Send out provisioning links from Digital Access using a bounce page

This article is valid for Smart ID 20.11 and later.

Smart ID Digital Access component supports provisioning of profiles for Smart ID Mobile App and OATH either via the administration interface or the self-service. In both cases, the provisioning message can be sent out via SMS, email or directly shown in the browser.

Unlike an email, an SMS can not contain a QR code for provisioning. Therefore, Digital Access component provides a feature called bounce page that makes it easier for users to provision profiles that are sent out via SMS.

In this case, instead of a normal provisioning URL, a bounce page URL is sent out. The bounce page URL points to the Distribution Service (through the Access Point) to render the provisioning URL as a QR code. The user can either scan the QR code with another device, or click a link to open the provisioning URL directly on the same device.

Prerequisites

Deployed Digital Access component, see here.

Step-by-step instruction

Enable distribution-service

To give access to the bounce page through the Access Point, enable the Distribution Service web resource:

In Digital Access Admin, go to Manage Resource Access.
Click configured web resource distribution-service.
Click Edit Resource Host...
In the tab General Settings check Enable resource.
In the tab Advanced Settings, select Reserved DNS mapping as Link Translation Type.
Select a Mapped DNS Name for HTTPS.
Click Save.

Enable token distribution

In Digital Access Admin, go to Manage System.
Click Distribution Services.
Select an distribution service in the list of Registered Distribution Services.
Check Enable Token Distribution.
Click Save.

Provide DNS name and port for distribution-service

In Digital Access Admin, go to Manage System.
Click Distribution Services.
Click Manage Global Distribution Service Settings...
Enter DNS name and port that will be used by clients to connect to the Distribution Server.
Click Save.

Enable bounce page for SMS

The bounce page can be enabled for provisioning SMS sent out from administration interface, during self-service provisioning or both.

To generate the bounce page URL, Digital Access component uses the DNS name and port described in the previous section.

Enable for administration interface

In Digital Access Admin go to Manage System.
Click Authentication Services.
Click Manage Global Authentication Service Settings...
In tab SMS/Screen Messages go to section OATH Authentication or Personal Authentication.
In field OATH Provisioning Message or Provisioning Message (for Personal Mobile) use variable
1. {0} to send out URL to bounce page
2. {1} to only send out provisioning URL

Enable for self-service

In Digital Access Admin, go to Manage Accounts and Storage.
Click Self Service.
Click Manage Global Authentication Service Settings...
Open tab Personal Mobile Provisioning or OATH Profile Provisioning.
In field SMS message use variable
1. {0} to send out URL to bounce page
2. {1} to only send out provisioning URL

If the distribution-service must not be available through reserved DNS mapping but only for URL mapping, the variable {0} can not be used. In this case the URL to the bounce page needs to be provided manually within the SMS text together with the provisioning URL as a parameter.

A corresponding message text could look like this:

Example: OATH authentication activation link

CODE

https://{ds-host}/https/distribution-service/message/oathbounce.html#{1}

Step-by-step instruction

Enable bounce page for SMS

Related information