Skip to content

Authentication and authorization

NAIS helps your applications log in users, validate inbound requests and make authenticated outbound requests using the following identity providers:

  • Entra ID (aka Azure AD)

    For employees and internal services.

  • ID-porten

    For Norwegian citizens.

  • TokenX

    For internal applications acting on-behalf-of ID-porten citizens.

  • Maskinporten

    For machine-to-machine communication between organizations or businesses.

Your application may have multiple use cases that can require a combination of services.

See the different scenarios below to identify which service(s) you need for your application, and follow the links to the respective service for more details.

Logging in users

Depending on who your users are, you can use the following services to log them in:

🧍 Log in employees Entra ID

🧍 Log in citizens ID-porten

Validating inbound requests

...from applications acting 

graph TD
  B1[on-behalf-of]
  B2[as themselves]

  B1 --> |citizens| TokenX[<a href='tokenx'>TokenX</>]
  B1 --> |employees| AAD_machine[<a href='entra-id'>Entra ID</>]
    
  
  B2 --> |internally| AAD_machine[<a href='entra-id'>Entra ID</>]
  B2 --> |externally| Maskinporten[<a href='maskinporten'>Maskinporten</a>]

The graph above can also be described as:

🧍 Validate requests from internal application acting on behalf of employee Entra ID

🧍 Validate requests from internal application acting on behalf of citizen TokenX

Validate requests from internal application Entra ID

Validate requests from external application Maskinporten

Making outbound requests

graph TD
  B1[on-behalf-of]
  B2[as application]

  B1 --> |citizens| TokenX[<a href='tokenx'>TokenX</>]
  B1 --> |employees| AAD_machine[<a href='entra-id'>Entra ID</>]
  
  B2 --> |internally| AAD_machine[<a href='entra-id'>Entra ID</>]
  B2 --> |externally| Maskinporten[<a href='maskinporten'>Maskinporten</a>]

The graph above can also be described as:

🧍 Make requests to internal API on behalf of employee Entra ID

🧍 Make requests to internal API on behalf of citizen TokenX

Make requests to internal API Entra ID

Make requests to external API Maskinporten