...

...

HSPC IDs SHALL be free and open for individuals to self-register, regardless of current or intended membership status. Manual approval of IDs by HSPC management SHALL NOT be required; however, email addresses MUST be verified prior to ID activation, as is acceptance of the HSPC Terms of Service agreement. A CAPTCHA SHOULD be used, as well. Usernames MUST be unique within the HSPC ID namespace. An active HSPC ID is required for:

1. Membership self-management on the website.
2. Access to digital downloads requiring RBAC.
3. Logging into the freely available public FHIR Sandbox system.
4. Marketing email list opt-in/opt-out management.
5. Access to JIRA, Confluence and Atlassian tools.
6. Usage of members-only tools and services such as the HSP Marketplace, Terminology Server and

...

1. others.
2. Restricted access to the HSPC Amazon Web Services (AWS) account.

All HSPC members and staff MUST have an HSPC ID to use any service requiring authentication. To allow for the plausibility of usernames being used for email purposes in be future, a blacklist of externally-used names SHOULD be maintained . (Ee.g. "platform@hspconsortium.org", "roadmap@hspconsortium.org" etc)

Functional Requirements

SHOULD allow for two-factor authentication in the future.

Non-Functional Requirements

• MUST be a "buy/license" product, as opposed to "build".
• SHOULD be available as a F/OSS license
• Technology

In terms of software and infrastructure, HSPC ID is an instance of Gluu Server Open Source

Implications

e

Identity Provider

. Long-term, this implies that future SaaS and on-premise services implemented by HSPC SHOULD strongly favor solutions capable of operating as an OpenID Connect resource server and/or client (preferred) or SAML relying party (also supported by this solution).

To avoid confusion and use correct semantics, the HSPC IDP " issuer " and URI/ URL SHALL be: https://id.hspconsortium.org . This URIs used for native application purposes (such as iOS, Android etc) SHALL use namespace prefix of "hspc://" where applicable. These cannot be trivially changed, and SHOULD be treated as a permanent, immutable decisiondecisions. OAuth "subject" identifiers similarly need to be treated as immutable.

Identity

...

Creation Requirements

During registration, users:

...

@hspconsortium.org email namespace

Initial Consolidation Plan

Functional Requirements

The HSPC ID System:

1. SHALL provide a web-based ID registration form for guests and members.
2. SHALL provide a web-based management GUI for staff.
3. SHALL serve as an OpenID Connect Provider (OP), and thus the core OAuth 2.0 flows.
4. SHALL support the configuration of custom scopes.
5. SHALL support OAuth 2.0 HEART extensions for User-Managed Access (UMA).
6. SHOULD support core SAML authentication/authorization flows.
7. SHOULD allow for two-factor authentication in the future that SHALL NOT be enabled at deployment time.

Non-Functional Requirements

The HSPC ID System:

• MUST be a "buy/license" product, as opposed to "build".

• MUST have a sensible release cycle for maintenance.

• MUST include sufficient technical documentation and existent community of users. 

• SHOULD be available as a F/OSS license.

• SHOULD provide an option for paid support that HSPC MAY or MAY NOT elect to purchase in the future. 

Technology

In terms of software and infrastructure, the HSPC ID System is an instance of Gluu Server, which is one of the leading fully-Open Source implementations. Gluu Server is deployed to the Platform Engineering Virtual Private Cloud on AWS and Internet accessible at https://id.hspconsortium.org.

Rough Project Tasks

1. Establish Gluu Server
   1. Set up in Platform VPC
   2. test heavily Either set up a new common IDP or use one of the existing instances.
2. Migrate HSPC Sandbox to the new IDP.
   1. Need help from Travis with this one  ... Hopefully some combination of adding the IDP configuration and migrating existing user accounts.
3. Enable AWS to support SSO login.
   1. Update AWS IAM group policies
   2. SAML probably
   3. Remove unneeded users
   4. Account for lock-out situations (since Gluu is hosted on AWS)
4. Reconfigure the WEBSITE to use the IDP in additional to local authentication.
   1. Install membership management 
5. eee

...

1. 1. Evaluate and install membership management plugin(s), such as MemberPress.
   2. Add IDP configuration
   3. Possibly relocate hosting situation
   4. Add MSP support and configure applicable hooks to IDP 
2. Migrate Marketplace to the new IDP
   1. Probably disable the Google and Microsoft login options.
   2. Re-authorize existing accounts
3. Configure terminology servers to support authenticated and authorized access.
   1. Ontoserver
   2. HAPI-FHIR
4. Document all this