Session Management Overview#

Version: 1.0

This document is an overview of session management between Service Providers (SeP) and BankID.

Single Sign-On (SSO)#

BankID system allows for the SSO in the following way:

Once the End-User has logged in once, BankID may store an Identification Cookie in the User-Agent of the End-User
End-User's User-Agent will send this Identification Cookie every time BankID's Authorization Endpoint is called
This will allow BankID to show:
- A list of all available banks
- A list of currently active Bank sign-ins
If the End-User chooses to log in using one of the currently active sign-ins, BankID SHOULD include the id_token_hint in the request to the Bank.
- The Bank MAY skip the credential verification step, if it deems this secure, and only show the consent approval screen

At least: The Bank can ensure that the initial identification, which is often required for federated authentication/authorization in banking solutions, is skipped.

The "Keep me logged in" checkbox#

This feature on the side of the SeP means that the SeP will have a "Keep me logged in" checkbox on its login form. When it is checked, the SeP will make sure to ask for the Authorization Code grant, rather than the Implicit grant.

The "Switch accounts" feature#

If the End-User has already signed into a Bank, BankID will present an option to "speed-dial" the Bank with the End-User's account (using the id_token_hint mechanism). This happens during the BankID authentication process in the Bank selection phase.

However, if the End-User wishes to sign in using a different Bank (or with a different account), BankID MUST allow the End-User to do so. This could be done with a special "Switch Accounts" button or a similar UI mechanism.

The "Iframe Session state change notification" mechanism#

BankID allows for frontend state detection through an embedded /session-iframe endpoint iframe as described in the OpenID.Session document. See the following diagram to learn more about this mechanism.

Front and back channel logout#

Both logout modes are supported as specified in the OpenID.FrontChannel and OpenID.BackChannel documents.

Single Sign-On (SSO)#

BankID system allows for the SSO in the following way:

Once the End-User has logged in once, BankID may store an Identification Cookie in the User-Agent of the End-User

End-User's User-Agent will send this Identification Cookie every time BankID's Authorization Endpoint is called

This will allow BankID to show:

A list of all available banks
A list of currently active Bank sign-ins

If the End-User chooses to log in using one of the currently active sign-ins, BankID SHOULD include the id_token_hint in the request to the Bank.

The Bank MAY skip the credential verification step, if it deems this secure, and only show the consent approval screen

At least: The Bank can ensure that the initial identification, which is often required for federated authentication/authorization in banking solutions, is skipped.

The "Switch accounts" feature#