iam
integrations
methods and practices
platforms
security
tools
examples
version control

Strong Authentication (Suomi.fi)

TL;DR

An application can be connected to bank identification using the DVV’s national service. Technically straightforward SAML2.0 authentication. Note the significant challenge factor from administrative/legal intricacies; allocate weeks or months of calendar time. Coordinate carefully with the University of Helsinki’s user administration. What is Suomi.fi?

Suomi.fi identification is a common authentication service for public administration, also known colloquially as “bank identification.” Joining and using the service is free. It is provided by the Population Register Centre. The service is gradually expanding into European-wide EIDAS authentication.

Secure identification to public administration e-services

At the University of Helsinki, it is possible to use Suomi.fi authentication if the application meets its requirements. Learn more about the University of Helsinki’s centralized user authentication: Centralized User Authentication Options (does not yet specifically include information about Suomi.fi).

The Process at a Glance

Below, the process is described in more detail.

Implementation Process

Understand and internalize the implementation steps.

Applying for a Production License (2+ weeks)

NOTE: Initiate this process well in advance, even before setting up the test environment!

The University has its own organizational account in Suomi.fi, linked to several different services. A separate usage license must be applied for from the DVV for each different production service. For example, password reset service has required its own license, FIMM’s genetic research consent its own, and HR’s labor contract data delivery its own. Only in exceptional cases might it be easier if the new service is sufficiently within the scope of an existing one and responsible persons, etc. are the same.

Make the usage license application electronically to the DVV:

Implementation of the Test Environment (1+ week)

Implementation is quite straightforward, as it does not require a separate usage license. Instructions

A SAML2.0 metadata description is required, describing the application’s login configuration.

Metadata content production requires, among other things:

When the Test Environment is Operational

Once the test environment is operational and connected to your application, it can be accessed using commonly known Suomi.fi test credentials, in essence without authentication! Keep this in mind in your application’s test environment and limit access as necessary by other means (e.g., only from the internal network). Open test login to the world lets anyone in!?

Suomi.fi support article Test-tools in the e-identification test environment includes a list of test IDs/test personal identity codes with different attributes. The article also lists details of test users for banks (OP, Säästöpankki/Handelsbanken, Aktia), and at least previously the fake user “Nordea Demo” (personal identity code 210281-9988) from Nordea worked as well.

Implementation of the Production Environment (1 week)

A SAML2.0 metadata file is needed, as in the test environment (see above). Additionally required:

Request the University’s User Management Group to provide the metadata file to the Population Register Centre in electronic service management. Production environment metadata updates also occur at the DVV about once a week.

When Might/Should Strong Authentication be Used?

When access to the system is required for users outside the University / Haka network who still need to be reliably identified.

Examples:

When Might/Should Strong Authentication Not be Used?

If there is a need to identify staff or students of the University of Helsinki. For universities, the use of Suomi.fi identification internally is restricted to certain situations, such as recovering a forgotten password. Internal users are primarily identified using centralized user authentication, which also allows for multi-factor authentication.

If external users do not have the possibility for strong authentication in Suomi.fi even via general European authentication methods, i.e., if a significant portion of external users is from outside Europe. From Europe, at least Germany, Estonia, Spain, Italy are part of the eIDAS authentication network (see below), but authentication outside these countries is more limited.

If user attributes are absolutely required that are only available within the University, and the application does not have the possibility to combine this data, for example, based on the personal identity code. European users receive a unique identifier, which, however, is not in the same format as the Finnish personal identity code (see below)

If users also have an AD account, which is primarily desired for use in logging in, and the application does not have the possibility to logically combine bank login, for example, based on the personal identity code to the AD account. Usually, it is not a good idea to allow users to create two separate identities within the application (one linked to the AD account, the other linked to bank credentials).

Examples:

Technical Details

Your application must be able to handle logins coming through different channels in different ways. While the University’s internal Shibboleth authentication delivers, for example, group attributes, Suomi.fi, of course, does not contain such information. Thus, it must be able to handle Suomi.fi credentials and Shibboleth credentials in different ways and not be paralyzed, for example, by the absence of group data.

The technical authentication event is SAML2 authentication. If possible, it is advisable to use the Shibboleth SP application, which has been found to best implement different situations. This can also easily implement various authentication methods, such as the University’s internal Shibboleth, national Haka, and Suomi.fi identification within the same service. The user information received by the service depends on the method of authentication.

The user will only receive certain attributes depending on the scope defined in the usage license application:

European-wide eIDAS Authentication

European-wide authentication (eIDAS) enables secure use of public administration services across Europe beyond national borders. For EU countries, the adoption of European-wide authentication is mandatory, but a few non-EU EEA countries are also adopting it. All EU countries have been required to accept eIDAS authentication since autumn 2018, so the technical readiness exists, and the pace of transition depends on how quickly different countries join. New countries are added to the authentication options as they are added to Suomi.fi authentication.

eIDAS authentication in Suomi.fi currently (spring 2024) operates with identification instruments from the following countries:

In addition to the aforementioned, most EU countries have already given formal notification of joining (see the EU’s page for Approved Countries and Their Identification Instruments), but the practical implementation schedule for these countries is still open.

Support materials from the Digital and Population Data Services Agency:

Notices on the subject: