplified flow

Full flow: SEID-SDO

Full flow: PAdES

Envelope
SEID-SDOPAdES
Signature types
  • Combined end user and merchant signature
  • Combined end user and merchant signature
  • Combined end user and merchant signature
  • End user signature only
Document types
  • Text
  • Text
  • XML
  • PDF
  • PDF
Number of documentsSingleMultipleMultiple

Identity Providers

  • BankID netcentric
  • BankID on mobile
  • BankID netcentric
  • BankID on mobile (Note: single text only)
  • BankID netcentric

Multiple end user signatures in same envelope



Serial signing (PAdES increments)

Customization
  • User interface options
  • Timeout for user signing
  • User interface options
  • Timeout for user signing
  • Configuration of visible seals
Result content
  • Basic signature
  • Document hash
  • SEID-SDO envelope
  • Basic signature
  • Document hash
  • PAdES envelope
  • PAdES appendix
  • Document hash

A different subset of the signing functionality is available directly through BankID Server implementations. See Signing compatibility matrix for comparison.

Technical overview

Simplified flow

The simple flow utilizes the authorize-endpoint and is triggered by using the additional scope sign. The request must also include a sign_txt attribute for providing the actual text to be signed. The result will be available as a claim in the ID token

For more details see Simple flow API and implementation guide.

Full flow

The two full flow alternatives makes use of the SignDoc resource server, enabling the merchant to manage and control a more complex sign order and its properties.

A brief overview of this flow:

  1. Merchant request an access token with the signdoc/read_write scope to be used in request to the SignDoc resource server.
  2. Merchant creates the sign order by sending a request to the SignDoc resource server and receives a reference, i.e. sign_id.

  3. The signing transaction is initiated by adding the sign scope and the sign_id reference as query parameters to the authorization request.

  4. End user performs the signing using the BankID web client (netcentric).
  5. Merchant downloads the signing result from the SignDoc resource server.

The general characteristics of this flow are the same for both the SEID-SDO and PAdES alternatives, but properties such as endpoints, request body and response data differs. The PAdES flow supports multiple end user signatures through serial signing where the output from one signing session is used as input for the next.

For more details see the relevant implementation guide for your choice of feature set:

BankID on mobile

BankID web client (netcentric) is the default identity provider used for signing. For text only signing (simplified flow or SEID-SDO full flow) it is possible to use BankID on mobile instead.

In order to use BankID on mobile, the authorization request must contain login_hint=BIM[:[phoneNumber][:birthDate]] as a query parameter.

BankID on mobile has the following limitations:

  • Only supports text signing (simplified flow)
  • The text can be maximum 118 characters long.
  • Only the following character set is supported:
    [0-9] [a-z] [æ] [ø] [å] [A-Z] [Æ] [Ø] [Å] [ ][CR] [LF] [#] [$] [%-&] [(-?] [@] [¡] [£] [¤] [¥] [§] [¿] [Ä] [Ç] [É] [Ñ] [Ö] [Ü] [ß] [à] [ä] [è] [é] [ì] [ñ] [ò] [ö] [ù]
  • Show understanding and show confirmation flags do not apply.
  • English locale is not supported.

Further reading

  • No labels