Versions Compared

Old Version 5

changes.mady.by.user John Schneider

Saved on

compared with

New Version 6

changes.mady.by.user John Schneider

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Common for both municipal and regional users is that:

  1. The Infrastructure Authorization Service (AS) redirects a login as SAML AuthNRequest to SEB

  2. SEB forwards the SAML AuthNRequest to municipal and regional Identity Providers (IdP), respectively.

    1. As apparent in Federated Authentication and Authorization for Municipal Users and Federated Authentication and Authorization for Regional Users there are differences in what systems are involved.

  3. What is returned to SEB and the Infrastructure AS is a SAML AuthNResponse conforming to OIO BPP

Info

Technically speaking, authorization is performed in the Infrastructure Authorization Service while the municipal and regional IdP provide claims. In effect, however, the IdPs provide the decisions behind the authorization in the form of system roles.

...

The PrivilegeGroups provided in the OIO BPP must be unique in accordance with by the following scheme:

The combination of CVR number (scope) sorIdentifer(regional)/orgUnit(municipal) (and careteam must be unique). Failing to comply with this may result in errors. This scheme is to ensure that users cannot have multiple different privileges stated differently. Do note that it is possible to list multiple (valid) privileges in any given PrivilegeGroup.