The infrastructure provides a login component, which is the client systems' access to user authentication and authorization. This functionality is implemented in the Authorization Server. The login protocol between the client systems and the login component will follow the standard OpenID Connect. Authentication should be done by completing an OpenID Connect "code flow".
...
After successful authentication, three tokens are issued for separate purposes:
...
Citizen access to the eHealth Infrastructure goes through NemLogin. NemLogin provides a set of SAML attributes in a SAML assertion which is used to identify the citizen. Other attributes are also part of the SAML attribute; they are however not currently used. The table below lists the current attributes that are delivered by NemLogin:
Attribute | Description |
|---|---|
dk:gov:saml:attribute:CprNumberIdentifier | Civil registration number (CPR) |
dk:gov:saml:attribute:PidNumberIdentifier | PID number from certificate |
dk:gov:saml:attribute:AssuranceLevel | AssuranceLevel (must be 4) |
urn:oid:2.5.4.3 | Common name (full name) |
urn:liberty:disco:2006-08:DiscoveryEPR | Bootstrap token that can be used on the NSP STS to exchange to an IDWS token. |
dk:gov:saml:attribute:Privileges_intermediate | Optional. Can be used to express delegations (“digital fuldmagt”). |
Citizens accessing the eHealth Infrastructure is handled a bit differently from other users accessing the platform. As citizens do not carry a context of roles and rules, it is limited to the citizen itself and scoped by the provided SAML attributes. This means that the citizen is not able to switch context and that the citizen can only access data being scoped to him/herself. The scope of access is determined by setting the citizen in context of him/herself and not allowing context switches.
...
Clinical access to the eHealth Infrastructure goes through SEB. SEB provides a set of SAML attributes in a SAML assertion which is used to identify the clinical user.
Attribute | Description |
|---|---|
urn:oid:2.5.4.10 | Organization name |
dk:gov:saml:attribute:CprNumberIdentifier | Required from SEB. Civil registration number (CPR) |
dk:gov:saml:attribute:CvrNumberIdentifier | CVR number |
dk:gov:saml:attribute:RidNumberIdentifier | RID number from certificate |
dk:gov:saml:attribute:AssuranceLevel | AssuranceLevel (must be 4) |
urn:oid:2.5.4.3 | Required from SEB. Common name (full name) |
urn:liberty:disco:2006-08:DiscoveryEPR | IDCard |
dk:healthcare:saml:attribute:HasUserAuthorization | A boolean saying if the user has any healthcare authorizations |
dk:healthcare:saml:attribute:UserAuthorizations | A list of the users healthcare authorizations |
urn:oid:0.9.2342.19200300.100.1.1 | Required from SEB. The globally unique ID of the user within his/her organization. (also known as UID) |
dk:gov:saml:attribute:Privileges_intermediate | Required from SEB. A base64-encoded XML structure in OIO BPP format, listing privileges. If an employee should have any permissions, this attribute should define one or more roles in scope of an organizational unit or careteam, e.g. a SOR number, STS Organisation or careteam reference. See general structure in documentation[1]. [1] https://digst.dk/media/19020/oiosaml-basic-privilege-profile-1_1.pdf |
dk:healthcare:ehealth:saml:attribute:scopingOIOBPPContext | Optional. Can be used to limit scopes expressed in the OIO BPP structure, by adding it as a constraint in each PrivilegeGroup. Only PriviledgeGroups with the constraint matching the value of scopingOIOBPPContext will be available for the user. The use of scopingOIOBPPContext is not yet used and will be ignored. Can be used to support multi affiliation in the future. |
The attributes used are the CPR number (dk:gov:saml:attribute:CprNumberIdentifier), the UID and the OIO BPP format (dk:gov:saml:attribute:Privileges_intermediate). The CPR number is primarily used for delivering data to the centra NSP MinLog service. The UID uniquely identifies the user in the eHealth Infrastructure and the OIO BPP provides the roles and careteams that are accessible to the user.
...