cdaefa:EFA WS Trust Policy Provider - Versionsgeschichte

Jcaumanns: Markup-Fehler behoben

2015-01-26T16:12:17Z

Markup-Fehler behoben

Jcaumanns: Querverweise

2015-01-14T13:48:38Z

Querverweise

Jcaumanns: Querverweise

2015-01-14T13:45:49Z

Querverweise

Jcaumanns: /* Example */ Fixed error in example.

2014-12-14T22:04:54Z

‎Example: Fixed error in example.

Jcaumanns: /* Example */ Fixed error in example.

2014-12-14T22:03:29Z

‎Example: Fixed error in example.

Jcaumanns: WS-Trust-Binding für issueAccessToken hinzugefügt.

2014-11-14T17:01:08Z

WS-Trust-Binding für issueAccessToken hinzugefügt.

Jcaumanns: Redundantes entfernt.

2014-11-13T18:24:13Z

Redundantes entfernt.

Jcaumanns: Expected Actions und Response Message ergänzt

2014-11-12T17:56:27Z

Expected Actions und Response Message ergänzt

Jcaumanns: Constraints on RST ergänzt.

2014-10-27T14:38:15Z

Constraints on RST ergänzt.

Jcaumanns: /* Constraints and Extensions to the Request Message (RST) */

2014-10-20T19:34:09Z

‎Constraints and Extensions to the Request Message (RST)

@@ Zeile 179: / Zeile 179: @@
 {{NoteBox|'''Referenzen und Querverweise'''
 * [[cdaefa:EFA_Spezifikation_v2.0|EFA-2.0-Spezifikation]]
 }}

@@ Zeile 13: / Zeile 13: @@
 The actor EFA Context Manager SHALL be implemented as Requestor in terms of the ''WS Services Trust Model''.
-== EFA WS-Trust Binding: requestPolicy ==
+=== EFA WS-Trust Binding: requestPolicy ===
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02}</tt>
 This section defines the technical binding for the operation ''requestPolicy''.
-=== Request Message ===
+==== Request Message ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.01}</tt>
@@ Zeile 37: / Zeile 37: @@
 {{WorkBox|The binding for values of consentInfo is under reconciliation.}}
-==== Example ====
+===== Example =====
 <syntaxhighlight lang="xml">
 <wst:RequestSecurityToken
@@ Zeile 66: / Zeile 66: @@
 </syntaxhighlight>
-=== Expected Actions ===
+==== Expected Actions ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.02}</tt>
@@ Zeile 79: / Zeile 79: @@
 The STS responds with the EFA Policy Assertion.
-=== Response Message (Full Success Scenario) ===
+==== Response Message (Full Success Scenario) ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.03}</tt>
 The response message SHALL be a WS-Trust response with a RequestSecurityTokenResponseCollection element in the SOAP-Body. It contains exactly one RequestSecurityTokenResponse element.
-=== Response Message (Failure or Partial Failure Scenario) ===
+==== Response Message (Failure or Partial Failure Scenario) ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.04}</tt>
 The response message SHALL be a SOAP Fault. The message should conform to the section Error Handling of WS-Trust 1.3.
-=== Security Audit Considerations ===
+==== Security Audit Considerations ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.05}</tt>
 See [[cdaefa:EFA_XDS_SecurityConsiderations|Security Considerations]].
-== EFA WS-Trust Binding: issueAccessToken ==
+=== EFA WS-Trust Binding: issueAccessToken ===
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.03}</tt>
 This section defines the technical binding for the operation ''issueAccessToken''.
-=== Request Message ===
+==== Request Message ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.03.01}</tt>
@@ Zeile 119: / Zeile 119: @@
 :The value of ecrRef.patientID MUST be encoded with the [[ihecb:IHE-XACML_Binding#Patient_ID_2|IHE-XACML Binding for Folder.patientId]].
-==== Example ====
+===== Example =====
 <syntaxhighlight lang="xml">
 <wst:RequestSecurityToken
@@ Zeile 148: / Zeile 148: @@
 </syntaxhighlight>
-=== Expected Actions ===
+==== Expected Actions ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.03.02}</tt>
@@ Zeile 157: / Zeile 157: @@
 The STS responds with the access token.
-=== Response Message (Full Success Scenario) ===
+==== Response Message (Full Success Scenario) ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.03.03}</tt>
 The response message SHALL be a WS-Trust response with a RequestSecurityTokenResponseCollection element in the SOAP-Body. It contains exactly one RequestSecurityTokenResponse element.
-=== Response Message (Failure or Partial Failure Scenario) ===
+==== Response Message (Failure or Partial Failure Scenario) ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.03.04}</tt>
 The response message SHALL be a SOAP Fault. The message should conform to the section Error Handling of WS-Trust 1.3.
-=== Security Audit Considerations ===
+==== Security Audit Considerations ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.03.05}</tt>

← Nächstältere Version		Version vom 14. Januar 2015, 13:45 Uhr
Zeile 172:		Zeile 172:
	See [[cdaefa:EFA_XDS_SecurityConsiderations\|Security Considerations]].		See [[cdaefa:EFA_XDS_SecurityConsiderations\|Security Considerations]].

