ID Token

urn:idp:vismaconnect

Any authentication method using Visma Connect

2 or 3

urn:idp:vismaconnect:method:pwd

Password authentication method using Visma Connect

2 or 3

urn:idp:vismaconnect:method:pwdless

Passwordless authentication method using Visma Connect

3

urn:idp:vismaconnect:level:3

Any Level 3 (or higher) authentication method using Visma Connect. Level 3 will always trigger Level 2 (pwd) before the Level 3 method in combination with max_age parameter.

3

urn:idp:vismaconnect:mfa

Any 2fa method will be possible to use during sign in or step up. If user is not enrolled to 2fa he will be prompted for the wizard. Can be combine with max_age to trigger pwd re-authentication. 

amr will include only the method used for re-authentication or authentication

Use case 1: User is signed in with pwd (level 2).

• if only the acr_value is sent without max_age, then user has to enter 2fa

• if only the acr_value is sent with max_age=0, then user has to enter both pwd + 2fa (same as prompt=login): 

• if only the acr_value is sent with max_age=0 and prompt=login, then user has to sign in with a new session and enter both pwd + 2fa;

• if the acr_value is sent with max_age, then user has to enter only 2fa if pwd is within  the max_age

Use case 2: User is signed in with 2fa (level 3)

• if only the acr_value is sent without max_age, then user has to enter both pwd + 2fa

• if the acr_value is sent with max_age, then user will not enter anything if 2fa is within the max_age

2 or 3

urn:idp:vismaconnect:method:push

TOTP authentication method using Visma Authenticator App

3

urn:idp:vismaconnect:method:sms  NOT IMPLEMENTED

Provide SMS security code using Visma Connect. A Level 3 method will always trigger Level 2 (pwd) before the Level 3 method in combination with max_age parameter.

3

urn:idp:vismaconnect:method:otp

TOTP authentication method using Visma Connect when a user is signed in.

Will be Level 2 (otp) because the user is only prompted for OTP and not a password.

Level 3 is set only when use goes through TOTP setup wizard.

2 or 3

urn:idp:my-<mydomain>
(e.g. urn:idp:my-visma)

Authentication using a customers chosen External Identity Provider (e.g. EntraID, ADFS etc.). Each customer choose their own "MyDomain" specific for their OIDC or SAML setup.

2 or 3

urn:idp:saml_oidc

Authentication using a customers SAML 2.0 or OpenID Connect Identity Provider (e.g. Azure AD, ADFS etc.)

2 or 3

urn:idp:nbid

Authentication method using BankID Norway

4

urn:idp:nbid-biometric

Authentication method using BankID Norway Biometric app

3

urn:idp:id-porten

Any authentication method using ID-porten

3 or 4

urn:idp:id-porten:level:4

Only Level 4 authentication method using ID-porten

4

urn:idp:feide
OR
urn:idp:feide:level:2

Authentication method using Feide

2

urn:idp:feide:method:otp
OR
urn:idp:feide:level:3

Authentication method using Feide with Feide 2FA

3

urn:idp:sbid

Authentication method using BankID Sweden

3

urn:idp:sbid-mobile

Authentication method using BankID Sweden Mobile

3

urn:idp:apple

Authentication method using social sign-in with Apple

2

urn:idp:google

Authentication method using social sign-in with Google

2

urn:idp:facebook

Authentication method using social sign-in with Facebook

2

urn:idp:microsoft

Authentication method using social sign-in with Microsoft

2

urn:idp:linkedin

Authentication method using social sign-in with LinkedIn

2

urn:idp:mitid

Authentication method using Danish MitID for private individuals

3 or 4

urn:idp:mitid:level:4

Request level 4 using MitID provider

4

urn:idp:mitid:method:mitid-erhverv

Authentication method using Danish MitID for business individuals (see idp_claims scope for instructions to retrieve CVR number)

3 or 4

urn:idp:fbid

Authentication using Finnish BankID

4

urn:idp:fbid:method:<AMR>

Authentication using Finnish BankID using a specific bank. See AMR values supported in AMR descriptions below.

4