Sweden Connect Technical Specifications

An introduction to the Sweden Connect Framework

Overview documents that describe the different parts of the Sweden Connect Framework. Currently only covers SAML.

• En introduktion till Sweden Connect Tekniskt ramverk
• Introduction to the Sweden Connect Technical Framework

Sweden Connect – Registry for identifiers

This document defines the structure for identifiers assigned by the Swedish Agency for Digital Government (Digg) and provides a registry for assigned identifiers.

• Sweden Connect – Registry for Identifiers

Deployment Profile for the Swedish eID Framework

This is the main SAML specification for the Sweden Connect Framework. It defines a SAML profile including metadata, request and response processing, as well as extensions for signature services.

• Deployment Profile for the Swedish eID Framework
• Deployment Profile for the Swedish eID Framework Draft version 1.9

Attribute Specification for the Swedish eID Framework

This document specifies a SAML attribute profile for the Sweden Connect Framework. The attribute profile defines attributes for use within the Sweden Connect federation, and a number of defined attribute sets that may be referenced by other documents as a means of specifying attribute release requirements.

• Attribute Specification for the Swedish eID Framework

Entity Categories for the Swedish eID Framework

This specification contains the Entity Category definitions that are defined for the Sweden Connect Framework and that should be supported by Service Providers and Identity Providers that are part of the federation.

• Entity Categories for the Swedish eID Framework

eIDAS Constructed Attribute Specification for the Swedish eID Framework

This document provides specifications for constructed attributes.

The concept of constructed attributes is introduced in Swedish national authentication nodes (proxy nodes) delivering identity assertions to Swedish Service Providers based on user authentication with a foreign eID.

• eIDAS Constructed Attributes Specification for the Swedish eID Framework

Principal Selection in SAML Authentication Requests

This specification defines an element that may be included in the Extensions element of a SAML AuthnRequest where the requesting Service Provider can specify matching criteria that may be used by the Identity Provider to select the particular user that should be authenticated.

• Principal Selection in SAML Authentication Requests

User Message Extension in SAML Authentication Requests

This specification defines an element that may be included in the Extensions element of a SAML authentication request where the requesting Service Provider can specify a "user message" that is to be displayed for the user by the Identity Provider during the authentication phase.

• User Message Extension in SAML Authentication Requests

Implementation Profile for BankID Identity Providers within the Swedish eID Framework

SAML implementation profile for Identity Providers implementing BankID support.

• BankID Profile for the Swedish eID Framework

eIDAS Identity Binding

This informational document outlines the process for binding an eIDAS-notified electronic identity (eID) to an individual's personal identification number in the Swedish Population Register.

• Binding eIDAS Identities to Records in the Swedish Population Register

OpenID Connect Profile for Sweden Connect

This profile is an extension of The Swedish OpenID Connect Profile for the Sweden Connect identity federation.

The profile aims to establish a baseline level of security and to facilitate interoperability between Relying Parties and OpenID Providers within the Sweden Connect identity federation.

• OpenID Connect Profile for Sweden Connect
• OpenID Connect Profile for Sweden Connect Draft version 1.1

OpenID Connect Claims and Scopes Specification for Sweden Connect

This specification extends the Claims and Scopes Specification for the Swedish OpenID Connect Profile with OpenID Connect claims and scopes for usage within the Sweden Connect federation.

• OpenID Connect Claims and Scopes Specification for Sweden Connect
• OpenID Connect Claims and Scopes Specification for Sweden Connect Draft version 1.1

OpenID Connect Metadata Requirements

This specification defines the metadata requirements for Relying Parties and OpenID Providers participating in the Sweden Connect OpenID Connect federation. The metadata is published in Entity Configurations according to OpenID Federation 1.0.

The requirements apply to the resolved metadata, meaning the metadata that results once the Trust Chain of an Entity has been applied to the declarations the Entity makes about itself.