−	~~== Querverweise und Referenzen ==~~

		+
		+	----
		+
		+
		+	{{NoteBox\|'''Referenzen und Querverweise'''
	* [[cdaefa:EFA_Spezifikation_v2.0\|EFA-2.0-Spezifikation]]		* [[cdaefa:EFA_Spezifikation_v2.0\|EFA-2.0-Spezifikation]]
		+	}}

@@ Zeile 130: / Zeile 130: @@
      AttributeId="urn:ihe:iti:xds-b:2007:patient-id"
      DataType="urn:hl7-org:v3#II">
-  <xacml-context:AttributeValue>
+    <xacml-context:AttributeValue>
-    <hl7:InstanceIdentifier
+      <hl7:InstanceIdentifier
-      extension="6578946"
+        extension="6578946"
-      root="1.3.6.1.4.1.21367.2005.3.7"/>
+        root="1.3.6.1.4.1.21367.2005.3.7"/>
-  </xacml-context:AttributeValue>
+    </xacml-context:AttributeValue>
    </xacml-context:Attribute>
    <xacml-context:Attribute
-     AttributeId="urn:oasis:names:tc:xacml:2.0:resource:resource-id"
+     AttributeId="urn:ihe:iti:xds-b:2007:folder:code"
-     DataType="http://www.w3.org/2001/XMLSchema#string">
+     DataType="urn:hl7-org:v3#CV">
-  <xacml-context:AttributeValue>1.3.6.1.4.1.21367.2005.3.7.3670984664</xacml-context:AttributeValue>
+    <xacml-context:AttributeValue>
    </xacml-context:Attribute>
 </wst:RequestSecurityToken>

@@ Zeile 48: / Zeile 48: @@
      AttributeId="urn:ihe:iti:xds-b:2007:patient-id"
      DataType="urn:hl7-org:v3#II">
    <xacml-context:AttributeValue>
-     <hl7:InstanceIdentifier
+     <hl7:CodedValue
-       extension="6578946"
+       code="K70.0"
-       root="1.3.6.1.4.1.21367.2005.3.7"/>
+       codeSystem="1.2.276.0.76.5.311"/>
    </xacml-context:AttributeValue>
    </xacml-context:Attribute>
 </wst:RequestSecurityToken>

@@ Zeile 21: / Zeile 21: @@
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.01}</tt>
-The requestor of the operation SHALL send a ''RequestSecurityToken'' message as defined in ''WS-Trust 1.3''. The format of the message SHOULD be ''SOAP Version 1.2''.
+The requestor SHALL send a ''RequestSecurityToken'' message as defined in ''WS-Trust 1.3''. The format of the message SHOULD be ''SOAP Version 1.2''.
 As for the ''RequestSecurityToken'' element, this binding defines the following constraints and extensions:
@@ Zeile 33: / Zeile 33: @@
 ;<nowiki>/wst:RequestSecurityToken/{any}</nowiki>
 :The extensibility point is used. It holds the values for both input parameters, ecrRef and consentInfo.
-:The value of ecrRef.purpose MUST be encoded with the IHE-XACML Binding for [[ihecb:IHE-XACML_Binding#Code|IHE-XACML Binding for Folder.codeList]].
+:The value of ecrRef.purpose MUST be encoded with the [[ihecb:IHE-XACML_Binding#Code|IHE-XACML Binding for Folder.codeList]].
-:The value of ecrRef.patientID MUST be encoded with the IHE-XACML Binding for [[ihecb:IHE-XACML_Binding#Patient_ID_2|IHE-XACML Binding for Folder.patientId]].
+:The value of ecrRef.patientID MUST be encoded with the [[ihecb:IHE-XACML_Binding#Patient_ID_2|IHE-XACML Binding for Folder.patientId]].
 {{WorkBox|The binding for values of consentInfo is under reconciliation.}}
@@ Zeile 65: / Zeile 65: @@
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.02}</tt>
-The STS SHALL authenticate the requester by validating the SOAP security header and the EFA Identity Assertion. If the authentication fails the STS responds with a fault code.
+The STS SHALL authenticate the requester by validating the SOAP Security Header and the EFA Identity Assertion. If the authentication fails the STS responds with a SOAP Fault message.
 The STS retrieves a matching subject access policy from its policy repository. A subject access policy matches
@@ Zeile 87: / Zeile 87: @@
 === Security Audit Considerations ===
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.05}</tt>
 See [[cdaefa:EFA_XDS_SecurityConsiderations|Security Considerations]].

