{"type":"doc","content":[{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"7af72605-1ca1-4704-853f-a6cbc584e033"},"schemaVersion":{"value":"1"},"title":"Excerpt"}},"localId":"901ae38e-3ab8-4ed7-95ae-0495f72a7cd4"},"content":[{"type":"paragraph","content":[{"text":"The eHealth infrastructure uses ","type":"text"},{"text":"OIOSAML Basic Privilege Profile 1_2 (digst.dk)","type":"text","marks":[{"type":"link","attrs":{"href":"https://digst.dk/media/20999/oiosaml-basic-privilege-profile-1_2.pdf"}}]},{"text":" to express user privileges as attributes in SAML Assertions. ","type":"text"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"c61b60b4-c141-44db-a0a0-e49bba9c6029"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"f5a3b99b-ad8b-458f-a2d6-5dc535bd3a83"}},{"type":"paragraph","content":[{"text":"The infrastructure also supports version 1.1, the only difference being the XML namespace of the schema:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"86e58c54-1534-404b-b91e-f2a5d59544d9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Version","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Namespace","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"1.1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"http://itst.dk/oiosaml/basic_privilege_profile","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"1.2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"http://digst.dk/oiosaml/basic_privilege_profile","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Examples of PrivilegeList:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"c33b415d-38f4-4509-9308-3d5ac8f19a5c"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"initial","rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n eeeeeeee-b760-11e9-a2a3-2a2ae2dbcce4\n cccccccc-b760-11e9-a2a3-2a2ae2dbcce4\n urn:dk:sundhed:ehealth:role:monitoring_assistor\n urn:dk:sundhed:ehealth:role:citizen_enroller\n \n \n ...\n \n","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Example of PrivilegeList without careteam","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n 48df8b3d-56be-4f3a-bd0f-d3ade05348dd\n urn:dk:sundhed:ehealth:role:clinical_administrator\n urn:dk:sundhed:ehealth:role:questionnaire_editor\n \n","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Contents of a PrivilegeList","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Municipalities MUST follow the guidelines located here: ","type":"text"},{"text":"OIO-BPP URI naming precautions for municipalities","type":"text","marks":[{"type":"link","attrs":{"href":"https://ehealth-dk.atlassian.net/wiki/spaces/EDTW/pages/948404233"}}]}]}]},{"type":"paragraph","content":[{"text":"A PrivilegeList must contain ","type":"text"},{"text":"at least one","type":"text","marks":[{"type":"underline"}]},{"text":" PrivilegeGroup with ","type":"text"},{"text":"Scope=\"urn:dk:gov:saml:cvrNumberIdentifier:\"","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"A PrivilegeGroup has the following elements:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Exactly one","type":"text","marks":[{"type":"underline"}]},{"text":" Constraint specifying an organization identifier (see Organization Constraints)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"At most one","type":"text","marks":[{"type":"underline"}]},{"text":" Constraint specifying a care team identifier (see Care Team Constraints)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"At least one","type":"text","marks":[{"type":"underline"}]},{"text":" Privilege element","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Organization Constraints","type":"text"}]},{"type":"paragraph","content":[{"text":"An organization constraint identifies an Organization resource by an external identifier and type.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are three types of organizations:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SOR organizations: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Identified by Constraints with Name attribute = \"urn:dk:gov:saml:sorIdentifier\" and value = {sor-id}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to Fhir Organization with Identifier.system = \"urn:oid:1.2.208.176.1.1\" and Identifier.value = {sor-id}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Constraint:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"950531000016003","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to Organization with: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","attrs":{"language":"json"},"content":[{"text":"\"Identifier\": [{\"system\": \"urn:oid:1.2.208.176.1.1\", \"value\": \"950531000016003\"}]","type":"text"}]}]}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"STS organizations","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Identified by Constraints with Name attribute = \"urn:dk:kombit:orgUnit\" and value = {sts-id}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to Fhir Organization with Identifier.system = \"https://www.kombit.dk/sts/organisation\" and Identifier.value = {sts-id}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Constraint:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"eeeeeeee-b760-11e9-a2a3-2a2ae2dbcce4","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to Organization with: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","attrs":{"language":"json"},"content":[{"text":"\"Identifier\": [{\"system\": \"https://www.kombit.dk/sts/organisation\", \"value\": \"eeeeeeee-b760-11e9-a2a3-2a2ae2dbcce4\"}]","type":"text"}]}]}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SSL organizations","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Identified by Constraints with Name attribute = \"urn:dk:sundhed:ehealth:sslOrg\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to Fhir Organization with Identifier.system = \"http://ehealth.sundhed.dk/organization/ssl\" and