Authentification Flow

The client starts the login of municipal users by starting an OIDC Authentification Code Flow. The eHealth authentication server (KeyCloak) goes through a federation process and uses SEB and KOMBIT Context Handler for login in the user.

Open

The sequence diagram for clinicians' logins, explained in Guide; Client Application Login and Logout to eHealth Infrastructure | Clinical logins. This shows how the OIDC Authorization Code Flow is redirected through a series of steps involving OIOSAML-based AuthNRequest and AuthNResponse.

Here's a summary of the responsibilities of the services involved:

1. The eHealth Authorization Service (KeyCloak) - Forwards the login request as SAML AuthNRequest to the SEB and receives the SAML response from SEB. The KeyCloak service modifies and adapts KOMBIT-style SAML Attributes to ensure they match the uniform OIOSAML OIO-BPP Attributes used.

2. Sundhedsvæsenets Elektroniske Brugerstyring (SEB) - This is the shared user administration platform for the Danish healthcare sector. This forwards or federate municipality users login to the KOMBIT Context Handler.

3. The KOMBIT Context Handler forwards login to municipality IdP and creates a SAML AuthnResponse based on registrations stored in the KOMBIT user administration system STS Administration (or STS Admin or FK Admin for short).

KOMBIT Terms and Concepts

The following terms are used in registrations in “Fælleskommunalt Administrationsmodul” (KOMBIT STS Admin):

Registrations Required in Municipal KOMBIT Systems

eHealth Infrastructure as User-systems

The eHealth Infrastructure uses the KOMBIT Context Handler for access control.

Therefore the eHealth test environments are registered as user-facing systems in the FK Administration system (https://admin-test.serviceplatformen.dk/).

As the login flows through the SEB, the management of the eHealth test environments is managed by Sundhedsdatastyrelsen (Danish Health Authority).

The eHealth test environments are registered as one user-facing system in the KOMBIT external test and login goes through T-SEB for all eHealth test environments (incl. pre-prod).

A similar registration in the KOMBIT FK Administration in the KOMBIT production environment.

Data constraints (Danish: “data afgrænsninger”)

The data constraints narrow the user system role. In eHealth Infrastructure, there are two data constraints in use:

• Organisation - This is a cross-cutting data constraint identifying an Organisation from KOMBIT FK Organisation. This data constraint is defined and maintained outside eHealth.

• CareTeam - This is a system-specific data constraint identifying a CareTeam. This constraint is optional for some user system roles and required for others (see below). The data constraint is defined as follows:

  • Data Constraint Name: CareTeam

  • EntityId: http://<domain>/constraints/<filtername>/<version>

    • domain: ehealth.seb.dk

    • filtername: careteam

    • version: 1

  • type: Syntax validation

  • ([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12})+(,\s*[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12})*

The following screenshot shows the “Fælleskommunalt Administrationsmodul” user interface for creating data constraints and mandatory fields.

Open

KOMBIT User system roles for the eHealth Infrastructure

The following screenshot shows the “Fælleskommunalt Administrationsmodul” user interface for creating user system roles and mandatory fields.

User system roles for the eHealth Infrastructure are registered in KOMBIT STS Admin:

• Name: can have (and should have) a Danish name

  • The Danish designation for the corresponding eHealth Infrastructure OIO BPP system role can be found here: https://ehealth.sundhed.dk/fhir/CodeSystem-ehealth-oio-bpp-roles.html

• Shall have an EntityId on the form:

  • The <Domain> shall be ehealth.seb.dk

  • Role name and version: see table below

Mapping between KOMBIT user system role and OIO BPP role

The KOMBIT user system role has a different format than the eHealth Infrastructure OIO BPP system roles.

The following table shows the KOMBIT user system role and the corresponding OIO BPP roles.

eHealth Infrastructure user system roles for T-SEB and SEB (consolidated)

The table shows the KOMBIT user system role, the corresponding OIO BPP roles, and what data constraints are possible and which are mandatory for “T-SEB” and SEB.

Getting municipal employee CPR

To allow regional and municipal employees to access national healthcare solutions from the FUT Infrastructure their CPR information is required.