Client to the ehealth infrastructure should implement an OpenID Connect "code flow" in order to login and get a set of tokens.
Clients must be created in the login server and assigned a name.
Clients can be either confidential (like a server application) or public (like an app or a web application). Confidential clients authenticate themselves with a password. Public client must use PKCE (pronounced "pixi"). Explanations can be found many places, for instance here.
The loginserver of the infrastructure will delegate parts of the login to other servers, but that is transparent for the client (provided the login is handled by a generic browser window that can handle redirects).
Employee logins
For employees it is expected that the total login flow will look somewhat like this. Details can vary depending on the organization of the user (region, municipality or service/support/logistics organization).
Citizen logins (first time)
For citizens, a similar login flow could look like this:
...