oidf-structure October 2026
Lindström Informational [Page]
Published:
Author:
M. Lindström
The Swedish Agency for Digital Government (Digg)

Sweden Connect – OpenID Federation Structure

Abstract

The Sweden Connect identity federation for OpenID Connect is built on OpenID Federation [OpenID.Federation] and profiled by the "Swedish OpenID Federation Deployment and Interoperability Profile" [OIDC.Sweden.Federation]. Sweden Connect declares federation rules and policies in "Sweden Connect – OpenID Federation Rules and Policies 1.0" [SC.Federation.Rules]. This document describes the Sweden Connect OpenID Federation structure and provides connection information for participating parties.

▲

Table of Contents

1. Introduction

Sweden Connect is an identity federation operated by the Swedish Agency for Digital Government (Digg). It connects organizations that offer electronic identification services with organizations that need to authenticate the users of their services, so that a Relying Party can obtain authentication of a user from an OpenID Provider that Digg has approved, without having to establish a separate relationship with each individual provider.

The federation is built upon OpenID Federation 1.0 [OpenID.Federation], and profiled by the "Swedish OpenID Federation Deployment and Interoperability Profile" [OIDC.Sweden.Federation]. Sweden Connect declares federation rules and policies in "Sweden Connect – OpenID Federation Rules and Policies 1.0" [SC.Federation.Rules].

OpenID Federation gives the federation a common root of trust, the Trust Anchor, whose federation key every participant configures. Starting from that root, trust in an individual Entity is established by collecting and validating a chain of signed Entity Statements, and the metadata that a participant needs in order to interact with that Entity is carried in the same chain. Approvals that an Entity holds, such as the levels of assurance an OpenID Provider may issue tokens under, are expressed as Trust Marks. Registration and metadata discovery are in this way automated, so that participants do not need to exchange configuration out of band.

Registering an Entity in the Production or QA environments requires that the organization has a contract or an agreement with Digg. The Sandbox environment carries no such requirement, and is open to any organization that wants to test or develop against the federation. See Sweden Connect Federation Environments for the environments themselves, and Section 5.2.2, "Contract Trust Marks" of [SC.Federation.Rules] for how a signed contract is reflected within the federation.

This document describes how the Sweden Connect OpenID Connect federation is put together, and provides the information a party needs in order to connect to it. It does not itself define protocol requirements; those are found in the profiles it references. The intended audience is organizations that are joining, or have joined, the Sweden Connect OpenID Connect federation, together with the developers and operators of their Relying Parties and OpenID Providers.

The reader will find the Entities that act as federation services within the federation, and the role each of them has, in Federation Structure. How a Relying Party or an OpenID Provider is registered is described in Joining the Federation, and the Trust Mark types defined for the federation are documented in Trust Marks. Finally, Sweden Connect Federation Environments gives the Entity Identifiers, endpoints, and Trust Anchor keys for each of the environments.

1.1. Terminology

This document uses the terms "OpenID Provider (OP)" and "Relying Party (RP)" as defined by OpenID Connect Core 1.0 [OpenID.Core], and the terms "Entity", "Entity Configuration, "Subordinate Statement", "Intermediate Entity", "Subordinate Entity", "Superior Entity", "Trust Anchor", "Trust Mark", and "Trust Mark Issuer" defined in OpenID Federation 1.0 [OpenID.Federation].

2. Federation Structure

The Sweden Connect OpenID Federation structure can be visualized as shown below:

Figure 1: OpenID Federation structure for Sweden Connect.

Sweden Connect Trust Anchor

The Trust Anchor is the root of the federation, and defines policies and constraints that apply to the entire federation. Participants within the federation configure trust to the federation by trusting the Trust Anchor federation key, see Sweden Connect Federation Environments below.
Resolver

The Trust Anchor exposes a "resolver endpoint" according to Section 8.3 of [OpenID.Federation].
Trust Mark Issuers

There are two Trust Marks Issuers within the Sweden Connect federation; one issuer for issuing Trust Marks that assert OpenID Providers have been approved for issuing tokens under specific "Level of Assurance" URIs, and one issuer that issues Trust Marks indicating that an RP or OP has signed a particular Sweden Connect contract. See Section 4, Trust Marks, below.
Sweden Connect RP Registration Intermediate

An Intermediate Entity that is responsible of registering OpenID Connect Relying Parties to the federation. This entity issues Subordinate Statements for all RPs joining the federation, and also supports hosting of RP Entity Configurations for those RPs that lacks sufficient OpenID Federation-support.
Sweden Connect OP Registration Intermediate

An Intermediate Entity that is responsible of registering OpenID Connect Providers to the federation.

3. Joining the Federation

An organization that has signed any of the contracts that give access to Sweden Connect can join the federation. No contract is required to join the Sandbox federation, see Section 3.1, Joining the Sandbox Federation, below.

