HIN Federation Service – SAML Integration

The HIN Federation Service is a SAML 2.0-based authentication service for web applications. It allows the use of HIN as an authentication system (IDP), providing secure and privacy-compliant access to the entire HIN community.

The user accesses a web application connected to HIN via the Federation Service. The application detects that no authenticated session exists for the user’s client and redirects them to the HIN IDP. The user authenticates there, if no HIN-side session exists. Once a session is created in the HIN IDP, a signed assertion is generated. This contains information about the accessing identity and is transmitted to the application provider (the exact flow depends on the chosen SAML binding). The application provider can then create a session with the client. The connection between user and application subsequently runs directly, without any data flowing through the HIN data centre.

Target Audience

• Application providers: Organisations that want to make their application accessible to selected HIN users.
• Application developers and integrators: Individuals tasked with making an application available via HIN Login (HIN Identity).

Prerequisites for Using the HIN Federation Service

The following prerequisites must be met to use the HIN Federation Service:

• A service agreement between the application provider and HIN must be in place.
• Certificates must be exchanged to verify message signatures (see Certificates).
• The accessing person must have a HIN Identity.

Integration Variants

The Federation Service is offered in two variants. For configuring your SAML library, we recommend using the metadata directly: