A Minimum ID Token returned by the OIDC Provider from BankID contains a minimum set of standardized claims marked by 
and 
, among which sub is the only claim that is linked to the actual user. Claims marked by are currently not supported but will be added. A minimum ID Token can be used by OIDC Clients that need to authenticate end-users in an anonumous way. The sub value does not identify the user unless it is linked by the OIDC Client to other claims about the end user associated with that sub value.
An Enlarged ID Token adds some basic (and standardized) claims about the end user to the ID Token, depending on the scopes and claims actually requested by the OIDC Client. Additional claims about the authenticated user beyond this basic set is available via Userinfo associated with the Additional Information service. The basic claims from the enlarged ID Token are duplicated in the reponse from Userinfo. Note that the basic claims of the enlarged ID Token are returned without requesting an explicit consent from the end-user. This is in contrast to additional claims available via Userinfo that as a rule-of-thumb demand explicit consent from the user.
| Claim | Support | Example | Description | Comment | Consent | Editorial comment |
|---|---|---|---|---|---|---|
| Minimum ID Token (todo: corresponds to scope=openid) | ||||||
iss | | https://preview.bankidapis.no | Issuer Identifier for the Issuer | NA | ||
sub | | 9578-5999-4-1765512 | Subject Identifier | Personal Identifier from BankID (Serial number from associated BankID certificate) | NA | |
aud | | DotNetClient | Audience | Always includes client_id | NA | |
exp | | 1494144386 | Expiration time | Epoc time | NA | |
iat | | 1494140787 | Issuing time | Epoc time | NA | |
auth_time | | 1494140786 | Authentication time | Epoc time | NA | |
nonce | | <random value> | Nonce | NA | ||
| acr | | 4 | Authentication Context Class | Level of Assurance for IDP option being used | NA | Must be added |
amr | | BankID | Authentication Method Reference | Name of IDP option being used | NA | |
azp | | DotNetClient | Authorized party | Equals client_id | NA | |
alg | | RS256 | Algorithm used to sign ID Token | NA | ||
typ | | JWT | Type of key used to sign ID Token | NA | ||
kid | | bankid-oauth | ID of key used to sign ID Token | NA | ||
at_hash | | <hash value> | Access Token hash value | NA | Must be added. Required for hybrid flow and implicit flow | |
c_hash | | <hash value> | Code hash value | Hybrid flow | NA | |
| Enlarged ID Token (todo: corresponds to scope=profile) | ||||||
name | | Nilsen, Frode Beckmann | Full name | CommonName from associated BankID certificate | No | |
given_name | | Frode Beckmann | Given name (first name) | No | ||
family_name | | Nilsen | Surname (last name) | No | ||
preferred_username | | Nilsen, Frode Beckmann | Shorthand name | No | Must be reviewed | |
gender | | Male | Gender | Gender derived from NNI from associated BankID certificate | Yes | Must be added |
birthdate | | 1966-12-18 | Birthdate | BirthDate from associated BankID certificate | Yes | |
updated_at | | 1468582440 | Update time | Epoc time of issuing time of associated BankID certificate | Must be added | |
given_name | | Frode Beckmann | Given name (first name) | ||
family_name | | Nilsen | Surname (last name) |