...
| Table of Contents | ||||
|---|---|---|---|---|
|
Authorisations generated in the Suomi.fi service by users can be imported to the ID Authorisations system.
Pre-requisites
A person or company (the “Principal”) has created an authorisation at Suomi.fi, granting the User (the “Delegate”) ability to do something.
The User has signed in to your Service using OIDC. You have their access token.
At this time the knowledge of the authorisations Authorisation data is located only at the suomi.fi service. It needs to be retrieved from thereThe User must transfer it to the ID service.
Create
...
clickable buttons to retrieve the Authorisations
TODO
...
On behalf of another person
Create a form which makes a POST request to the URL https://id.example.com/api/suomi.fi/valtuudet/hpa with form parameters:
Form parameter | Value |
|---|---|
| User’s access token |
| URI where user will be directed after successfully retrieving the Authorisations |
| URI where user will be directed if they cancel the operation or it fails for other reasons. |
The Success and Failure URIs must be pre-registered on the ID service. This can be done in the Management UI, System Preferences, Suomi.fi / Authorisations, Allowed redirect URLs.
On behalf of a company
Use the URL https://id.example.com/api/suomi.fi/valtuudet/ypa, otherwise works the same as above.
Simple example
| Paste code macro | ||||
|---|---|---|---|---|
| ||||
<!DOCTYPE html>
<html>
<head>
<meta charset="ISO-8859-1">
<title>Authorisations example</title>
</head>
<body>
<h1>Authorisations example</h1>
<p>Click one of the below buttons to continue.</p>
<form action="https://id.example.com/api/suomi.fi/valtuudet/hpa" method="post">
<input type="hidden" name="access_token" value="pctOdyzJxIn1jrfg368Gy8Ln1nmVyxyu9">
<input type="hidden" name="successRedirectUri" value="https://example.com/hpa_success" >
<input type="hidden" name="failureRedirectUri" value="https://example.com/hpa_failure" >
<input type="submit" value="Henkilön puolesta asiointi">
</form>
<form action="https://id.example.com/api/suomi.fi/valtuudet/ypa" method="post">
<input type="hidden" name="access_token" value="pctOdyzJxIn1jrfg368Gy8Ln1nmVyxyu9">
<input type="hidden" name="successRedirectUri" value="https://example.com/ypa_success" >
<input type="hidden" name="failureRedirectUri" value="https://example.com/ypa_failure" >
<input type="submit" value="Yrityksen puolesta asiointi">
</form>
</body>
</html> |
Have the User activate the
...
buttons in their web browser
Show the link buttons to the user as a clickable link or button, User and instruct the User to activate iton of them.
User experience after clicking the
...
button
The User’s web browser will go through the ID service, then be redirected to suomi.fi pages where they will likely have to identify themselves using bank credentials or other means.
...
They will be redirected to the ID service where they will see another confirmation dialog. [WHY????]
Finally they will be redirected to the success URL.
Retrieving Authorisation data
After being redirected to the Success URL, a copy of the Authorisation data is retrievable from the ID service’s Authorisations API.
Figuring out who created the Authorisation
See example in Authorisations API on how to retrieve active Authorisations granted to a specific user.
For each Authorisation record, see the subject.type and subject.value properties. The type should be User and the value is the User ID of the person or company who granted the Authorisation.
Look up this Principal User account using the User API: GET /api/rest/v1/user/{userId}
The personalIdentityCodes property will hold an array of objects. Their identityCode value is the user’s personal identity code (“henkilötunnus”).