OpenID Connect Claims and Scopes Specification for Sweden Connect

Version 1.1 – 2026-10-21

Registration number: 2024-7704

Copyright © The Swedish Agency for Digital Government (Digg), 2015-2026. All Rights Reserved.

Table of Contents

1. Introduction

   1.1. Requirements Notation and Conventions

2. Claims

   2.1. eIDAS Claims

   2.1.1. Provisional Identifier

   2.1.2. Provisional Identifier Persistence Indicator

   2.1.3. Mapped Swedish Personal Identity Number

   2.1.4. Mapped Swedish Coordination Number

   2.1.5. Identity Binding

   2.1.6. eIDAS Person Identifier

   2.1.7. eIDAS Country

3. Scopes

   3.1. eIDAS Scopes

   3.1.1. eIDAS Natural Person Identity

   3.1.2. eIDAS Natural Person with Swedish Identity

   3.1.3. Additional eIDAS Claims

4. References

5. Changes between versions

Appendix A: Conversion of eIDAS Attributes

1. Introduction

This specification extends the "Claims and Scopes Specification for the Swedish OpenID Connect Profile", [OIDC.Sweden.Claims], with OpenID Connect claims and scopes for use within the Sweden Connect federation.

1.1. Requirements Notation and Conventions

The keywords “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” are to be interpreted as described in [RFC2119].

These keywords are capitalized when used to unambiguously specify requirements over protocol features and behaviour that affect the interoperability and security of implementations. When these words are not capitalized, they are meant in their natural-language sense.

2. Claims

This section defines a set of claims that extend the claims defined in [OIDC.Sweden.Claims], and the set of standard claims defined in [RFC7519] and Section 5.1 of [OpenID.Core]. A full listing of standard claims can be found in the IANA JSON Web Token Claims Registry, [IANA-Reg].

The claims defined in this specification are named in a collision-resistant manner, as described in the JSON Web Token (JWT) specification, [RFC7519]. All claims defined within this specification are prefixed with the namespace https://id.swedenconnect.se/claim/.

2.1. eIDAS Claims

This section defines how identity attributes received from, or in conjunction with, an eIDAS authentication are represented as OpenID Connect claims within the Sweden Connect federation.

Appendix A: Conversion of eIDAS Attributes presents a full listing of all eIDAS attributes and how they map to OpenID Connect claims. The subsections below define additional claims that may be added by the Swedish eIDAS node.

2.1.1. Provisional Identifier

Claim: https://id.swedenconnect.se/claim/prid

Description: Provisional Identifier used to represent a subject that has been authenticated by the Swedish eIDAS Connector. See Section 3.3.1 of [SAML.SC.Attributes] for details.

Type: String

Corresponding SAML Attribute: urn:oid:1.2.752.201.3.4 (prid) - [SAML.SC.Attributes]

2.1.2. Provisional Identifier Persistence Indicator

Claim: https://id.swedenconnect.se/claim/pridPersistence

Description: Indicator for the expected persistence of the prid claim. See Section 3.3.1 of [SAML.SC.Attributes] for details.

Type: String, where the possible values are A, B or C. See [SC.Constructed] for details.

Corresponding SAML Attribute: urn:oid:1.2.752.201.3.5 (pridPersistence) - [SAML.SC.Attributes]

2.1.3. Mapped Swedish Personal Identity Number

Claim: https://id.swedenconnect.se/claim/mappedPersonalIdentityNumber

Description: A Swedish civic registration number ("personnummer"). This claim is used to represent a Swedish civic registration number that was the result of a query from the Swedish eIDAS Connector to the identity binding service after the subject was authenticated at a foreign eIDAS node. See Section 3.3.2 of [SAML.SC.Attributes] for details.

Normally, a Swedish civic registration number is represented using the claim https://id.oidc.se/claim/personalIdentityNumber defined in [OIDC.Sweden.Claims]. However, to prevent the claim from being used without checking how the binding was made, i.e., how trustworthy the process of binding the Swedish identity to the identity attributes from the eIDAS authentication is, the identity number is represented in a separate claim. See Identity Binding below.

Type: String, where the format is 12 digits without a hyphen.

Corresponding SAML Attribute: urn:oid:1.2.752.201.3.16 (mappedPersonalIdentityNumber) - [SAML.SC.Attributes]

2.1.4. Mapped Swedish Coordination Number

Claim: https://id.swedenconnect.se/claim/mappedCoordinationNumber

Description: A Swedish coordination number ("samordningsnummer"). This claim is used to represent a Swedish coordination number that was the result of a query from the Swedish eIDAS Connector to the identity binding service after the subject was authenticated at a foreign eIDAS node. See Section 3.3.2 of [SAML.SC.Attributes] for details.

Normally, a Swedish coordination number is represented using the claim https://id.oidc.se/claim/coordinationNumber defined in [OIDC.Sweden.Claims], but for the same reasons as described for the mappedPersonalIdentityNumber claim above, a mapped coordination number is represented in a separate claim.

