...
The Access token is a JWT with at set of fields that explains what a user is allowed to do in combination with the applied context. The fields of the JWT are the following:
JWT | Meaning | exampleExample |
---|---|---|
preferred_username | value of SAML attribute http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | C=DK,O=TRIFORK A/S // CVR:20921897,CN=Lasse Læge-Dam,Serial=CVR:20921897-RID:93134986 |
name | value of SAML attribute urn:oid:2.5.4.3 | Lasse Læge-Dam |
jti | 2ef5b6b1-a667-40f5-b468-f475cdcef5ec | |
exp | 1556110351 | |
nbf | 0 | |
iat | 1556110051 | |
iss | ||
aud | EHealth | |
sub | 88c4feb3-f87a-43c6-9141-fc03a3944ad6 | |
typ | Bearer | |
azp | EmployeeClient | |
acr | 1 | |
auth_time | 0 | |
scope | Scope is either ehealth or nemlogin | profile openid ehealth |
realm_access | List of process privileges – eg. what is the user allowed to do in combination with the context. | "realm_access": { "roles": [ "Patient.read", "Patient.write" ] } |
context | List of items that are set in context. context in combination with items in realm_access governs the access to all resources in the ehealth infrastructure. | "context": { "organization_id" : "https://fut.com/fhir/Organization/1", "care_team_id": https://fut.com/fhir/CareTeam/4, "episode_of_care_id": https://fut.com/fhir/EpisodeOfCare/10, "patient_id": "https://fut.com/fhir/Patient/8" } |
user_id | Id of the user. Can be either a FHIR patient Id, FHIR practitioner Id or a KeyCloak Id | "user_id": " e03ccef7-b0b1-4f68-8e16-6fc2f865a922" |
user_type | Can be either SYSTEM, PATIENT, PRACTITIONER or SSL | "user_type": "PATIENT" |
...
The current list of privilege roles defined is as given in the table below.
Role name in OIO BPP | Domain | Description (non-normative) | Privileges (danish) |
---|---|---|---|
urn:dk:sundhed:ehealth:role:citizen_enroller | Clinical | Role capable of initiating episode of care and setting up careplans for Citizen |
|
urn:dk:sundhed:ehealth:role:clinical_viewer | Clinical | Role capable of viewing a citizen's demographic data, careplans and measurements. |
|
urn:dk:sundhed:ehealth:role:monitoring_assistor | Clinical | Role capable of handling measurements and communication with Citizen. |
|
urn:dk:sundhed:ehealth:role:monitoring_adjuster | Clinical | Role capable of maintaining careplans, setting up measurement regimes and reference ranges, suspending and reactivating careplans, handling communication with Citizen. |
|
urn:dk:sundhed:ehealth:role:questionnaire_editor | Administrative | Role capable of creating and maintaining questionnaires |
|
urn:dk:sundhed:ehealth:role:clinical_administrator | Administrative | Role capable of creating and maintaining plan definitions |
|
urn:dk:sundhed:ehealth:role:clinical_supporter | Support, Service & Logistics | Role capable of searching and updating communications related to support and incidents |
|
urn:dk:sundhed:ehealth:role:incident_reporter | Support, Service & Logistics | Role capable of creating and maintaining communications related to support and incidents. |
|
urn:dk:sundhed:ehealth:role:incident_manager | Support, Service & Logistics | Role capable of dispatching incidents and tracking status. |
|
urn:dk:sundhed:ehealth:role:report_user | Administrative | Role capable of generating reports for statistics and administration |
|
urn:dk:sundhed:ehealth:role:careteam_administrator | Administrative | Role capable of creating and maintaining careteams |
|
urn:dk:sundhed:ehealth:role:order_placer | Support, Service & Logistics (secondary: Clinical) | Role capable of accessing carePlans, placing orders for devices and services, maintaining orders |
|
urn:dk:sundhed:ehealth:role:service_and_logistics | Support, Service & Logistics | Role capable of processing orders for devices and services |
|
urn:dk:sundhed:ehealth:role:terminology_administrator | Administrative | Role capable of creating and maintaining terminology |
|
urn:dk:sundhed:ehealth:role:ssl_catalogue_responsible | Support, Service & Logistics | Role capable of creating and maintaining SSL catalogues |
|
urn:dk:sundhed:ehealth:role:ssl_catalogue_annotator | Support, Service & Logistics | Role capable of accessing SSL catalogues and maintaining annotations about devices |
|
urn:dk:sundhed:ehealth:role:ssl_contract_responsible | Support, Service & Logistics | Role capable of creating and maintaining SSL contracts and involved parties |
|
...