By Mikkel Hald, 14/09/26
Service providers that receive NemLog-in/MitID through WAYF can now also receive authentications from the national digital identities (eIDs) of other EEA countries. This requires neither changes to the service’s integration with WAYF nor any separate activation.
NemLog-in has now been integrated with the Danish eIDAS gateway, which connects Denmark with the national eID solutions of other countries. And WAYF has now, in close cooperation with the Danish Agency for Digital Government, as one of the first NemLog-in “brokers”, made the necessary adjustment to its integration with NemLog-in, so the functionality is already active for services that currently receive NemLog-in/MitID through WAYF.
On the NemLog-in login page, the new option appears as the “International” tab alongside “MitID” and “Local login”. Here, the user can select their home country and authenticate using a supported national eID.
This means that people with digital identities issued in other EEA countries can now identify themselves digitally to WAYF service providers through NemLog-in. There is therefore no need to establish a separate login solution for these users or wait until they obtain a Danish MitID.
The same integration – also for foreign eIDs
From the service provider’s perspective, there is no difference in the integration: the interface to WAYF remains unchanged, and if you have an integration with WAYF, you also have an integration with the eIDAS gateway.
WAYF delivers the information from the foreign authentication through the same attributes as for authentication with MitID or a Local IdP – to the extent that the relevant information is available and released as part of the foreign authentication.
When authenticating with a European eID, the service can (to the extent that it is authorised to receive the information) always expect to receive:
- given name, surname and full name in gn, sn and cn/displayName, respectively;
- date of birth and year of birth in schacDateOfBirth and schacYearOfBirth, respectively; and
- a European person identifier, either on its own or as part of eduPersonPrincipalName, which can be correlated in the Once-Only Technical System (OOTS).
Depending on which information the issuing country releases, the service may additionally receive, among other things, nationality (schacCountryOfCitizenship), country of residence (schacCountryOfResidence), gender (schacGender), postal address (postalAddress), telephone number (
In eduPersonAssurance, the service can also determine the assurance level at which the user’s identity has been established in the issuing country and authenticated – low, substantial or high.
A foreign eID can be linked to a Danish CPR number
If a foreign user has a Danish CPR number, it can be linked to the user’s national eID from their home country. This makes it possible to recognise the user by means of that eID in Danish systems where the person has already been registered using their CPR number.
The Danish Agency for Digital Government describes the process in more detail on borger.dk.
For services in WAYF, the CPR number, where available, will be delivered in the same way as otherwise, namely in the attribute schacPersonalUniqueID or norEduPersonNIN.
Relevant before, during and after affiliation with an institution
The option is particularly relevant when research and education institutions have digital contact with citizens of other European countries before, during or after their affiliation with the institution.
This may, for example, be in connection with:
- applications and admissions;
- enrolment;
- exchange and international mobility;
- employment;
- access to services before a Danish MitID has been established; or
- follow-up after the end of studies or employment.
For WAYF service providers using NemLog-in, the change therefore means that the existing integration can now be used for digital identification of a broader group of users – without the service provider having to make any changes to its existing integration.