Without Identity Broker

This use case would look as follows without an Identity Broker:

Legal view

Prerequisite registration

Interaction

Description without Identity Broker

It is a prerequisite of this use case that:

• The Service Provider has and manages its own authorisation information indicating what Entitled Parties are entitled to what (parts of) services*;

• The Service Consumer has and manages its own authorisation information indicating which Human Service Consumers are authorised to act on its behalf**;

• The delegation/authorisation responsible at the Service Consumer registers the authorisation information at the Authorisation Registry;

• The Service Provider can authenticate the Human Service Consumer.

• The Identity Provider can authenticate the Service Provider.

• The Service Provider can authenticate the Identity Provider.

• The Human Service Consumer has been issued identity credentials by the Identity Provider.

• In this use case, the Entitled Party is also the Service Consumer.

*The Service Provider can outsource this function to a third party

**The Service Consumer can outsource this function to a third party

Authorisation Registry discovery logic:

The Service Provider discovers the Authorisation Registry for the specific capability in the following order. The first condition that applies, determines the location of the Authorisation Registry.

1. The Entitled Party has registered an Authorisation Registry for the specific capability in its /capabilities endpoint;

2. The Entitled Party has registered the Authorisation Registry for the specific capability in the Participant Registry;

3. The Entitled Party has registered an Authorisation Registry for a specific data space in the Participant Registry;

4. The Entitled Party's has set a default Authorisation Registry in the Participant Registry.

The use case consists of the following steps:

(Numbers are intended to explain the use case flow, it might vary from the diagram due to multiple authorisation methods)

1. The Human Service Consumer requests a service from the Service Provider.

2. The Service Provider asks the Human Service Consumer for their Identity Provider information.

3. The Human Service Consumer provides Identity Provider information to the Service Provider.

4. The Service Provider requests a login from the Identity Provider.

5. The Identity Provider requests credentials from the Human Service Consumer.

6. The Human Service Consumer provides credentials to the Identity Provider.

7. The Identity Provider authenticates the Human Service Consumer.

8. The Identity Provider provides an identity token to the Service Provider.

9. The Service Provider validates the Identity Provider’s iSHARE certification and the identity token of the Human Service Consumer.

10. The Service Provider discovers the applicable registry as described in Discovering Authorisation rules (if unknown).

11. The Service Provider validates the Human Service Consumer based on the authorisation token (Refer to methods of authorisation on how an authorisation token is obtained.

12. The Service Provider validates authorisation and iSHARE adherence of the Service Consumer.

13. The Service Provider executes the requested service and provides the service result to the Human Service Consumer.

Methods of authorisation

Diagram 1: Authorisation via Identity Provider Checking Authorisation Registry (AR)

Diagram 2: Authorisation via Identity Provider Providing ID of Authorisation Registry to the Service Provider for Discovery

Diagram 3: Authorisation via Participant Registry Verifying Service Consumer Before Authorisation Check

Sequence diagram without Identity Broker

Authorisation via Identity Provider Checking Authorisation Registry (AR)

Authorisation via Identity Provider Providing ID of Authorisation Registry to the Service Provider

Authorisation via Participant Registry Verifying Service Consumer Before Authorisation Check