• Sweden Connect – OpenID Connect Metadata Requirements

Implementation Profile for using OASIS DSS in Central Signing Services

This document specifies an implementation profile for exchange of sign requests and responses using the OASIS DSS protocol, enhanced by the DSS Extensions for Federated Central Signing Services.

• Implementation Profile for using DSS in Central Signing Services
• Implementation Profile for using DSS in Central Signing Services Draft version 1.7

Certificate Profile for Certificates Issued by Central Signing Services

This document specifies a certificate profile for certificates issued by a signature service.

• Certificate Profile for Central Signing Services

DSS Extension for Federated Central Signing Services

This specification defines elements that extends the <dss:SignRequest> and <dss:SignResponse> elements of the OASIS DSS protocol.

• DSS Extension for Federated Signing Services
• DSS Extension for Federated Signing Services Draft version 1.6

Signature Activation Protocol for Federated Signing

This document specifies a Signature Activation Protocol (SAP) and its data elements for implementation of Sole Control Assurance Level 2 (SCAL2) according to the European standard prEN 419241, Trustworthy Systems Supporting Server Signing.

• Signature Activation Protocol

Signature Validation Tokens

The "Signature Validation Token" draft specifications have been replaced by IETF drafts. See https://github.com/swedenconnect/IETF-SVT.

Sweden Connect – Security Requirements 1.0

This specification defines the security requirements for participants in the Sweden Connect federation. It covers transport protection, cryptographic algorithms, key lengths and key rollover, and applies to both the SAML and the OpenID Connect parts of the federation.

• Sweden Connect – Security Requirements 1.0

Tekniska anslutningsregler för Sweden Connect-federationen

Normative specification for parties joining the Sweden Connect SAML federation. It covers the agreements that give access to the federation, levels of assurance, requirements on authentication and attribute release, and the rules for registering metadata. Currently only in Swedish.

• Tekniska anslutningsregler för Sweden Connect-federationen

Sweden Connect – OpenID Federation Rules and Policies 1.0

The Federation Rules of the Sweden Connect OpenID Connect federation, and the entry document for participants. It states what Relying Parties and OpenID Providers must comply with, including Trust Marks, Registration Policies and the steps for joining the federation.

• Sweden Connect – OpenID Federation Rules and Policies 1.0

Sweden Connect – OpenID Federation Structure

Describes how the Sweden Connect OpenID Connect federation is structured, and gives the Entity Identifiers, endpoints and Trust Anchor keys for the Production, QA and Sandbox environments.

• Sweden Connect – OpenID Federation Structure

Sweden Connect – OpenID Connect Metadata Requirements 1.0

Defines the metadata requirements for Relying Parties and OpenID Providers in the Sweden Connect OpenID Connect federation, and the metadata policies the federation applies to enforce them.

• Sweden Connect – OpenID Connect Metadata Requirements 1.0

Swedish OpenID Federation Deployment and Interoperability Profile 1.0

A deployment and interoperability profile for OpenID Federation. It defines a constrained subset of OpenID Federation, with clarifications and extensions, so that OpenID Providers, Relying Parties and other protocol entities can join a federation with little effort. It also describes how systems without full OpenID Federation support can take part.

• Swedish OpenID Federation Deployment and Interoperability Profile 1.0

OpenID Federation Organization Identifier Metadata Parameter 1.0

Defines the organization_identifier metadata parameter, which lets an Entity declare a unique identifier for the organization that owns it.

• OpenID Federation Organization Identifier Metadata Parameter 1.0

OpenID Federation Registration Policy 1.0

An OpenID Federation extension that defines the registration_policy Claim for Subordinate Statements, identifying the registration policies applied when an Entity was registered in the federation, and a matching constraint that Trust Anchors and Intermediate Entities can use to require them.

• OpenID Federation Registration Policy 1.0

OpenID Federation Entity Configuration Hosting 1.0

An OpenID Federation extension that defines the ec_location Claim, telling where a subject's Entity Configuration can be fetched. This lets an Intermediate Entity host the Entity Configuration for entities that lack full OpenID Federation support.

• OpenID Federation Entity Configuration Hosting 1.0