According to the NemLog-in documentation for the app switch feature (9.7 Mobile app-switch), I need to add the AppSwitch property to the SAML request.

However, I am using FoxIDs as an OpenID-to-SAML service and cannot find a way to include the AppSwitch property in the requests FoxIDs generates for the third-party IdP.

It should be like:

<?xml version="1.0"?>
<samlp:AuthnRequest
ID="id9eb5dd256c25461584a2796994feab1d"
...
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:Issuer>;/saml:Issuer>
<samlp:Extensions>
  <nl:AppSwitch xmlns:nl=";>
    <nl:Platform>Android</nl:Platform>
    <nl:ReturnURL>dk.serviceprovider.test</nl:ReturnURL>
  </nl:AppSwitch>
</samlp:Extensions>
...
</samlp:AuthnRequest>

How can I achieve this?

According to the NemLog-in documentation for the app switch feature (9.7 Mobile app-switch), I need to add the AppSwitch property to the SAML request.

However, I am using FoxIDs as an OpenID-to-SAML service and cannot find a way to include the AppSwitch property in the requests FoxIDs generates for the third-party IdP.

It should be like:

<?xml version="1.0"?>
<samlp:AuthnRequest
ID="id9eb5dd256c25461584a2796994feab1d"
...
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:Issuer>https://sp3.dev-nemlog-in.dk</saml:Issuer>
<samlp:Extensions>
  <nl:AppSwitch xmlns:nl="https://data.gov.dk/eid/saml/extensions">
    <nl:Platform>Android</nl:Platform>
    <nl:ReturnURL>dk.serviceprovider.test</nl:ReturnURL>
  </nl:AppSwitch>
</samlp:Extensions>
...
</samlp:AuthnRequest>

How can I achieve this?

• saml
• foxids

1 Answer 1

You can configure app-switch as extension XML in the authentication method. You can also alternatively configure multiple profiles in a authentication method with different extension XML. Authentication method profiles can be also be selected as allowed authentication methods in your application.

Click Show advanced to add extension XML and optionally profiles.

You can redirect back to your Android app URL dk.serviceprovider.test by adding this XML as extension XML.

<nl:AppSwitch xmlns:nl="https://data.gov.dk/eid/saml/extensions">
  <nl:Platform>Android</nl:Platform>
  <nl:ReturnURL>dk.serviceprovider.test</nl:ReturnURL>
</nl:AppSwitch>

In the authentication method

or in a profile

FoxIDs documentation about connecting to NemLog-in, see section 3) - Optionally - Configure MitID app-switch to mobile app.