EFA Identity Provider SFM
K (Querverweise) |
K (Markup-Fehler behoben) |
||
| (Eine dazwischenliegende Version desselben Benutzers wird nicht angezeigt) | |||
| Zeile 10: | Zeile 10: | ||
{|class="wikitable" style="text-align: left; cellpadding: 10;" | {|class="wikitable" style="text-align: left; cellpadding: 10;" | ||
!Method | !Method | ||
| − | + | | colspan="2"| | |
| + | requestHPIdentityAssertion(credential Object) :<br> | ||
HPIdentityAssertion<br> | HPIdentityAssertion<br> | ||
fault AuthenticationFailedException | fault AuthenticationFailedException | ||
|- | |- | ||
| − | + | !Description | |
| colspan="2"|This method authenticates a user by means of an EFA Identity Provider. If necessary the EFA Identity Provider calls more user attributes from a HPD. A credential MUST be passed. | | colspan="2"|This method authenticates a user by means of an EFA Identity Provider. If necessary the EFA Identity Provider calls more user attributes from a HPD. A credential MUST be passed. | ||
|- | |- | ||
| − | + | !Input Parameters | |
|credential | |credential | ||
|Object which MAY be a username/password combination, a subject identifier, a health card handle, or a SAML assertion that guarantees for an authentication. | |Object which MAY be a username/password combination, a subject identifier, a health card handle, or a SAML assertion that guarantees for an authentication. | ||
|- | |- | ||
| − | + | !Return Value | |
|[[cdaefa:EFA_Security_Informationsmodell#subjectIdentity|HP Identity Assertion]] | |[[cdaefa:EFA_Security_Informationsmodell#subjectIdentity|HP Identity Assertion]] | ||
|The assertion confirms the successful authentication. | |The assertion confirms the successful authentication. | ||
|- | |- | ||
| − | + | !Preconditions | |
| colspan="2"| | | colspan="2"| | ||
# Credentials (i.e., username/password) are present. | # Credentials (i.e., username/password) are present. | ||
# The user is already registered in the identity store of the EFA Identity Provider (i.e., the identity is established). | # The user is already registered in the identity store of the EFA Identity Provider (i.e., the identity is established). | ||
|- | |- | ||
| − | + | !Sequence (Main success scenario) | |
| colspan="2"| | | colspan="2"| | ||
# The EFA Identity Provider detects whether a username password combination [WSSUsername], SAML assertion (i.e, a locally issued Guarantor Assertion), or a X.509 certificate is passed. | # The EFA Identity Provider detects whether a username password combination [WSSUsername], SAML assertion (i.e, a locally issued Guarantor Assertion), or a X.509 certificate is passed. | ||
| Zeile 36: | Zeile 37: | ||
# If the authentication was successful, the Identity Assertion is issued. Otherwise an exception is thrown. | # If the authentication was successful, the Identity Assertion is issued. Otherwise an exception is thrown. | ||
|- | |- | ||
| − | + | !Exception | |
|AuthenticationFailedException | |AuthenticationFailedException | ||
|Authentication failed due to wrong credentials. | |Authentication failed due to wrong credentials. | ||
| Zeile 48: | Zeile 49: | ||
{{NoteBox|'''Referenzen und Querverweise''' | {{NoteBox|'''Referenzen und Querverweise''' | ||
* [[cdaefa:EFA_Spezifikation_v2.0|EFA-2.0-Spezifikation]] | * [[cdaefa:EFA_Spezifikation_v2.0|EFA-2.0-Spezifikation]] | ||
| + | <nowiki></nowiki> | ||
}} | }} | ||
Aktuelle Version vom 27. Januar 2015, 10:37 Uhr
Dieses Material ist Teil des Leitfadens CDA für die elektronische Fallakte.
|
EFA Identity Provider
Bitte markieren Sie Kommentare zu diesem Abschnitt mit dem Code {Edtie.01}
Die Authentisierung ist der initiale Schritt eines Clients (EFA-Teilnehmer), um einen EFA Sicherheitskontext zwischen Client und EFA-Provider aufzubauen. Ein Client, der sich gegenüber einen EFA Identity Provider (über die OpenContext-Operation) authentisiert, muss dazu Credentials für seine behauptete Identität vorlegen, welche serverseitig überprüft werden.
Der EFA Identity Provider bietet als Schnittstelle zum Client nur eine Operation zur Authentifizierung an. Da der EFA Identity Provider ist als Sicherheitstokendienst deployt ist, erstellt er bei positiver Authentifizierung einen Nachweis als Sicherheitstoken, nämlich die HP Identity Assertion. Die EFA 2.0 Spezifikation macht keine spezifischen Vorgaben, wie das Protokoll ausgestaltet ist. Als Vorgabe gilt hingegen das IHE-Profil Cross-Enterprise User Assertion (XUA), welches ein Binding auf das SAML- oder WS-Tust-Protokoll spezifiziert (siehe EFA Identity Assertion SAML2 Binding). Der Authentifizierungsnachweis kann weitere Attribute eines EFA-Teilnehmers aus einem Healthcare Provider Directory (HPD) enthalten, welche später für eine Zugriffskontrolle genutzt werden.
| Method |
requestHPIdentityAssertion(credential Object) : | |
|---|---|---|
| Description | This method authenticates a user by means of an EFA Identity Provider. If necessary the EFA Identity Provider calls more user attributes from a HPD. A credential MUST be passed. | |
| Input Parameters | credential | Object which MAY be a username/password combination, a subject identifier, a health card handle, or a SAML assertion that guarantees for an authentication. |
| Return Value | HP Identity Assertion | The assertion confirms the successful authentication. |
| Preconditions |
| |
| Sequence (Main success scenario) |
| |
| Exception | AuthenticationFailedException | Authentication failed due to wrong credentials. |
 |
Referenzen und Querverweise |
