Manage Local IdP

If your organisation is established as a Local IdP, you, as an organisation administrator, manage your organisation’s

Local IdP in MitID Erhverv.

This page is relevant for:

  • organisation administrator

What is Local IdP?

With Local IdP (Identity Provider), your organisation can issue its own authenticators for your organisation’s employees. Instead of using the MitID app, code display, audio code reader, or chip, employees can use the authenticators issued by your organisation to log in to self-services as well as the organistion’s own systems.

What can you manage as an organisation administrator?

In MitID Erhverv, as an organisation administrator, you can create or change settings for Local IdP.

You can:

Before you begin managing your Local IdP, read the step by step guide on establishing it. The guide covers how:

  • your organisation should prepare
  • you can conduct a test connection
  • you can connect Local IdP in production.

Local IdP

Add Local IdP

The integration guide for Local IdP provides a detailed explanation of how you, as an organisation administrator, can add a Local IdP in MitID Erhverv. This is covered in Chapter 7.1: "Technical connection":

NemLog-in.dk: Integration with NemLog-in – Local IdP (pdf)

View details of your organisation’s Local IdP

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, and the list of your organisation’s Local IdPs will be visible.

Details for the selected Local IdP will appear.

Display metadata for your organisation’s Local IdP

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, and the list of your organisation’s Local IdPs will be displayed.

The menu will provide the following 6 options:

  • View metadata
  • Upload metadata
  • Edit organisations
  • Edit Local IdP
  • Configure service window
  • Delete Local IdP
Metadata for the Local IdP will be displayed.

Edit metadata for your organisation’s Local IdP

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, and the list of your organisation’s Local IdPs will be displayed.

The menu will provides the following 6 options:

  • View metadata
  • Upload metadata
  • Edit organisations
  • Edit Local IdP
  • Configure service window
  • Delete Local IdP

A warning will appear stating “Changes to metadata take effect immediately”. You should then tap the “Upload” button.

The “Edit metadata” window will appear.

Tap the “Find file” button, locate the file you want to upload and then tap “Ok”.

Tap the “OK” button. This button will only be activated if the uploaded file is a valid metadata file.

The metadata will update, and you will see changes under “Entity ID” and/or “Certificates.”

Add an organisation to your organisation’s Local IdP

When adding an organisation to your organisation’s Local IdP, it is only possible to add organisations that are NSIS-registered and appear on the list with the same security level as your organisation’s Local IdP.

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, and the list of your organisation’s Local IdPs will be displayed.

The menu will provide the following 6 options:

  • View metadata
  • Upload metadata
  • Edit organisations
  • Edit Local IdP
  • Configure service window
  • Delete Local IdP

The “Edit associated organisations” window will appear.

If you have multiple tenants, enter the CVR numbers of the tenants you want to add in the “CVR number” field. This field is optional.

Note that you can only add organisations that are NSIS-registered and appear on the list with the same security level as your organisation’s Local IdP.

Once you have added CVR numbers, tap “Next.” If you do not need to add more tenants, simply tap “Next.”

You will see a summary of the information you have entered.

Note that the EntityID is retrieved from your metadata file; you have not manually entered it.

Tick the box “I hereby confirm that the connected IdP complies with NSIS at the specified security level.”

You will now see the organisation in the list of organisations added to your Local IdP.

Delete an organisation from your organisation’s Local IdP

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, and the list of your organisation’s Local IdPs will be displayed.

The menu provides the following 6 options:

  • View metadata
  • Upload metadata
  • Edit organisations
  • Edit Local IdP
  • Configure service window
  • Delete Local IdP

The “Edit associated organisations” window will appear. Displaying the list of organisations registered in your organisation’s Local IdP.

Find the organisation you want to delete. The “Delete” button is located to the right of the organisation’s name.

The warning “Remove organisation from Local IdP” will appear.

This button is located below the warning “Remove organisation from Local IdP”.

A confirmation of deletion is displayed, and you will see that the organisation has been removed from the list of organisations added to your Local IdP.

