Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

EPD

The EPD variant of the HIN Federation Service is intended for applications that require integration with the electronic patient record (EPD). The use of the electronic patient record requires the use of Artifact Binding.

The IDP endpoint for standard SAML operations is:

https://idp.id.hin.ch/auth/realms/hinid/protocol/saml

The SAML Renew endpoint can be reached at:

https://idp.id.hin.ch/auth/realms/hinid/sts

Note: This variant differs from the standard variant in terms of binding, AuthnRequest, and response format. Use the SAML metadata for automatic configuration of your SAML library.

Application Access Flow

  1. The HIN participant accesses the application provider’s application via HTTPS. The connection is direct and independent of the HIN data centre.

  2. The application provider detects that no session exists for the accessing user within its own application, and generates a signed AuthnRequest. This is transmitted to the IDP, e.g. via Post Binding.

  3. The HIN IDP verifies the signature of the request and authenticates the user. Instead of a full response, a SAML Artifact is generated and the user’s browser is redirected — via HTTP-Redirect (with the artifact as a URL parameter) or Post Binding (as part of the POST body) — to the Assertion Consumer Service (ACS) of the application provider.

  4. The application provider sends a signed ArtifactResolve request via SOAP directly (back-channel) to the IDP to resolve the artifact. This communication takes place without involvement of the browser.

  5. The HIN IDP verifies the ArtifactResolve request and responds with a signed Response inside an ArtifactResponse envelope. The application provider verifies the signature and, if successful, creates a session. The Assertion contained in the ArtifactResponse can also be used for EPD transactions.

  6. With the generated session, the user can access the application directly.

Integration

Your application must be registered on the HIN platform before use. For more information, see Integration.