Page Comparison

...

Once an identity has been verified with the IdP it provides a token to Tidepool’s Keycloak instance (the SP or Service Provider) that authenticates and authorizes the user to use Tidepool according to their role.

Authentication flows

SAML Federated authentication flow

...

OpenID Connect authentication flow

...

Tidepool Keycloak setup flow

1. Organization contacts clinic@tidepool.org to initiate discussion

   1. Schedule a call with organization IT/Security staff for initial discussion and requirements discovery

2. Tidepool meets with Organization IT staff to discuss details of configuration:

   1. IdP integration

   2. domains and patterns required to authenticate users

   3. process for org integration

   4. timeline and support communications

3. Organization and Tidepool Agree on timeline and ensure changes and notifications are coordinated with clinic and IT staff

4. Tidepool configures Keycloak ↔︎ IdP integration via an exchange of secure tokens and information on how to authenticate organization users. This usually consists of metadata information in a structured file or a URL pointing to an .xml file and exchanging needed service URLs and endpoint information

Differences

• Organization will manage all users and passwords internally and are responsible for onboarding and offboarding users.

• Organization will define manage security settings such as:

  • 2-Factor or Multi-factor authentication (2FA/MFA)

  • Organization level audit logging

  • Password complexity, expiration, aging

  • Login restrictions (ip address, time based, location based)

• If Organization’s user store (AD or IdP broker service) is not accessible, federated users will not be able to login to Tidepool

• Organization domain and login patterns or metadata will be verified programmatically in Keycloak and applied based on policy

Requirements

• Tidepool requires a valid email address to support the Clinic Admin authorization process

• Tidepool Keycloak supports only SP-initiated logons at this time

• SAML 2.0 or OpenID Connect compatible IdP provider

• a domain (e.g. an email domain) or other pattern that can be used to programmatically match logins

Example Identify Providers supporting SAML and/or OpenID

• Microsoft ADFS and Azure ADFS running SAML or OpenID Connect

• Ping Federate running SAML or OpenID Connect

• Auth0 running SAML or OpenID Connect

• Shibboleth

• Google Workspace

More Information on Keycloak, SAML and OpenID Connect

...