Use of credentials
Performing logins with different credentials
Services 1 and 2 imply that the target applications do not perform user logins (user authentications) themselves. Instead, authentication is carried out by an internal or external Identity Provider (IdP) connected to eIAM. This is an important security aspect of the federation between identity provider, eIAM and target applications: The login is always performed on the infrastructure of the electronic identity provider. Which identity providers (IdPs) and which quality of electronic identity (QoA) a target application accepts is defined in the eIAM dossier at the integration project per target application.Infolink regarding the IdPs can be found at: eIAM list of IdPs
Infolink regarding the QoA concept can be found at: Quality of Authentication (QoA)
Credentials
Overview of the credentials available for each login method.| CREDENTIAL | FED-LOGIN with Smartcard | FED-LOGIN without Smartcard | AGOV | CH-LOGIN |
|---|---|---|---|---|
| Smartcard | ✅ (QoA60) | ❌ | ❌ | ❌ |
| FED-LOGIN Access App | ✅ (QoA50) | ✅ (QoA50) | ❌ | ❌ |
| AGOV access App | ❌ | ❌ | ✅ (QoA30/QoA50*) | ❌ |
| Security key (FIDO2) | ✅ (QoA50) | ✅ (QoA50) | ✅ (QoA30/QoA50*) | ✅ (QoA50) |
| Active Directory Single Sign-On | ✅ (QoA40) | ✅ (QoA40) | ❌ | ❌ |
| Software certificate ✅ (QoA30) | ||||
| Password with Mobile ID | ❌ | ❌ | ❌ | ❎ (QoA30/QoA50*) |
| Password with Authenticator App | ❌ | ❌ | ❌ | ✅ (QoA30/QoA40*) |
| Password with mTAN (SMS) | ❌ | ❌ | ❌ | ✅ (QoA30/QoA40*) |
| Password without second factor | ❌ | ❌ | ❌ | ✅ (QoA20) |
| Link to information source: | ||||
| e-ID** | ❌ | ❌ | ✅ (QoA50) | ❌ |
Legend:
✅ supported
❌ not supported
❎ existing registrations are supported; new registrations are no longer possible (CH-LOGIN and nHEC+)
* the higher QoA level requires identity verification
** once available
Self-service portal for credential management
