Security and penetration testing — digital wallet, MinID and eFormidling
— Remote · Oslo · Published: Oct 12, 2026 · Application deadline: Oct 20, 2026
About the assignment
Digitaliseringsdirektoratet (Norwegian Digitalisation Agency, Digdir) is seeking a security test of the national sandbox for the digital wallet and a new MinID-pluss app, as well as a penetration test of eFormidling. The assignment covers testing of the entire ecosystem around eIDAS2-based solutions, including the relying party register, trusted lists, Bevisporten, VP-service and onboarding/authentication in minid-pluss. eFormidling has recently moved to newer versions of Java and Spring Boot, and a security audit is required of the distributed integration point, central components and the KOSMOS app. An approved final report must be delivered by 18 December 2026, with an option for further consulting services on an hourly basis until 30 June 2027.
Responsibilities
- Penetration test the relying party register, including UI and API, for technical and functional vulnerabilities and access control
- Test that the trusted lists in the sandbox maintain integrity and cannot be manipulated
- Penetration test Bevisporten (OAuth2 server, core issuance component, status service) for functional and logical vulnerabilities
- Penetration test the VP-service used by MinID for authentication
- Security test the minid-pluss app's backend, frontend/UI (Android/iOS), onboarding process, credential sharing, key management and detection of fake app instances
- Carry out vulnerability analysis and penetration testing of eFormidling's distributed integration point, central components and KOSMOS app, including endpoints, onboarding, key management, detection of fake integration points and the customer logging solution
- Prepare and deliver an approved final report by 18 December 2026
Required skills
- Knowledge of the digital wallet, MinID and eFormidling
- Relevant expertise in eIDAS2
- Relevant expertise in OAuth2
- Relevant expertise in Spring Boot
- Relevant expertise in Java
- Relevant expertise in React
- Relevant expertise in JavaScript
- Relevant expertise in KOSMOS