Skip to content

Commit d38fdef

Browse files
balazsorban44balazsorban44
authored
feat(providers): Add BankID Norge provider (#11162)
1 parent b56b928 commit d38fdef

File tree

4 files changed

+258
-0
lines changed

4 files changed

+258
-0
lines changed

‎apps/examples/nextjs/auth.ts

+2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import "next-auth/jwt"
44
import Apple from "next-auth/providers/apple"
55
import Auth0 from "next-auth/providers/auth0"
66
import AzureB2C from "next-auth/providers/azure-ad-b2c"
7+
import BankIDNorway from "next-auth/providers/bankid-no"
78
import BoxyHQSAML from "next-auth/providers/boxyhq-saml"
89
import Cognito from "next-auth/providers/cognito"
910
import Coinbase from "next-auth/providers/coinbase"
@@ -55,6 +56,7 @@ const config = {
5556
clientSecret: process.env.AUTH_AZURE_AD_B2C_SECRET,
5657
issuer: process.env.AUTH_AZURE_AD_B2C_ISSUER,
5758
}),
59+
BankIDNorway,
5860
BoxyHQSAML({
5961
clientId: "dummy",
6062
clientSecret: "dummy",

‎docs/pages/getting-started/providers/bankid-no.mdx

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
title: BankID Norge
3+
---
4+
5+
import { Code } from "@/components/Code"
6+
7+
<img align="right" src="/img/providers/bankid-no.svg" width="64" height="64" />
8+
9+
# BankID Norway Provider
10+
11+
[BankID Norge](https://bankid.no) is a widespread login method in Norway, used by banks, government agencies, and other organizations. This provider allows users to sign in with BankID Norway.
12+
13+
## Resources
14+
15+
- [BankID Norway documentation](https://confluence.bankidnorge.no/confluence/pdoidcl)
16+
- [BankID Testing](https://developer.bankid.no/bankid-with-biometrics/testing)
17+
- [BankID Public Testing discovery endpoint](https://auth.current.bankid.no/auth/realms/current/.well-known/openid-configuration)
18+
19+
## Setup
20+
21+
### Callback URL
22+
23+
<Code>
24+
<Code.Next>
25+
26+
```bash
27+
https://example.com/api/auth/callback/bankid-no
28+
```
29+
30+
</Code.Next>
31+
<Code.Svelte>
32+
33+
```bash
34+
https://example.com/auth/callback/bankid-no
35+
```
36+
37+
</Code.Svelte>
38+
</Code>
39+
40+
### Environment Variables
41+
42+
```
43+
AUTH_BANKID_NO_ID
44+
AUTH_BANKID_NO_SECRET
45+
```
46+
47+
### Configuration
48+
49+
<Code>
50+
<Code.Next>
51+
52+
```ts filename="/auth.ts"
53+
import NextAuth from "next-auth"
54+
import BankIDNorway from "next-auth/providers/bankid-no"
55+
56+
export const { handlers, auth, signIn, signOut } = NextAuth({
57+
providers: [BankIDNorway],
58+
})
59+
```
60+
61+
</Code.Next>
62+
<Code.Svelte>
63+
64+
```ts filename="/src/auth.ts"
65+
import { SvelteKitAuth } from "@auth/sveltekit"
66+
import BankIDNorway from "@auth/sveltekit/providers/bankid-no"
67+
68+
export const { handle, signIn, signOut } = SvelteKitAuth({
69+
providers: [BankIDNorway],
70+
})
71+
```
72+
73+
</Code.Svelte>
74+
<Code.Express>
75+
76+
```ts filename="/src/app.ts"
77+
import { ExpressAuth } from "@auth/express"
78+
import BankIDNorway from "@auth/express/providers/bankid-no"
79+
80+
app.use("/auth/*", ExpressAuth({ providers: [BankIDNorway] }))
81+
```
82+
83+
</Code.Express>
84+
</Code>

