Scenario 1

e_Health is a web portal for doctors. e_Health uses Med_Association as an external identity provider to verify whether the user is a doctor and obtain the user's professional code and specialization. Med_Association retrieves these details with the help of Access Manager Identity Server.

Med_Association completes the following steps:

  1. Write an External Attribute data extension class and use the required attribute to retrieve the professional code and specialization of the user. For more information about data extension class, see Adding Policy Extensions. For more information about data extension example code, see The Policy Extension API in the NetIQ Access Manager 5.0 SDK Guide.

  2. Create an External Attribute Source policy for the data extension.

    For more information about how to import the data extension class and configure the External Attribute Source policy in Identity Server, see External Attribute Source Policies.

  3. Define a shared secret for the professional code and specialization. For more information, see Adding Custom Attributes.

  4. Configure this shared secret for a service provider to be sent with authentication. For more information, see Configuring the Attributes Set with Authentication.

  5. The retrieved details that are professional code and specialization are sent to e_Health.

The following diagram illustrates this scenario:

Workflow:

  1. A user requests for access to e-Health through browser.

  2. e_Health redirects the user’s browser to Access Manager Identity Server at Med_Association for authentication.

  3. User logs in with providing credentials. User is authenticated with LDAP.

  4. On the successful authentication, Identity Server sends the assertion to e_Health.

  5. e_Health verifies the assertion with Med_Association by using the back channel communication.

  6. After verification, Access Manager Identity Server retrieves the attributes (professional code and specialization) from external sources (for example, database) by using the External Attribute Source policy.

  7. Identity Server returns the response containing professional code and specialization in a shared secret attribute. If the user is not a doctor, external source returns null values in the shared secret attribute in the response.

    e_Health grants access to the user if it receives valid values for the attributes in the authentication response else it denies Access.