During contract signing, each organization appoints one or more administrators who are given the right to log in to the Sweden Connect Metadata Registration Portal. An administrator uses the portal to administer the Entities of its organization.

The portal is accessible from:

A Relying Party can join in one of two ways:

An OpenID Provider can only join the federation by providing its Entity Identifier, from which its published Entity Configuration can be retrieved.

Note: The Sweden Connect Registration Intermediates check the parties that join the federation. This includes manual checks of display names and similar metadata parameters, and automated checks that verify compliance with the underlying standards.

3.1. Joining the Sandbox Federation

An organization joins the Sweden Connect Sandbox federation by:

Read more about the Sandbox federation at https://sandbox.swedenconnect.se.

4. Trust Marks

Section 5.2 of [SC.Federation.Rules] specifies the Trust Marks that are defined within the Sweden Connect federation.

5. Sweden Connect Federation Environments

This section provides information about the different Sweden Connect environments.

5.1. Production

5.1.2. Trust Anchor

Entity Identifier

https://fed.swedenconnect.se/trustanchor
Resolve Endpoint

https://fed.swedenconnect.se/trustanchor/resolve

Trust Anchor Federation Key:

5.1.3. Trust Mark Issuers

5.1.3.1. Level of Assurance Trust Mark Issuer

See Section 5.2.1 of [SC.Federation.Rules].

Entity Identifier

https://fed.swedenconnect.se/tmi-loa
Trust Mark Endpoint (for issuance)

https://fed.swedenconnect.se/tmi-loa/trust_mark
Trust Mark Status Endpoint (for status check)

https://fed.swedenconnect.se/tmi-loa/trust_mark_status
5.1.3.2. Sweden Connect Property and Contract Trust Mark Issuer

See Section 5.2.2 of [SC.Federation.Rules].

Entity Identifier

https://fed.swedenconnect.se/tmi-contracts
Trust Mark Endpoint (for issuance)

https://fed.swedenconnect.se/tmi-contracts/trust_mark
Trust Mark Status Endpoint (for status check)

https://fed.swedenconnect.se/tmi-contracts/trust_mark_status

5.1.4. Registration Intermediate Entities

5.1.4.1. RP Registration Intermediate
Entity Identifier

https://fed.swedenconnect.se/im-reg-sc
Federation List Endpoint

https://fed.swedenconnect.se/im-reg-sc/subordinate_listing
5.1.4.2. OP Registration Intermediate
Entity Identifier

https://fed.swedenconnect.se/im-reg-sc-op
Federation List Endpoint

https://fed.swedenconnect.se/im-reg-sc-op/subordinate_listing

5.2. QA

5.2.2. Trust Anchor

Entity Identifier

https://qa.fed.swedenconnect.se/trustanchor
Resolve Endpoint

https://qa.fed.swedenconnect.se/trustanchor/resolve

Trust Anchor Federation Key:

As PEM-encoded key file:

-----BEGIN PUBLIC KEY-----
MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA0aliFcJ5cpnNjTz87tX6jLdoKTFr
bjLiiwGNBCJrDJWUpPcZtQ36yIXBUqu9p3oe7Og1LZD1kIjIht+myoIlLScA90D5
1nGPdiEsLJlXGgXNsEbhLCOFOul29PcCLp0Vw/t2EpvSVfBXIsa1GigOSKt68iF7
7Ep5V/gWjmlyvYs+2uQ=
-----END PUBLIC KEY-----

As JWK:

{
  "crv": "P-521",
  "kty": "EC",
  "x": "ANGpYhXCeXKZzY08_O7V-oy3aCkxa24y4osBjQQiawyVlKT3GbUN-siFwVKrvad6HuzoNS2Q9ZCIyIbfpsqCJS0n",
  "y": "APdA-dZxj3YhLCyZVxoFzbBG4SwjhTrpdvT3Ai6dFcP7dhKb0lXwVyLGtRooDkirevIhe-xKeVf4Fo5pcr2LPtrk",
  "kid": "CikQYhQZ3WOsSIjLC2E6yhzgOJHfg0suePny60V2Xfs",
  "alg": "ES512",
  "use": "sig"
}

As PEM-encoded X.509 certificate:

