Cross-Enterprise User Assertion (XUA) Profile

From IHE Wiki
Jump to navigation Jump to search

Introduction

This is a draft of the Cross-Enterprise User Assertion Profile (XUA) supplement to the ITI Technical Framework. This draft is a work in progress, not the official supplement or profile.

Profile Abstract

The Cross-Enterprise User Assertion Profile (XUA) provides the user identity in transactions that cross enterprise boundaries. Enterprises may choose to have their own user directory and their own unique method of authenticating the users, they may even choose to use a third party. To provide accountability in these cross enterprise transactions there is a need to identify the requesting user in a way that the receiver can make access decisions and proper audit entries.

Glossary

XUA
Cross-Enterprise User Assertion (Formerly Cross-Enterprise User Authentication)

Issue Log

See Cross-Enterprise User Assertion - Discussion

Volume I

Add the following bullet to the list of profiles
  • Cross-Enterprise User Assertion - provides the user identity in transactions that cross enterprise boundaries. Enterprises may choose to have their own user directory and their own unique method of authenticating the users, they may even choose to use a third party. To provide accountability in these cross enterprise transactions there is a need to identify the requesting user in a way that the receiver can make access decisions and proper audit entries.

Dependencies

Add the following row(s) to the list of dependencies
Integration Profile Dependency Dependency Type Purpose
Cross-Enterprise User Assertion

Cross-Enterprise User Assertion

The Cross-Enterprise User Assertion Profile (XUA) provides a trustable user identity for transactions that cross enterprise boundaries. The user identities may be centrally managed, or distributed.

There are transactions defined by IHE that cross enterprise boundaries. The existing IHE mechanisms to provide an authenticated user identity (EUA) will not function in cross-enterprise transactions. Further in a cross-enterprise environment it is more likely that the transactions will be going between two enterprises that maintain their own independent user directories (PWP). This problem is the same focus of the OASIS-SAML standard. This standard has received much attention and support by the security and the platforms industry. This standard allows for centralized user directory, but also supports the more powerful federation of user directories. This standard supports many methods of user authentication (password, biometrics, smartcard) and can include details about the method(s) used.

The solution proposed is to leverage SAML and the various profiles from W3C, OASIS, and WS-I. In this way we will be able to take advantage of the vast experience of the communities outside of healthcare standards. This profile will be leveraging the experience of a few programs around the globe that have started work with SAML in healthcare. Most of these projects are applying SAML to XDS as we expect to be doing in the first year.

Discussion about the creation of this profile can be found at Cross-Enterprise User Assertion - Discussion

Use Cases

This profile will likely take two years to fully fill out. In the first year we will be focusing only on the consumption side of XDS, specifically the Registry Stored Query and Retrieve Document transactions. The motivator for this is that these are the most exposed transactions that IHE has defined; their use is expected to be from a wide variety of consuming applications and enterprises.

  1. Country that provisions users into a single assigning authority domain and handles all user authentication requests
  2. Region that knits together many competing hospitals and clinics where each hospital/clinic manages their own users.
  3. Patient that wishes to use their ISP as their authentication authority uses a PHR like application to access their own information in XDS.
  4. Hospital issues identity badges with picture and name printed, RFID for building access, and smart-card for strong authentication
  5. Small clinic in a rural setting supports a dozen users using passwords.
  6. General practice doctor retrieving results of a test performed by an outpatient clinic.
  7. Patient has requested that a named doctor not be given access to their documents.
  8. Outpatient clinic retrieving request to perform a test and background information necessary.
  9. Doctor in an emergency situation request to retrieve documents that would under normal conditions would not be accessible because the privacy consent (BPPC) has restricted access
  10. System, based on a scheduled procedure, pre-fetches the available documents so that it can determine a relevant few documents to offer to the doctor when the patient arrives.
  11. Access of a document by an individual that can’t be identified because the SAML-IDP (X-Assertion Provider) is not accessible

Actors/Transaction

File:At.jpg
Cross-Enterprise User Assertion Actor Diagram
Actor Transaction Opt. Section
Cross-Enterprise User Assertion Actors and Transactions
Actor 1 Transaction 1 R #Transaction 1

Options

Actor Option Section
{{{1}}} Options
Actor 1 Option 1 #Option 1

Option 1

A description of option 1.

Grouping

Process Flow

Cross-Enterprise User Assertion Process Flow

More text about process flow

Actor Definitions

  • X-Assertion Provider – This is a SAML Identity Provider (IDP), and is not further specified by IHE.
  • X-Service User – This is the system making a web-services request. In the first year this is the XDS-Document Consumer Actor.
  • X-Service Provider – This is the system providing the web-service. In the first year this is the XDS-Document Registry and XDS-Document Repository Actors.

Transaction Definitions

Transaction
Definition

Volume II

Transaction 1

Scope

Use Case Roles

[[image:ucr.jpr|frame|center]

Actor
Actor 1
Role
Role of Actor 1

lather, rise and repeat for each actor

Referenced Standards

Normative -- required to use this profile

Informative -- assist with understanding or implementing this profile

Interaction Diagram

File:Int.jpg

Message 1 of Interaction

Trigger
Message Semantics
Expected Actions
Retrieved from "http://wiki.ihe.net/index.php?title=Cross-Enterprise_User_Assertion_(XUA)_Profile&oldid=3511"