Type: String, where the format is 12 digits without a hyphen.

Corresponding SAML Attribute: urn:oid:1.2.752.201.3.16 (mappedPersonalIdentityNumber) - [SAML.SC.Attributes]

2.1.5. Identity Binding

Claim: https://id.swedenconnect.se/claim/identityBinding

Description: A semicolon-separated list of URIs identifying the "binding process(es)" for a mappedPersonalIdentityNumber or mappedCoordinationNumber claim. See Section 3.3.2 of [SAML.SC.Attributes] and [SC.ID-Binding] for details.

Type: Semicolon-separated list of URIs. Possible values are defined in Section 3 of [SC.ID-Binding].

Corresponding SAML Attribute: urn:oid:1.2.752.201.3.6 (personalIdentityNumberBinding) - [SAML.SC.Attributes]

2.1.6. eIDAS Person Identifier

The eIDAS SAML Attribute Profile [eIDAS.Attributes] defines SAML attributes to be used within the eIDAS authentication framework. Appendix A contains a mapping between these SAML attributes and their corresponding OpenID Connect claims. However, there is no mapping for the http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier SAML attribute. This attribute holds the unique user identifier for a natural person being authenticated using eIDAS.

This specification defines that the URI used as the SAML attribute name is also used as the name of the corresponding OpenID Connect claim representing the eIDAS PersonIdentifier.

Claim: http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier

Description: A claim that holds the value of the eIDAS PersonIdentifier attribute. This value is issued by the foreign eIDAS node, and it is the unique user identifier within the eIDAS federation.

Type: String

Corresponding SAML Attribute: urn:oid:1.2.752.201.3.7 (eidasPersonIdentifier) - [SAML.SC.Attributes]

Note: In version 1.0 of this specification, the custom claim https://id.swedenconnect.se/claim/eidasPersonIdentifier was used to represent an eIDAS PersonIdentifier. This claim has been removed to avoid introducing unnecessary claim definitions in the Sweden Connect framework.

2.1.7. eIDAS Country

Claim: https://id.swedenconnect.se/claim/eidasCountry

Description: A claim that identifies the eIDAS member state that is providing the claims of the subject.

Type: String representing a country code in [ISO3166-1] Alpha-2 or [ISO3166-3] format.

Corresponding SAML Attribute: No specific SAML attribute exists for "eIDAS country". However, the generic urn:oid:2.5.4.6 (c) attribute is included in assertions issued by the Swedish eIDAS node.

3. Scopes

This section defines a set of scopes that extend the scopes defined in Section 3 of [OIDC.Sweden.Claims].

The scopes defined in this specification are named in a collision-resistant manner, as described in the JSON Web Token (JWT) specification, [RFC7519]. All scopes defined within this specification are prefixed with the namespace https://id.swedenconnect.se/scope/.

3.1. eIDAS Scopes

Section 3 of [OIDC.Sweden.Claims] states the following:

Many Relying Parties that use OpenID Connect to authenticate users cannot solely depend on the user's session at the OpenID Provider and the sub claim to log in the user to the RP application. In the context of Swedish eID there are some obvious claims that are regarded to be "primary" identity claims by Relying Parties, for example, a Swedish personal identity number. Such claims are needed by the Relying Party in order to log in a user to its application. Therefore, this specification's scope definitions will define that some claims are to be delivered in the ID Token so that a Relying Party can fully log in a user without having to make a potentially unnecessary call to the UserInfo endpoint.

This also applies to Relying Parties that authenticate users through the Swedish eIDAS Connector.

3.1.1. eIDAS Natural Person Identity

Scope: https://id.swedenconnect.se/scope/eidasNaturalPersonIdentity

Description: A scope that defines a claim set that provides identity information for a natural person authenticated through the Swedish eIDAS node (from an eIDAS member state).

Claims Parameter Equivalent:

{
  "userinfo" : {
    "https://id.swedenconnect.se/claim/prid" : { "essential" : true },
    "https://id.swedenconnect.se/claim/pridPersistence" : { "essential" : true },
    "http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier" : { "essential" : true }
  },
  "id_token" : {
    "https://id.swedenconnect.se/claim/prid" : { "essential" : true },
    "https://id.swedenconnect.se/claim/pridPersistence" : { "essential" : true }
  }
}

Note: It is RECOMMENDED that Swedish Relying Parties use the https://id.swedenconnect.se/claim/prid claim as the primary identity for a user identified using eIDAS. This is why the scope delivers this claim in the ID Token. The eIDAS Person Identifier, which is the identifier issued by the member state eIDAS node, may be logged/saved by the Relying Party for potential future use in contacts with the member state node.

3.1.2. eIDAS Natural Person with Swedish Identity

Scope: https://id.swedenconnect.se/scope/eidasSwedishIdentity

Description: This scope is intended for use when the Swedish eIDAS Connector is integrated with an "Identity Binding Service" holding bindings between eIDAS eID identities and Swedish identities (see [SC.ID-Binding] for details). If this scope is requested by a Relying Party, the eIDAS Connector checks whether a binding exists between the user's eIDAS identity and a Swedish identity, and if so, makes the claims listed below available to the Relying Party.