Identifier.value = {ssl-id}","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Constraint:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"aaaaaaaa-b760-11e9-a2a3-2a2ae2dbcce4","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to Organization with: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","content":[{"text":"\"Identifier\": [{\"system\": \"http://ehealth.sundhed.dk/organization/ssl\", \"value\": \"aaaaaaaa-b760-11e9-a2a3-2a2ae2dbcce4\"}]","type":"text"}]}]}]}]}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Care Team Constraints","type":"text"}]},{"type":"paragraph","content":[{"text":"A care team constraint identifies a CareTeam resource by an external identifier.","type":"text"}]},{"type":"paragraph","content":[{"text":"Care team constraints always have Name attribute = \"urn:dk:sundhed:ehealth:careteam\".","type":"text"}]},{"type":"paragraph","content":[{"text":"A care team constraint with value = {careteam-id} refers to Fhir CareTeam with Identifier.system = \"urn:ietf:rfc:3986\" and Identifier.value = {careteam-id}","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Constraint: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"cccccccc-b760-11e9-a2a3-2a2ae2dbcce4","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refers to CareTeam with: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"codeBlock","attrs":{"language":"json"},"content":[{"text":"\"Identifier\": [{\"system\": \"urn:ietf:rfc:3986\", \"value\": \"urn:uuid:cccccccc-b760-11e9-a2a3-2a2ae2dbcce4\"}]","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Privileges:","type":"text"}]},{"type":"paragraph","content":[{"text":"Allowed privileges:","type":"text"}]},{"type":"paragraph","content":[{"text":"See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://ehealth-dk.atlassian.net/wiki/spaces/EDTW/pages/291176482/Tokens+Roles+and+RBAC+ABAC#Privilege-Roles"}},{"text":" ","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Acceptance of PrivilegeList","type":"text"}]},{"type":"paragraph","content":[{"text":"This section describes different scenarios for eHealth Infrastructure acceptance of privilege lists:","type":"text"}]},{"type":"paragraph"},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n eeeeeeee-b760-11e9-a2a3-2a2ae2dbcce4\n cccccccc-b760-11e9-a2a3-2a2ae2dbcce4\n urn:dk:sundhed:ehealth:role:monitoring_assistor\n urn:dk:sundhed:ehealth:role:citizen_enroller\n \n \n ...\n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"In the same , there can be both valid and invalid PrivilegeGroups. The valid ones will still be able to be used even if the list also contains invalid ones.","type":"text"}]},{"type":"paragraph","content":[{"text":"The invalid group will be in a list of \"warnings\" in the response from Keycloak's ","type":"text"},{"text":"/contexts","type":"text","marks":[{"type":"code"}]},{"text":" endpoint to the calling system.","type":"text"}]},{"type":"table","attrs":{"layout":"default","isNumberColumnEnabled":true,"width":760.0,"localId":"4afa903e-b9de-452e-9de4-5f5f4a3270c8"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Scenario","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"Handling","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Referenced Organization does not exist in the eHealth Infrastructure","type":"text"}]},{"type":"paragraph","content":[{"text":"Example ","type":"text"},{"text":"Scope=\"urn:dk:gov:saml:cvrNumberIdentifier:20921897\"","type":"text","marks":[{"type":"code"}]},{"text":" cannot be found.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The entire ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is ignored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" are handled.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Unknown privilege in privilege group.","type":"text"}]},{"type":"paragraph","content":[{"text":"E.g.. the group contain privileges like","type":"text"}]},{"type":"paragraph","content":[{"text":"urn:dk:kombit:system_xyz:view_case","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The entire ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is ignored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" are handled.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Unknown in ","type":"text"}]},{"type":"paragraph","content":[{"text":"E.g.","type":"text"}]},{"type":"paragraph","content":[{"text":"25.*","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is ignored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" are handled.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Referenced CareTeam does not exist","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The entire ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is ignored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" are handled.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Referenced CareTeam is not active","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The entire ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is ignored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" are handled.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Reference CareTeam “from date” is in the future.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" becomes a valid context in Keycloak's ","type":"text"},{"text":"/contexts","type":"text","marks":[{"type":"code"}]},{"text":" endpoint","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Referenced sorIdentifier does not exist","type":"text"}]},{"type":"paragraph","content":[{"text":"eeeeeeee-b760-11e9-a2a3-2a2ae2dbcce4","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[423.0]},"content":[{"type":"paragraph","content":[{"text":"The entire ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is ignored.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" are handled.","type":"text"}]}]}]}]}],"version":1}