Suomi.fi e-Identification to deploy OpenID Connect interface – the change requires measures from e-services

Suomi.fi e-Identification to deploy OpenID Connect interface – the change requires measures from e-services 

Suomi.fi e-Identification will deploy an interface that supports the OpenID Connect protocol instead of the SAML 2.0 standard. In the change, the current SAML interface will be replaced with a new OIDC interface. The deployment of the new interface requires measures from e-services. The current SAML interface of Suomi.fi e-Identification will be discontinued after a transition period. 

New OpenID Connect interface responds to the needs of organisations better 

OpenID Connect is an authentication protocol based on the OAuth 2.0 protocol. As a result of the interface change, a trust relationship is established between the e-service and the e-Identification service by using metadata compliant with the OIDC protocol.  

The introduction of the new OpenID Connect interface responds to the needs of client organisations and provides a more modern and developer-friendly protocol. The transition to the OIDC interface will also improve security, as the change of keys will be carried out more frequently in future. 

Main changes compared to the previous interface 

SAML 2.0 and OpenID Connect have similar functionalities, but their implementation methods are different. The SAML protocol uses XML-based messages, whereas the OIDC protocol uses JSOn and JWT. 

Changing over to the OIDC interface reduces the workload involved in maintaining e-services. As a result of the changeover, the changing of SAML certificates will be discontinued. In the OIDC interface, the change of keys can be automated and metadata updates are not required. 

Read more on the OICD information page. 

The change requires measures from e-services – do as follows 

A prerequisite for the change is that the e-services using Suomi.fi e-Identification deploy the new OIDC interface in the production and testing environment of Suomi.fi e-Identification. E-services must carry out the technical deployment of the interface themselves. The workload of the deployment depends on the implementation of the e-service. The transition to the OIDC interface starts from the client test environment and then proceeds to the production environment. Inform your potential system supplier about the upcoming change and take into account the deployment of the new interface in the product development roadmap of the e-service.  

A prerequisite for the deployment of the OIDC interface is that the new details of the metadata are submitted through Service Management. We will inform you separately when the client test environment and production environment can be deployed.  We will publish instructions for the deployment of the OIDC interface on the Suomi.fi for Service Developers website and provide support for the deployment of the interface. The deployment of the OIDC interface does not require a new Suomi.fi e-Identification user permit. 

Schedule for the deployment of the OIDC interface 

The OIDC interface will be published in late 2026 in the Suomi.fi e-Identification client test environment and production environment. We will publish more detailed publication schedules separately. The deployment of the client test environment and production environment does not need to be carried out at the same time as the publication of the OIDC interfaces by Suomi.fi e-Identification. E-services can make the transition within their own schedules, taking into account the transition period of the interface change.  The e-service is responsible for testing the change before proceeding to production. 

E-services must change over to using the OIDC interface by 1 June 2028. The current SAML interface of Suomi.fi e-Identification will remain a supported interface during the transition period, and e-services can schedule their own transition to the OIDC interface within the transition period. It is advisable to start scheduling and planning the transition in your organisation immediately so that the transition of your e-service can be completed within the transition period.  

The current SAML interface will be discontinued in Suomi.fi e-Identification after 1 June 2028. After this, identification through the SAML interface will no longer work.  

We provide support for the deployment of the OICD interface 

We will organise an information event on the new OIDC interface.  You will receive an email with more detailed instructions for registering for the information event in the autumn.  We will publish instructions for the deployment of the OIDC interface and provide support for the deployment of the interface.