@@ Zeile 20: / Zeile 20: @@
 !Actor
 |EFA Policy Provider
-|Security Token Service
+|WS-Trust Security Token Service (STS)
 |-
 !Transaction
@@ Zeile 34: / Zeile 34: @@
 Such retrieval of an ECR access policy from an ECR provider's Policy Provider service is bound to the OASIS WS-Trust 1.3 ''RequestSecurityToken (RST)'' and ''RequestSecurityTokenResponse (RSTR)'' messages. This EFA binding introduces extensions and restrictions on the respective WS Trust 1.3 definitions.
-=== Constraints and Extensions to the Request Message (RST) ===
+=== Request Message ===
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.01}</tt>
@@ Zeile 41: / Zeile 41: @@
 The request message implements a SOAP message including a single RST element as specified in [WS-Trust 1.3] considering the following constraints and extensions:
-{|class="wikitable"
+;<nowiki>/wst:RequestSecurityToken/wst:TokenType</nowiki>
-!OASIS WS-Trust	1.3
+:This element is required. The value SHOULD be "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0".
-The value of ecrRef.purpose MUST be encoded with the [[ihecb:IHE-XACML_Binding#Code|IHE-XACML Binding for Folder.codeList]].
+;<nowiki>/wst:RequestSecurityToken/wst:RequestType</nowiki>
+:This element is required. The value MUST be "http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue".
 {{WorkBox|The binding for values of consentInfo is under reconciliation.}}
 ==== Example ====
@@ Zeile 91: / Zeile 78: @@
 </syntaxhighlight>
-=== Expected Actions ===
+==== Expected Actions ====
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.02}</tt>
-...
+The STS SHALL authenticate the requester by validating the SOAP security header and the EFA Identity Assertion. If the authentication fails the STS responds with a fault code.
 === Response Message (Full Success Scenario) ===
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.03}</tt>
-If the EFA Policy Provider Service is able to decode the received message and to properly issue a policy it responds with an WS Trust 1.3 RequestSecurityTokenResponse message that carries a single ECR [[cdaefa:EFA_Security_Informationsmodell#subjectAccessPolicy|subjectAccessPolicy]].
+The response message SHALL be a WS-Trust response with a RequestSecurityTokenResponseCollection element in the SOAP-Body. It contains exactly one RequestSecurityTokenResponse element.
 === Response Message (Failure or Partial Failure Scenario) ===
 <tt>Bitte markieren Sie [[cdaefa:Kommentierung_EFAv2.0|Kommentare]] zu diesem Abschnitt mit dem Code {EWuPo.02.04}</tt>
-If the EFA Policy Provider Service provider is able to decode the received message but fails to issue the requested policy, ...
+The response message SHALL be a SOAP Fault. The message should conform to the section Error Handling of WS-Trust 1.3.
 === Security Audit Considerations ===

@@ Zeile 9: / Zeile 9: @@
 Within EFA the actors and transactions of the OASIS WS-Trust 1.3 standard are mapped onto EFA Policy Provider actors and operations as follows:
-{|class="wikitable" style="text-align: left; cellpadding: 10;"
+{|class="wikitable"
 !Role
 !EFA Policy Provider Service
@@ Zeile 41: / Zeile 41: @@
 The request message implements a SOAP message including a single RST element as specified in [WS-Trust 1.3] considering the following constraints and extensions:
-{|class="wikitable" style="text-align: left; cellpadding: 10;"
+{|class="wikitable"
 !OASIS WS-Trust	1.3
 !Optionality
 !Constraints
 |-
 |/wst:RequestSecurityToken/wst:TokenType
 |mandatory
-|SHALL be <tt>http://fallakte.de/EFAv20/token-types/subjectAccessPolicy</tt>
+|SHALL be <tt>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</tt>
 |-
 |/wst:RequestSecurityToken/wst:RequestType
@@ Zeile 58: / Zeile 54: @@
 |SHALL be <tt>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</tt>
 |-
-|/wst:RequestSecurityToken/wst: SecondaryParameters
+|/wst:RequestSecurityToken/{any}
 |mandatory
-| ...
-|-
+SHALL contain values of the parameters ecrRef and consentInfo as XACML-Attribute.
-|/wst:RequestSecurityToken/ecr:ConsentInfo
-|optional
+The value of ecrRef.purpose MUST be encoded with the [[ihecb:IHE-XACML_Binding#Code|IHE-XACML Binding for Folder.codeList]].
 ==== Example ====
-...
+<syntaxhighlight lang="xml">
 === Expected Actions ===