Edit settings in your organisation’s Local IdP

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, displaying the list of your organisation’s Local IdPs.

The menu provides the following 6 options:

  • View metadata
  • Upload metadata
  • Edit organisations
  • Edit Local IdP
  • Configure service window
  • Delete Local IdP

The "Edit Local IdP" window appears.

You can adjust the following 3 fields:

  • Name.
  • Security level. This field can only be adjusted if your organisation has prior approval from the MitID Erhverv Administration.
  • IdP Software.

Once tapped, the "Edit Local IdP" window will close, and you will able to see your changes in the Local IdP details.

Delete Local IdP

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu at the bottom of the page.

The "Local IdP" menu will expand, displaying the list of your organisation’s Local IdPs will be visible.

The menu provides the following 6 options:

  • View metadata
  • Upload metadata
  • Edit organisations
  • Edit Local IdP
  • Configure service window
  • Delete Local IdP

A warning about deleting the Local IdP will appear.

The warning closes and a confirmation of the deletion appears in the list of Local IdP's.

Set the security level at which a user administrator can create users

Once your organisation has connected a Local IdP, it is required that your organisation’s administrators understands how to properly execute the NSIS-approved (Local) identity assurance process.

Agency for Digital Government’s homepage: National Standard for Identity Assuarance Levels (NSIS) (Only available in Danish)

In MitID Erhverv, you must tick the box confirming that administrators are educated to create users at the substantial assuarance level.

Find "Users": Menu > Users.

Locate the administrator you want to tick as trained in the list and tap the administrator.

The "User Information" window will open.

Once tapped," the menu expands.

The box is under "User Administrator." This box is only for the substantial assurance level, as the high assurance level is not yet supported in MitID Erhverv.

The "Finish" button is at the bottom of the "User Information" window.

Assign rights to users when your organisation uses a Local IdP

A right in MitID Erhverv grants access or permission to perform a specific task in self-service. Users are assigned rights in the same manner, regardless of whether they use MitID authenticators or authenticators issued by a Local IdP. Rights are therefore assigned to the user and not dependant on the type of authenticator used.

Rights can be assigned to users through:

  • integration to the IdM API
  • the user interface in MitID Erhverv.

If you choose to assign rights through the user interface in MitID Erhverv, a rights administrator or user administrator in your organisation must do it. The guide is available here:

Assign or delete rights

For Local IdPs, you can also send information about groups of rights in the locally issued token, which can then be mapped to rights in MitID Erhverv. The process is explained in detail in section 8 of the technical integration guide for Local IdP:

NemLog-in.dk: Integration with NemLog-in – Local IdP (pdf)

Display information about the Local IdP's service windows on the login page

During service windows in your Lokal IdP, you, as the organisation administrator, can display a message about them on the login page.

In MitID Erhverv, you can enter:

  • a message about the service window
  • start date and time
  • end date and time (optional).

During the service window, the message you entered in MitID Erhverv will be displayed when users attempt to log in via your Local IdP. Please note that it may take 5-10 minutes from entering the message text until the message is displayed to users.

Find "Settings": Menu > Settings.

"Local IdP" is located just above the "Notifications" menu item at the bottom of the page.

The "Local IdP" menu will expand, displaying the list of your organisation’s Lokal IdPs.

The menu provides the following 6 options:

  1. View metadata
  2. Upload metadata
  3. Edit organisations
  4. Edit Lokal IdP
  5. Configure service window
  6. Delete Lokal IdP

The "Local IdP" window will appear.

Tick the box "Service window configured."

You will enter:

  • a message about the service window
  • the start date and time
  • the end date and time (optional).

Then tap the "OK" button at the bottom of the window.

The service window information is now saved. It may take 5-10 minutes before users attempting to log in via your Local IdP see the service window message. Note that users will not be able to proceed from the login page during this time.

If you did not set an end date and time, you will need to log in to MitID Erhverv again to remove the service window message.

Related topics