Suomi.fi OIDC Authorization Request

Choose environment. Endpoints are discovered server-side from the provider's .well-known/openid-configuration.

Tip: For implicit/hybrid responses (id_token/token) the authorization server uses URL fragment by default. This form will automatically switch the path to /oidc_callback.html when needed.
Tip: Using response_mode=form_post lets the authorization server post directly to the backend callback, so no relay page is needed. Choose fragment only if you specifically need it; it requires a minimal relay page to forward the URL fragment to the server.


OIDC Client Configurations Summary

Core / Scope / ACR Tests

1. nimbus Full scope, full ACR, RSA-OAEP-256+ES256 LoA2,LoA3,eLoA2,eLoA3,FFI,TESTI
scopes: openid eidas finnishauthenticator names domesticaddress municipality foreignaddress protectionorder mail finnishcitizenship
2. nimbus_2 No foreignaddress/protectionorder/mail LoA2,LoA3,eLoA3,FFI,TESTI
scopes: openid eidas finnishauthenticator names domesticaddress municipality
3. nimbus_3 RSA-OAEP-512 LoA2,LoA3,TESTI,FFI
scopes: openid eidas finnishauthenticator names
4. nimbus_4 Unicode/ASCII names, RS512 signer LoA3,FFI,TESTI
scopes: openid eidas finnishauthenticator names
5. nimbus_5 PS512 signer LoA2,LoA3,TESTI
scopes: openid finnishauthenticator names
6. nimbus_6 Full scope, ECDH-ES + PS256 LoA2,LoA3
scopes: openid eidas finnishauthenticator names domesticaddress municipality foreignaddress protectionorder mail finnishcitizenship
7. nimbus_7 Minimal scope FFI
scopes: openid finnishauthenticator
8. nimbus_8 EIDAS-only scope eLoA2,eLoA3
scopes: openid eidas
9. nimbus_9 Full scope, single fallback ACR TESTI
scopes: openid eidas finnishauthenticator names domesticaddress municipality foreignaddress protectionorder mail finnishcitizenship

JWKS Error Tests (10-16)