eHerkenning external IDP
eHerkenning is the digital identity schema that the Dutch government uses to identify representatives of organizations. It provides a mandate schema where organizations can designate individuals to authenticate and act on behalf of their organization. It can be used to identify, authenticate, and authorize designated users for eligible organizations.
eHerkenning is available as a standard identity provider (IDP) in the Identity Broker and can be used in onboarding processes. Availability is restricted to eligible organizations in the Netherlands.
The eHerkenning IDP is a Security Assertion Markup Language (SAML) implementation that is relevant only for the Netherlands. It follows the procedure for adding a SAML IDP, except some values are preset.
The eHerkenning connection provides access to eHerkenning and to eIDAS (via the Netherlands (NL) node). The identity broker supports the DV-HM interface, which means that you need a connection to an eHerkenning makelaar (broker). The DV-HM interface is standardized, so the identity broker is able to connect to all eHerkenning makelaars:
- OneWelcome
- Signicat
- Digidentity
- KPN
Request eHerkenning from an eHerkenning makelaar
You need to request DigiD for each brand.
Request an OIN
You can can check the OIN register.
Request PKI-overheid certificates
- Request a unique PKI-overheid certificate for each connection. You need a different certificate for production and non-production.
You can use a server certificate with a maximum validity of three years. The OIN is included in the certificate serial number.
Generate the service catalog
You need to manually create a new service catalog file for a new service or when switching the broker.
You can check the aggregated eHerkenning catalog to see if a service is already registered:
To create a new file, to fill this XML:
HerkenningsmakelaarId reference table
To fill the HerkenningsmakelaarId, use this table:
| Broker | HerkenningsmakelaarId | Pre-production metadata | Production metadata | Contact email address |
|---|---|---|---|---|
| OneWelcome | 00000003520354760000 |
Pre | Prod | eherkenningsupport@onewelcome.com |
| Signicat | 00000003244440010000 |
Pre | Prod | technicalsupport@signicat.com |
| Digidentity | 00000003273226310000 |
Pre | Prod | eid@digidentity.com |
| KPN | 00000003271247010000 |
eidsupport@kpn.com |
Sample eHerkenning
Sample eIDAS
Test accounts for pre-production
The eHerkenning broker can help get test accounts in the pre-production environment.
Configure eHerkenning in the identity broker
Typically, you provide these identity provider details for eHerkenning:
- Display name: eHerkenning (for example)
- Active: Select the check box
- Metadata URL: The metadata URL for production or pre-production from the HerkenningsmakelaarId reference table
- Entity ID (identity provider): Automatically filled when you click Load next to the metadata.
- Entity ID (service provider): The entity ID of the connection follows this structure:
urn:etoegang:DV:<OIN>:entities:<index>. The<index>is a number between 0 and 8999 that you can select to define different connections. Numbers between 9000 and 9999 are reserved for test systems. Source. - Signing key pair: Your PKO-o certificate (both private and public part)
- Encryption key pair: Your PKO-o certificate (both private and public part)
- Single logout: Do not select the check box
Variants
You always need at least one variant. If you use multiple services or want to connect eHerkenning and eIDAS under a single connection, you need two. You can add as many as you need as long as they have unique names.
Variant for eHerkenning
- Variant name: eHerkenning (for example)
- Service Catalog ID:
urn:etoegang:DV:<OIN>:services:<Service Index>. This is the ServiceID of the ServiceInstance as defined in that service catalog. - Force authentication: Select the check box
- Variant flavour: eHerkenning
- Authentication context class reference: EH2+ or higher, it must match the Loa of the service in the service catalog.
Variant for eIDAS
- Variant name: eIDAS (for example)
- Service Catalog ID:
urn:etoegang:DV:<OIN>:services:<Service Index>. This is the ServiceID of the ServiceInstance as defined in that service catalog. - Force authentication: Select the check box
- Variant flavour: eIDAS
- Authentication context class reference: Low or higher, it must match the Loa of the service in the service catalog.
- eIDAS environment: Select either Production or Preproduction. It must match the environment used for the IDP metadata.
- Decryption keys: The eHerkenning makelaar provides these keys after you provide the SAML SP metadata and the service catalog.