Note: The integration between the Swedish eIDAS Connector and the Identity Binding Service is not yet in place. Until it is, the claims of this scope will not be delivered.

Claims Parameter Equivalent:

{
  "userinfo" : {
    "https://id.swedenconnect.se/claim/mappedPersonalIdentityNumber" : null,
    "https://id.swedenconnect.se/claim/mappedCoordinationNumber" : null,
    "https://id.swedenconnect.se/claim/identityBinding" : null
  }
}

Note: None of the claims are marked as "essential" since the eIDAS Connector will only deliver the claims if an identity binding exists. Also, the scope definition states that the claims should be delivered via the UserInfo endpoint and not directly in the ID Token. The reason for this is that a mapped identity can never be seen as a primary eIDAS identity (since the claims are only delivered if a binding exists).

Note (ii): The mappedPersonalIdentityNumber and mappedCoordinationNumber claims are mutually exclusive. A user has bound their eIDAS identity to a Swedish civic registration number ("personnummer") or a Swedish coordination number ("samordningsnummer"), never both.

3.1.3. Additional eIDAS Claims

Not all eIDAS attributes/claims listed in Appendix A are covered by the above scope definitions. This section is informative and describes how Relying Parties can obtain additional claims for an eIDAS authentication.

• To obtain name and date of birth claims, include the https://id.oidc.se/scope/naturalPersonInfo scope (Section 3.1 of [OIDC.Sweden.Claims]).

• For the transaction identifier holding the ID of the SAML assertion delivered from the foreign member state (as described in Section 2.5 of [SAML.SC.Attributes]), include an explicit claim request for the txn claim ([RFC8417]).

• For the country code of the eIDAS country in which the user was authenticated (as described in Section 2.5 of [SAML.SC.Attributes]), include an explicit claim request for the https://id.swedenconnect.se/claim/eidasCountry claim (Section 2.1.7).

• For all other optional eIDAS attributes (see Appendix A), an explicit claim request should be included. These claims SHOULD NOT be marked as "essential" since they are not mandatory according to [eIDAS.Attributes].

Section 2.2.1 of [eIDAS.Attributes] defines the eIDAS Minimum Dataset for Natural Persons. This set consists of the eIDAS attributes FamilyName, FirstName, DateOfBirth and PersonIdentifier. In order for a Relying Party to obtain the corresponding OpenID Connect claims from an eIDAS authentication it should specify the https://id.oidc.se/scope/naturalPersonInfo and https://id.swedenconnect.se/scope/eidasNaturalPersonIdentity scopes in an authentication request sent to the Swedish eIDAS Connector.

4. References

[RFC2119]

Bradner, S., Key words for use in RFCs to Indicate Requirement Levels, March 1997.

[OpenID.Core]

Sakimura, N., Bradley, J., Jones, M., de Medeiros, B. and C. Mortimore, "OpenID Connect Core 1.0", August 2015.

[RFC7519]

Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", May 2015.

[IANA-Reg]

IANA JSON Web Token Claims Registry.

[OIDC.Sweden.Claims]

Claims and Scopes Specification for the Swedish OpenID Connect Profile - Version 1.0.

[SAML.SC.Attributes]

Attribute Specification for the Swedish eID Framework.

[SC.Constructed]

eIDAS Constructed Attributes Specification for the Swedish eID Framework.

[SC.ID-Binding]

Binding eIDAS Identities to Records in the Swedish Population Register.

[eIDAS.Attributes]

eIDAS SAML Attribute Profile, version 1.4.1, 09 September 2024.

[OIDC.IAC]

Lodderstedt, T., Fett, D., Haine, M., Pulido, A., Lehmann, K. and K. Koiwai, "OpenID Connect for Identity Assurance Claims Registration 1.0", October 2024.

[RFC8417]

Hunt, P., Jones, M., Denniss, W. and M. Ansari, "Security Event Token (SET)", July 2018.

[ISO3166-1]

ISO, "ISO 3166-1:2020. Codes for the representation of names of countries and their subdivisions -- Part 1: Country codes", 2020.

[ISO3166-3]

ISO, "ISO 3166-3:2020. Codes for the representation of names of countries and their subdivisions -- Part 3: Code for formerly used names of countries", 2020.

5. Changes between versions

Changes between version 1.0 and version 1.1:

• The custom claim https://id.swedenconnect.se/claim/eidasPersonIdentifier was replaced with the http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier claim for representing an eIDAS Person Identifier.

Appendix A: Conversion of eIDAS Attributes

This appendix lists how the eIDAS attributes for natural persons defined in Section 2.2 of [eIDAS.Attributes] are mapped to their corresponding OpenID Connect claims.

Also see Section 3.3.3 of [SAML.SC.Attributes] where a corresponding mapping between eIDAS attributes and Sweden Connect SAML attributes is presented.