# Direct Connection to eHerkenning Broker

IMPORTANT

This chapter discusses direct connections to the eHerkenning Broker. If you are using the Signicat Identity Broker, instead follow the steps for integration of eHerkenning in the Identity Broker.

# Signicat eHerkenning Broker certificate

Your application may need to trust the Signicat eHerkenning broker certificates. You can download them here directly:

# Pre-production

Certificate

# Production

Certificate

TIP

Information on how to migrate the eHerkenning Broker to the next-gen portal.

The representation flow is the flow where the user logs in to act on behalf of a company.

Step 1: The service provider sends an AuthnRequest to the eHerkenning broker via Artifact binding, Post binding or Redirect binding to the relevant SingleSignOnService of the eHerkenning broker from the metadata.

Example:

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" 
Location="https://eh01.staging.connectis.nl/broker/sso/1.13"/>

Example AuthnRequest:

<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     AttributeConsumingServiceIndex="6"
                     Destination="https://eh01.staging.connectis.nl/broker/sso/1.13"
                     ForceAuthn="false"
                     ID="_91b639b6cdeb6fe2c618f762a9b96e9a"
                     IssueInstant="2021-04-23T11:28:42.471Z"
                     ProviderName="Example"
                     Version="2.0"
                     >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:DV:00000003244440010000:entities:0006</saml2:Issuer>
</saml2p:AuthnRequest>

Step 2: The eHerkenning Broker verifies the signature and SAMLRequest.

Step 3: The eHerkenning Broker determines the service that is being requested, based on the OIN of the issuer and the AttributeConsumingServiceIndex.

The AttributeConsumingServiceIndex could optionally be mapped by AttributeConsumingServices in the metadata to another index. In below example, index 2 maps to index 50. And, if no AttributeConsumingServiceIndex is sent, index will be 1 (because of isDefault)

Step 4: Show IdP selection screen. Filter IdP from the network metadata based on:

requested LoA (each IdP specifies a maximum LoA they support)
Requested ECTAset (some IdPs do not support certain ECTA, e.g. Pseudo)

Step 5: Create an IdP request and send to the IdPs Single SignOn Service using Artifact binding.

Example: https://acc-ehlogin.we-id.nl/ad113_preprod/process?SAMLart

Once the above steps have been followed, next, you access eHerkenning.

# Access the eHerkenning Broker

To proceed, an authentication method with at least a Level of Assurance (LoA) 3 must be used. More information on purchasing an eHerkenning Level 3 supplier can be found on the leveranciersoverzicht (opens new window) page.

Using the dropdown, select the provider of the authentication method to choose how to log in.

eHerkenning Broker IdP screen