Technical Information

Setting Up a SAML Application

To activate your SAML integration, HIN requires the following information:

• Issuer of your AuthnRequests
• Certificate for verifying the signatures of your messages

These can be provided via the Certificate Portal or to the HIN representative during onboarding.

Issuer

The issuer used is used by the HIN IDP to determine the permitted certificate and must therefore be unique. To avoid naming collisions with existing SPs, we recommend using a URI as the issuer. Please note that your test applications must also have their own issuer value or use the same certificate as your production application (not recommended by HIN).

Certificate

Requests and responses are digitally signed. The application provider must verify the signature of the response and provides its own certificate via the Certificate Portal (certportal.hin.ch).

• A self-signed certificate is possible; a CA-signed certificate is recommended.
• The expiry date is the responsibility of the certificate issuer.
• The IDP certificate expires every 6 months; HIN notifies registered email addresses three months in advance and continuously updates the metadata.
• For uninterrupted operation, HIN recommends a SAML library that supports multiple certificates simultaneously.

The current IDP certificates can be found in the Metadata.

Bindings

The supported bindings can be found in the metadata.

Session Handling

Session management is entirely the responsibility of the application provider. There is currently no platform-wide logout mechanism.

Note: The HIN Client supports multiple users. When switching identities, an existing session remains valid.

Security

All connections — between user and application as well as between user and HIN IDP — must be secured via HTTPS. The application provider is responsible for protecting their own application (e.g. WAF).