Direct Connection to eHerkenning Broker
The following steps will outline how to configure a direct connection to the eHerkenning Broker.
IMPORTANT: This chapter discusses direct connections to the eHerkenning Broker. If you are using the Signicat Identity Broker, instead follow the steps for integration of eHerkenning in the Identity Broker.
Your application may need to trust the Signicat eHerkenning broker certificates. You can download them here directly:
eh.pre.signicat.nl.chained+root.crt
7KB
Binary
eh.signicat.nl.chained+root.crt
7KB
Binary
The representation flow is the flow where the user logs in to act on behalf of a company.
Step 1: The service provider sends an AuthnRequest to the eHerkenning broker via Artifact binding, Post binding or Redirect binding to the relevant SingleSignOnService of the eHerkenning broker from the metadata.
Example:
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="https://eh01.staging.connectis.nl/broker/sso/1.13"/>
Example AuthnRequest:
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
AttributeConsumingServiceIndex="6"
Destination="https://eh01.staging.connectis.nl/broker/sso/1.13"
ForceAuthn="false"
ID="_91b639b6cdeb6fe2c618f762a9b96e9a"
IssueInstant="2021-04-23T11:28:42.471Z"
ProviderName="Example"
Version="2.0"
>
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:DV:00000003244440010000:entities:0006</saml2:Issuer>
</saml2p:AuthnRequest>
Step 2: The eHerkenning Broker verifies the signature and SAMLRequest.
Step 3: The eHerkenning Broker determines the service that is being requested, based on the OIN of the issuer and the AttributeConsumingServiceIndex.
The AttributeConsumingServiceIndex could optionally be mapped by AttributeConsumingServices in the metadata to another index. In below example, index 2 maps to index 50. And, if no AttributeConsumingServiceIndex is sent, index will be 1 (because of isDefault)
Step 4: Show IdP selection screen. Filter IdP from the network metadata based on:
- requested LoA (each IdP specifies a maximum LoA they support)
- Requested ECTAset (some IdPs do not support certain ECTA, e.g. Pseudo)
Step 5: Create an IdP request and send to the IdPs Single SignOn Service using Artifact binding.
Example:
https://acc-ehlogin.we-id.nl/ad113_preprod/process?SAMLartOnce the above steps have been followed, next, you access eHerkenning.
To proceed, an authentication method with at least a Level of Assurance (LoA) 3 must be used. More information on purchasing an eHerkenning Level 3 supplier can be found on the leveranciersoverzicht page.
Using the dropdown, select the provider of the authentication method to choose how to log in.
eHerkenning Broker IdP screen
You can choose an authentication method from the following suppliers that offer LoA level 3. Use the links to find out more about each supplier: