Before a client system can interface with the eHealth Infrastructure a set of items must be carried out and complied with:
...
Client systems for citizens will in their (initial) login be met by NemID, which is presented via a federated login service from NemLogin. If the client system is running on a platform that supports it, it will be possible to store the RT and apply this later to resume an authenticated session, based on either pin code or biometric data. Details of this is can be read on Key Service overview, but in essence it involves selecting a PIN, registering a user / device / PIN via the Key Service, and resuming the session based on stored data and calling the Key Service.
...
| Info |
|---|
Access Tokens and Refresh Tokens are so-called "opaque tokens" but may be in JWT format. Client systems must not assume this and the format of AT and RT may change without notice. |
Determining System Roles Available in Current Context
The list of system roles available with the currently selected context can be obtained by querying the AS using a HTTP GET with the current Access token at the path /auth/realms/ehealth/protocol/openid-connect/userinfo. The following shows an example request in realm ehealth for a clinical user:
Userinfo
| Code Block |
|---|
GET https://saml.exttest.ehealth.sundhed.dk/auth/realms/ehealth/protocol/openid-connect/userinfo
Response:
{
"sub": "...",
"email_verified": true,
"cpr": "...",
"roles": [
"Service and Logistics",
"Incident Manager",
"Report User",
"Questionnaire Editor",
"Catalogue Responsible",
"Clinical Viewer",
"Care Team Administrator",
"Clinical Administrator",
"Catalogue Annotator",
"Terminology Administrator",
"Monitoring Adjuster",
"Citizen Enroller",
"Monitoring Assistor",
"Contract Responsible",
"Order Placer",
"Incident Reporter",
"Clinical Supporter"
],
"preferred_username": "...",
...
} |
The list in “roles” is the KeyCloak role names which can be mapped to system roles by doing a reverse lookup from groups, see https://ehealth-dk.atlassian.net/wiki/spaces/EDTW/pages/270991361/Switching+Context#Mapping-from-Role-to-Privileges.
Logout
To end a session, use end_session_endpoint found in the openid-configuration of the environment (e. g. : openid-configuration)
Example:
...