Overview#
A joint EU law enforcement operation involves officers from six member states accessing a shared intelligence platform at short notice. Issuing separate platform credentials for each officer is operationally impractical and creates a proliferation of accounts that is difficult to manage securely. The eIDAS Authentication module solves this by accepting national electronic identity credentials directly, allowing officers to authenticate with the same credentials they use for domestic government systems.
The module supports cross-border identity verification, SAML-based authentication flows, eIDAS node management, and trust service integration. European citizens, civil servants, and officials can authenticate using their national electronic identity credentials across federated deployments, with assurance level enforcement ensuring the right level of identity confidence for each operation. This satisfies compliance with eIDAS Regulation (EU 910/2014) and its implementing acts, as well as the emerging eIDAS 2.0 / EUDIW (European Union Digital Identity Wallet) framework.
Key Features#
- eIDAS Node Integration: Connect to national eIDAS nodes for cross-border identity verification, with support for both eIDAS proxy and middleware service configurations
- SAML Authentication Flows: Full SAML 2.0 support for eIDAS authentication, covering login initiation, callback handling, assertion validation, and attribute extraction from national identity providers
- SAML Signature Verification: Cryptographic validation of SAML assertions and responses with certificate management, signature algorithm enforcement, and replay attack prevention
- Cross-Border Identity Mapping: Map attributes from national identity schemes to platform user profiles, handling variations in attribute naming, format, and assurance levels across member states
- Assurance Level Enforcement: Validate that presented identities meet the required Level of Assurance (Low, Substantial, High) for the requested operation, with configurable minimum levels per resource
- Node Health Monitoring: Continuous monitoring of eIDAS node availability and response times, with automated failover to backup authentication paths when primary nodes are unavailable
- Non-Blocking Startup Synchronisation: eIDAS node metadata synchronisation runs asynchronously at service startup, preventing health check timeouts while ensuring fresh metadata is available
- Trust Service Directory: Maintain a local cache of trusted eIDAS nodes, certificates, and metadata, with automated refresh from the EU Trusted List infrastructure
Use Cases#
- European Law Enforcement Cooperation: Officers from different EU member states authenticate to shared investigation platforms using their national police identity credentials, with assurance level verification ensuring appropriate access tiers
- Cross-Border Emergency Response: Emergency responders operating across borders authenticate with their national eID to access shared situational awareness platforms during multi-national incidents
- Federated Defence Operations: Military and civilian personnel from allied nations authenticate through their national eIDAS infrastructure to access shared operational planning and intelligence systems
- Citizen Services: Public-facing services accept authentication from any EU member state electronic identity, enabling cross-border access to government services without requiring separate credential issuance
Integration#
This module connects to the platform's authentication service as an identity provider option alongside existing SSO, SAML, and OAuth providers. It feeds into the session management system for token issuance, the audit logging platform for authentication event recording, and the compliance dashboard for eIDAS regulation adherence monitoring.
Open Standards#
- eIDAS Regulation (EU) No 910/2014: The module directly implements this regulation's requirements for cross-border electronic identification, trust service interoperability, and assurance level enforcement across EU member states.
- SAML 2.0 (OASIS Security Assertion Markup Language): The core authentication protocol used for eIDAS node interactions, covering login initiation, callback handling, assertion validation, attribute extraction, and federation provider metadata synchronisation.
- OpenID for Verifiable Presentations (OpenID4VP): Used to request and receive credential presentations from EU Digital Identity Wallets (EUDIW) as an alternative to SAML-based national eID flows.
- eIDAS 2.0 / European Union Digital Identity Wallet (EUDIW) Framework: The module interoperates with the emerging EUDIW architecture, mapping wallet-issued credential assurance levels to platform access tiers.
- X.509 Public Key Infrastructure (ITU-T X.509 / RFC 5280): Certificate chain management and cryptographic validation of SAML assertions, including certificate expiry tracking, signature algorithm enforcement, and replay attack prevention.
- RFC 3161 (Internet X.509 Public Key Infrastructure Time-Stamp Protocol): Provides eIDAS-compliant cryptographic timestamping of authentication audit records via a multi-provider TSA client with failover support.
- W3C Verifiable Credentials Data Model 2.0: Used for issuing tamper-evident credential records tied to authenticated identities, supporting the EUDIW assurance and credential verification mapping defined in the compliance constants.
Availability#
- Enterprise Plan: Full eIDAS authentication suite included
- Professional Plan: Available as an add-on for organisations requiring European identity federation
Last Reviewed: 2026-03-02 Last Updated: 2026-04-14