Setting the available context
In order to set the available context, the AS can be requested with a base64 encoded PrivilegeList xml document. This is enabled on a special test client with id "oio_mock".
Mocking context supports acces token requests using either refresh token or username/password.
| Pararmeter name | Description | Since vesion |
|---|---|---|
| client_id | Required. The OAuth2 client id | |
| grant_type | Required. Value ‘refresh_token’ or 'password' | |
| refresh_token (grant_type = refresh_token ) | Required. The refresh token of the current session | |
| username (grant_type = password) | Required. The username of a keycloak user. | |
| password (grant_type = password) | Required. The password of the keycloak user. | |
| oio_bpp (available context) | Optional. Base 64 encode PrivilegeList xml document | |
| practitioner_upn (available context) | Optional. An unique identifier of a Practitioner. Maps to a FHIR Practitioner resource. | |
| practitioner_name (available context) | Optianal. The name of the pratitioner. Sets the name of the FHIR Practitioner. | |
| practitioner_email (available context) | Optional. The email of the practitioner. | |
| practitioner_authcode | Optional. The authorization code of the practitioner, e. g. "FUT01" | 1.8.8 |
| practitioner_cpr | Optional. The CPR of the practitioner. | 1.8.8 |
| user_type | Optional. The user type. "SSL" or "PRACTITIONER" (default) | 1.7.8 |
| care_team_id (context) | Optional. A valid absolute FHIR URI pointing to a Careteam resource. This adds implicit organization context given the organization constraint in the OIO BPP structure | |
| organization_id (context) | Optional. A valid absolute FHIR URI pointing to an Organization resource | |
| episode_of_care_id (context) | Optional. This adds implicit patient context. A valid absolute FHIR URI pointing to an Episode of Care resource | |
| patient_id (context) | Optional. A valid absolute FHIR URI pointing to a Patient resource |
Examples of PrivilegeList:
<?xml version="1.0"?>
<PrivilegeList xmlns="http://itst.dk/oiosaml/basic_privilege_profile">
<PrivilegeGroup Scope="urn:dk:gov:saml:cvrNumberIdentifier:20921897">
<Constraint Name="urn:dk:gov:saml:sorIdentifier">eeeeeeee-b760-11e9-a2a3-2a2ae2dbcce4</Constraint>
<Constraint Name="urn:dk:sundhed:ehealth:careteam">cccccccc-b760-11e9-a2a3-2a2ae2dbcce4</Constraint>
<Privilege>urn:dk:healthcare:futTreatmentResponsible_0_3</Privilege>
<Privilege>urn:dk:healthcare:futMonitoringResponsible_0_3</Privilege>
</PrivilegeGroup>
<PrivilegeGroup Scope="urn:dk:gov:saml:cvrNumberIdentifier:20921897">
...
</PrivilegeGroup>
</PrivilegeList>
A PrivilegeList must contain at least one PrivilegeGroup with Scope = "urn:dk:gov:saml:cvrNumberIdentifier:<some number>".
Each PrivilegeGroup must contain either a constraint with Name = "urn:dk:gov:saml:sorIdentifier" or Name = "urn:dk:kombit:orgUnit", but not both.
A constraint with Name = "urn:dk:gov:saml:sorIdentifier" and value = "A" refers to a Fhir Organization resource with an identifer with system = "urn:oid:1.2.208.176.1.1" and value = "A".
A constraint with Name = "urn:dk:kombit:orgUnit" and value = "B" refers to a Fhir Organization resource with an identifer with system = "https://www.kombit.dk/sts/organisation" and value = "B".
A Privilige group may also contain a constraint with Name "urn:dk:sundhed:ehealth:careteam".
A constraint with Name = "urn:dk:sundhed:ehealth:careteam" and value = "C" refers to a Fhir CareTeam resource with an identifer with system = "urn:ietf:rfc:3986" and value = "C".
Each PrivilegeGroup must contain at least one Privilege.
Allowed privileges:
- urn:dk:healthcare:futTreatmentResponsible_0_3
- urn:dk:healthcare:futMonitoringResponsible_0_3
- urn:dk:healthcare:futMonitoringDelegate_0_3
- urn:dk:healthcare:futClinicalContentDefiner_0_3
- urn:dk:healthcare:futRequestEffectuator_0_3