-----BEGIN CERTIFICATE-----
MIICCDCCAWmgAwIBAgIUc82lOuDXQzjP469OkjwBntUig6wwCgYIKoZIzj0EAwIw
QDELMAkGA1UEBhMCU0UxFzAVBgNVBAoMDlN3ZWRlbiBDb25uZWN0MRgwFgYDVQQD
DA9RQSBUcnVzdCBBbmNob3IwHhcNMjYwNjE3MTAzMTA5WhcNNDYwNjE3MTAzMTA5
WjBAMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOU3dlZGVuIENvbm5lY3QxGDAWBgNV
BAMMD1FBIFRydXN0IEFuY2hvcjCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEANGp
YhXCeXKZzY08/O7V+oy3aCkxa24y4osBjQQiawyVlKT3GbUN+siFwVKrvad6Huzo
NS2Q9ZCIyIbfpsqCJS0nAPdA+dZxj3YhLCyZVxoFzbBG4SwjhTrpdvT3Ai6dFcP7
dhKb0lXwVyLGtRooDkirevIhe+xKeVf4Fo5pcr2LPtrkMAoGCCqGSM49BAMCA4GM
ADCBiAJCAXzzLJpLhiwd13cITm3UEmbDS74zI9p55q0reME8VY/nit4f2U4EbwyT
8Md1OVWorflf7ajh6mCnlSSbn6+j840eAkIBqXnuoH3vrZuUycO/clrYb0UNPByY
ogmRYB1V92oqa8iVh1lo9Kum917vyqqtCalNP7X4dHOdhsOQlfU7wGXEiQw=
-----END CERTIFICATE-----

5.2.3. Trust Mark Issuers

5.2.3.1. Level of Assurance Trust Mark Issuer

See Section 5.2.1 of [SC.Federation.Rules].

Entity Identifier

https://qa.fed.swedenconnect.se/tmi-loa
Trust Mark Endpoint (for issuance)

https://qa.fed.swedenconnect.se/tmi-loa/trust_mark
Trust Mark Status Endpoint (for status check)

https://qa.fed.swedenconnect.se/tmi-loa/trust_mark_status
5.2.3.2. Sweden Connect Property and Contract Trust Mark Issuer

See Section 5.2.2 of [SC.Federation.Rules].

Entity Identifier

https://qa.fed.swedenconnect.se/tmi-contracts
Trust Mark Endpoint (for issuance)

https://qa.fed.swedenconnect.se/tmi-contracts/trust_mark
Trust Mark Status Endpoint (for status check)

https://qa.fed.swedenconnect.se/tmi-contracts/trust_mark_status

5.2.4. Registration Intermediate Entities

5.2.4.1. RP Registration Intermediate
Entity Identifier

https://qa.fed.swedenconnect.se/im-reg-sc
Federation List Endpoint

https://qa.fed.swedenconnect.se/im-reg-sc/subordinate_listing
5.2.4.2. OP Registration Intermediate
Entity Identifier

https://qa.fed.swedenconnect.se/im-reg-sc-op
Federation List Endpoint

https://qa.fed.swedenconnect.se/im-reg-sc-op/subordinate_listing

5.3. Sandbox

5.3.2. Trust Anchor

Entity Identifier

https://fed.sandbox.swedenconnect.se/trustanchor
Resolve Endpoint

https://fed.sandbox.swedenconnect.se/trustanchor/resolve

Trust Anchor Federation Key:

As PEM-encoded key file:

-----BEGIN PUBLIC KEY-----
MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAythak2N9X+iWmumBTIpVyfxnFk5T
LFMyBe6SrKj6ZXaY3KSZpN25nsneEtGZsJACmo8cC7iCHvkJY8dJge44yQUBCk97
K3liYsy1/BYYQ4YZIqGo9ZAEhb4Fshb0qMnjgqzXjjF0BFIfwRfdZ50eo+kl9H/o
F8Lhw1F3eNYbZsY9dp8=
-----END PUBLIC KEY-----

As JWK:

{
  "crv": "P-521",
  "kty": "EC",
  "x": "AMrYWpNjfV_olprpgUyKVcn8ZxZOUyxTMgXukqyo-mV2mNykmaTduZ7J3hLRmbCQApqPHAu4gh75CWPHSYHuOMkF",
  "y": "AQpPeyt5YmLMtfwWGEOGGSKhqPWQBIW-BbIW9KjJ44Ks144xdARSH8EX3WedHqPpJfR_6BfC4cNRd3jWG2bGPXaf",
  "kid": "x8vWKOCUciPdbte5wyXkY4404TSwi8cok3Zrfj-f7PQ",
  "alg": "ES512",
  "use": "sig"
}

As PEM-encoded X.509 certificate:

