SAML- security token

each value in SAML has certain source. This document focus is trying to identify source of these elements i SAML-token, provided by HelseID SAML service in Norsk helsenett

There are following sources to information, published in SAML

• "saml_claim", provided in request to SAML-endpoint provided by requestor who transforms JWT to SAML
• "claim", provided in JWT security token by HelseID service which provided by service consumer and token is forwarded unchanged as header to SAML-endpoint
• "claim_assertion" in JWT security token, provided by service consumer to HelseID end user known as "helsepersonellets attest"

There are 3 versions mentioned:
1.0 - Version "1.0" of SAML-specification, used in norwegian document exchange, defined by Direktoratet for e-helse (deprecated)
2.0 - Version "2.0" of SAML-specification, reflecting neccessary changes to SAML-security token while incorporating "helsepersonellets attest" (resource attest statement)
2.1 - Version "2.1" of SAML-specification, minor adjustment of version "2.0"

There might be several sources for information provided in SAML-security token

SUBJECT (Practitioner)

<saml:Attribute Name="urn:oasis:names:tc:xacml:1.0:subject:subject-id">
  <saml:AttributeValue>_helseid://claims/identity/pid_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:npi">
  <saml:AttributeValue>_helseid://claims/hpr/hpr_number_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:ihe:iti:xua:2017:subject:provider-identifier">
  <saml:AttributeValue>
    <id xmlns="urn:hl7-org:v3" xsi:type="II" 
      extension="_nhn:tillitsrammeverk:parameters - practitioner:hpr_nr:id_" 
      root="_nhn:tillitsrammeverk:parameters - practitioner:hpr_nr:system_"
      assigningAuthorityName="_nhn:tillitsrammeverk:parameters - practitioner:hpr_nr:authority_"
      displayable="true"/>
  </saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role">
    <saml:AttributeValue>
        <Role xmlns="urn:hl7-org:v3" xsi:type="CE" 
            code="_nhn:tillitsrammeverk:parameters - practitioner:authorization:code_"
            codeSystem="_nhn:tillitsrammeverk:parameters - practitioner:authorization:system_" 
            codeSystemName="_nhn:tillitsrammeverk:parameters - practitioner:authorization:assigner_"
            displayName="_nhn:tillitsrammeverk:parameters - practitioner:authorization:text_"/>
    </saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id">
  <saml:AttributeValue>_tillitsrammeverk:parameters - practitioner:legal_entity:id_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization">
  <saml:AttributeValue>_nhn:tillitsrammeverk:parameters - practitioner:legal_entity.name_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:child-organization">
  <saml:AttributeValue>_nhn:tillitsrammeverk:parameters - practitioner:point_of_care:id_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:nhn:trust-framework:1.0:ext:subject:child-organization-name">
  <saml:AttributeValue>_nhn:tillitsrammeverk:parameters - practitioner:point_of_care.name_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:facility">
  <saml:AttributeValue>_nhn:tillitsrammeverk:parameters - practitioner:department:id_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:nhn:trust-framework:1.0:ext:subject:facility-name">
  <saml:AttributeValue>_nhn:tillitsrammeverk:parameters - practitioner:department.name_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:nhn:saml:2.0:ext:scope">
  <saml:AttributeValue>_TBD_</saml:AttributeValue>
</saml:Attribute>

<saml:Attribute Name="urn:ihe:iti:xca:2010:homeCommunityId">
  <saml:AttributeValue>_homeCommunityId_</saml:AttributeValue>
</saml:Attribute>

RESOURCE (Patient)

// oid:resource-id table:
// ----------------------
// * 2.16.578.1.12.4.1.4.1 = type of norwegian F-number
// * 2.16.578.1.12.4.1.4.2 = type of norwegian D-number
// * 2.16.578.1.12.4.1.4.3 = type of norwegian emergency number

<saml:Attribute Name="urn:oasis:names:tc:xacml:1.0:resource:resource-id">
  <saml:AttributeValue>_resource:resource-id_^^^&amp;_oid:resource-id_&amp;ISO</saml:AttributeValue>
</saml:Attribute>