‎docs/public/img/providers/bankid-no.svg

+11
Loading

‎packages/core/src/providers/bankid-no.ts

+161
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
/**
2+
* <div style={{display: "flex", justifyContent: "space-between", alignItems: "center"}}>
3+
* <span style={{fontSize: "1.35rem" }}>
4+
* Built-in sign in with <b>BankID Norway</b> integration.
5+
* </span>
6+
* <a href="https://bankid.no" style={{backgroundColor: "black", padding: "12px", borderRadius: "100%" }}>
7+
* <img style={{display: "block"}} src="https://authjs.dev/img/providers/bankid-no.svg" width="24"/>
8+
* </a>
9+
* </div>
10+
*
11+
* @module providers/bankid-no
12+
*/
13+
import type { OIDCConfig, OIDCUserConfig } from "./index.js"
14+
15+
/**
16+
* @see [Core conepts - ID Token](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/core-concepts/id-token)
17+
* @see [userinfo](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/api/userinfo)
18+
*/
19+
export interface BankIDNorwayProfile {
20+
exp: number
21+
iat: number
22+
/** Epoc time */
23+
auth_time: number
24+
jti: string
25+
iss: string
26+
/** Always client_id */
27+
aud: string
28+
sub: string
29+
typ: "ID"
30+
/** Equals client_id */
31+
azp: string
32+
session_state: string
33+
at_hash: string
34+
name: string
35+
given_name: string
36+
family_name: string
37+
birthdate: string
38+
updated_at: number
39+
/**
40+
* Uniform Resource Name for [IDP option](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/core-concepts/identity-providers) being used,
41+
* including Level of Assurance (LoA).
42+
* @example
43+
* ```
44+
* urn:bankid:bid;LOA=4
45+
* ```
46+
*/
47+
acr: string
48+
sid: string
49+
/**
50+
* Name of [IDP option](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/core-concepts/identity-providers) being used to authenticate the end-user.
51+
* If the end-user is subject to authentication step-up,
52+
* note that this value may differ from any `amr` value specified
53+
* in the `login_hint` parameter of the [authorize](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/api/authorize) endpoint.
54+
*/
55+
amr: "BID" | "BIM" | "BIS"
56+
/** Personal Identifier (PID) / Serial Number) from associated BankID certificate. */
57+
bankid_altsub: string
58+
/**
59+
* In case of BID or BIM, the issuer of the end user certificate is returned.
60+
* @example
61+
* ```
62+
* CN=BankID Bankenes ID-tjeneste Bank CA 2,
63+
* OU=988477052,
64+
* O=Bankenes ID-tjeneste AS,*
65+
* C=NO;OrginatorId=9775;OriginatorName=Gjensidige Bank RA 1
66+
* ```
67+
*/
68+
originator: string
69+
additionalCertInfo: {
70+
certValidFrom: number
71+
serialNumber: string
72+
keyAlgorithm: string
73+
keySize: string
74+
policyOid: string
75+
certQualified: boolean
76+
certValidTo: number
77+
versionNumber: string
78+
subjectName: string
79+
}
80+
/** Currently used as an input parameter for the [securityData](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/api/securitydata) endpoint of the [Fraud Data](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/advanced-topics/fraud-data) service */
81+
tid: string
82+
/** Only returned from the `userinfo_endpoint` */
83+
email?: string
84+
/**
85+
* [Norwegian National Identity Number (fødselsnummer)](https://www.skatteetaten.no/en/person/foreign/norwegian-identification-number/national-identity-number). It can be an alternative to `sub`.
86+
* Requires `nnin_altsub` scope at the [authorize](https://confluence.bankidnorge.no/confluence/pdoidcl/technical-documentation/api/authorize) endpoint.
87+
* @example
88+
* ```
89+
* 181266*****
90+
* ```
91+
*/
92+
nnin_altsub?: string
93+
}
94+
95+
/**
96+
* ### Setup
97+
*
98+
* #### Callback URL
99+
* ```
100+
* https://example.com/api/auth/callback/bankid-no
101+
* ```
102+
*
103+
* #### Configuration
104+
* ```ts
105+
* import { Auth } from "@auth/core"
106+
* import BankIDNorge from "@auth/core/providers/bankid-no"
107+
*
108+
* const request = new Request(origin)
109+
* const response = await Auth(request, {
110+
* providers: [
111+
* Auth0({
112+
* clientId: AUTH_BANKID_NO_ID,
113+
* clientSecret: AUTH_BANKID_NO_SECRET,
114+
* }),
115+
* ],
116+
* })
117+
* ```
118+
*
119+
* ### Resources
120+
*
121+
* - [OpenID Connect Provider from BankID](https://confluence.bankidnorge.no/confluence/pdoidcl)
122+
*
123+
* ### Notes
124+
*
125+
* The BankID Norge provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/bankid-no.ts). To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
126+
*
127+
* ## Help
128+
*
129+
* If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
130+
*
131+
* Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
132+
* the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
133+
* we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
134+
*/
135+
export default function BankIDNorway(
136+
config: OIDCUserConfig<BankIDNorwayProfile>
137+
): OIDCConfig<BankIDNorwayProfile> {
138+
return {
139+
id: "bankid-no",
140+
name: "BankID Norge",
141+
type: "oidc",
142+
issuer: "https://auth.bankid.no/auth/realms/prod",
143+
client: {
144+
token_endpoint_auth_method: "client_secret_post",
145+
userinfo_signed_response_alg: "RS256",
146+
},
147+
idToken: false,
148+
authorization: { params: { ui_locales: "no", login_hint: "BIS" } },
149+
profile(profile) {
150+
return {
151+
id: profile.sub,
152+
name: profile.name,
153+
email: profile.email ?? null,
154+
image: null,
155+
}
156+
},
157+
checks: ["pkce", "state", "nonce"],
158+
style: { text: "#fff", bg: "#39134c" },
159+
options: config,
160+
}
161+
}

0 commit comments

Comments
 (0)