-----BEGIN CERTIFICATE-----
MIICEjCCAXOgAwIBAgIUdRPcpnV3mGKmcK7r0ZgBnA5WnWswCgYIKoZIzj0EAwIw
RTELMAkGA1UEBhMCU0UxFzAVBgNVBAoMDlN3ZWRlbiBDb25uZWN0MR0wGwYDVQQD
DBRTYW5kYm94IFRydXN0IEFuY2hvcjAeFw0yNjAxMzAwOTU4MDNaFw0zNjAxMzAw
OTU4MDNaMEUxCzAJBgNVBAYTAlNFMRcwFQYDVQQKDA5Td2VkZW4gQ29ubmVjdDEd
MBsGA1UEAwwUU2FuZGJveCBUcnVzdCBBbmNob3IwgZswEAYHKoZIzj0CAQYFK4EE
ACMDgYYABADK2FqTY31f6Jaa6YFMilXJ/GcWTlMsUzIF7pKsqPpldpjcpJmk3bme
yd4S0ZmwkAKajxwLuIIe+Qljx0mB7jjJBQEKT3sreWJizLX8FhhDhhkioaj1kASF
vgWyFvSoyeOCrNeOMXQEUh/BF91nnR6j6SX0f+gXwuHDUXd41htmxj12nzAKBggq
hkjOPQQDAgOBjAAwgYgCQgFX0+3h5IvfN6pb+1xEVrpept3a64mjg+apgMRRtvBg
i91yP4yJ1YhMEtrd6OdY9WSsTTYIu1vIrHLcJLGGtn4x4wJCAPaUg1+vBh3y7Z9M
n6xpVgkeur9oX0Orc9zTloZqMjLPC0m2qx+mYwQrCzd97T++AqbWVKLe1/mqF+JD
WdHa51qR
-----END CERTIFICATE-----

5.3.3. Trust Mark Issuers

5.3.3.1. Level of Assurance Trust Mark Issuer

See Section 5.2.1 of [SC.Federation.Rules].

Entity Identifier

https://fed.sandbox.swedenconnect.se/tmi-loa
Trust Mark Endpoint (for issuance)

https://fed.sandbox.swedenconnect.se/tmi-loa/trust_mark
Trust Mark Status Endpoint (for status check)

https://fed.sandbox.swedenconnect.se/tmi-loa/trust_mark_status
5.3.3.2. Sweden Connect Property and Contract Trust Mark Issuer

See Section 5.2.2 of [SC.Federation.Rules].

Entity Identifier

https://fed.sandbox.swedenconnect.se/tmi-contracts
Trust Mark Endpoint (for issuance)

https://fed.sandbox.swedenconnect.se/tmi-contracts/trust_mark
Trust Mark Status Endpoint (for status check)

https://fed.sandbox.swedenconnect.se/tmi-contracts/trust_mark_status

5.3.4. Registration Intermediate Entities

5.3.4.1. RP Registration Intermediate
Entity Identifier

https://fed.sandbox.swedenconnect.se/im-reg-sc
Federation List Endpoint

https://fed.sandbox.swedenconnect.se/im-reg-sc/subordinate_listing
5.3.4.2. OP Registration Intermediate
Entity Identifier

https://fed.sandbox.swedenconnect.se/im-reg-sc-op
Federation List Endpoint

https://fed.sandbox.swedenconnect.se/im-reg-sc-op/subordinate_listing

6. Normative References

[OIDC.Sweden.Federation]
Lindström, M. and S. Santesson, "Swedish OpenID Federation Deployment and Interoperability Profile 1.0", , <https://www.oidc.se/specifications/swedish-openid-federation-profile.html>.
[OIDC.Sweden.Hosting]
Lindström, M. and S. Santesson, "OpenID Federation Entity Configuration Hosting 1.0", , <https://www.oidc.se/specifications/openid-federation-hosting-1_0.html>.
[OpenID.Core]
Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and C. Mortimore, "OpenID Connect Core 1.0 incorporating errata set 2", , <http://openid.net/specs/openid-connect-core-1_0.html>.
[OpenID.Federation]
Hedberg, R., Jones, M. B., Solberg, A., Bradley, J., Marco, G. D., and V. Dzhuvinov, "OpenID Federation 1.0", , <https://openid.net/specs/openid-federation-1_0.html>.
[SC.Federation.Rules]
Lindström, M., "Sweden Connect – OpenID Federation Rules and Policies 1.0", , <https://docs.swedenconnect.se/federation/oidf-rules.html>.

Appendix A. Notices

Copyright (c) The Swedish Agency for Digital Government (Digg), 2015-2026. All Rights Reserved.

Appendix B. Document History

2026-10-22
Renamed "Sweden Connect Contract Trust Mark Issuer" to "Sweden Connect Property and Contract Trust Mark Issuer".
2026-10-20
Trust Mark Types are now declared in the Sweden Connect - OpenID Federation Rules and Policies 1.0 document. Definitions have been removed from this document.
2026-10-12
Provided URLs for the Sweden Connect Metadata Registration Portal.
2026-09-17
Corrected kid values for Trust Anchor JWKs for Sandbox and QA.
2026-08-31
Initial version

Author's Address

Martin Lindström
The Swedish Agency for Digital Government (Digg)