Epic EPCS SAML integration

Application Name

Set the name of the SAML configuration for the Haiku and Canto EPCS workflow.

This displays on the Application Manager list and to end users in the login workflow.

Application Description

This is an internal description not shown to end users at login.

Upload logo

Optionally upload a logo for the Haiku and Canto EPCS workflow.

Authentication Policy

Select the login authentication policy for the Haiku and Canto EPCS workflow.

Data Stores

Enter the data stores to to authenticate and allow user access for the Haiku and Canto EPCS workflow.

Start typing to bring up a list of data store names. You can enter more than one data store.

Groups

Use one of the following options:

User ID Profile Field

Select the profile field in your data store that contains the user IDs.

For example, if the Epic Haiku and Epic Canto app login accepts a username like jsmith, you could set it to Authenticated User ID.

Otherwise, if the Epic Haiku and Epic Canto app login requires an email address, you could use another available profile like User ID, Email 1 (Work), Aux ID 1, and so on.

Note

If you select a user profile field other than Authenticated User ID, make sure you have the data store field attribute correctly mapped to an available profile property, like Email 1 (Work) set to mail.

Name ID Format

The name ID format to use for sending the SAML response.

Use the default setting, which is set to unspecified as in: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

Upload Metadata

If you have a preconfigured XML file with your SAML settings, select the Upload Metadata link at the bottom right of the page.

After the file is uploaded, review the prepopulated fields and make the necessary edits.

IdP Issuer

A unique name that must match exactly on the Identity Platform side and in the Epic database for the Epic Haiku and Epic Canto mobile apps.

This helps the Epic database identify the Identity Platform as the SAML issuer.

For example, https://idp.example.org/SAML2

Assertion Consumer Service (ACS)

Enter the endpoint URL from Epic database to let the Epic Haiku and Epic Canto EPCS workflow accept a SAML assertion from the Identity Platform.

For example, epic://sp.example.com

Relay State

Optional. User is directed to this URL after authentication.

Recipient

Optional. This field is usually the same as the consumer (ACS) URL.

For example, epic://sp.example.com

Audience

Set to a unique string that identifies the Epic database as the service provider (SP). Usually, this is the entity ID of the Epic database.

For example, https://idp.example.org/SAML2

SP Login URL

This is the login URL of the Epic database as a service provider (SP).

Usually, this is the same address the Relay State or Assertion Consumer Service (ACS) URL.

For example, https://idp.example.org/SAML2

Assertion will be valid for

Indicate in hours and minutes, how long the SAML assertion is valid.

It is referred to as SAML NotOnOrAfter in the SAML specifications.

The default setting is one hour, but for more sensitive application resources, the recommended value is between one to five minutes.

Offset Minutes

Indicate in minutes to account for the time differences among devices.

This is referred to as SAML NotBefore in the SAML specifications.

Recommended value is five minutes.

IdP Signing Certificate

Click Select Certificate, choose the IdP signing certificate to use, and then click Select to close the box.

IdP Signing Certificate Serial Number

When you select an IdP signing certificate, the serial number populates this field.

Signing Algorithm

The signing algorithm digitally signs the SAML assertion and response.

Choose the signing algorithm – SHA1 or SHA2 (slightly stronger encryption hash and is not subject to the same vulnerabilities as SHA1).

Sign SAML Assertion

Indicate whether the Identity Platform signs the SAML assertion sent to the Epic database as the service provider (SP).

The signed certificate ensures assertion integrity from the Identity Platform.

Sign SAML Message

Indicate whether the Identity Platform signs the SAML message, including the SAML assertion, sent to the Epic database as the service provider (SP).

The signed certificate ensures message integrity from the Identity Platform.

Encrypt SAML Assertion

Indicate whether the Identity Platform sends an encrypted SAML assertion to the Epic database as the service Provider (SP).

If the slider is ON, then select the data and key encryption methods:

Attribute Name

Provide the attribute name from the directory to which identifies the user to the Epic database.

For example, givenname

Data Store Property

Select the data store property which maps to this directory attribute.

For example, First Name

Namespace (1.1)

Set the authorization URL to tell the Epic database which attribute is being asserted.

Filtered Group

Provide the group names from the directory to ensure users have appropriate view permissions based on their group membership. You can use a full regular expression or full group domain name list.

When the Data Store Property is set to Groups, use the regular expression like this: .*(Group1|Group2|Group3)

When the Data Store Property is set to Full Group DN List, use the full group domain name list like this: .*(cn=admin,dc=acme,dc=com|cn=devops, dc=acme,dc=com)

Login URL, Logout URL, IdP Issuer

Click Copy to Clipboard to copy the Identity Platform realm information and paste it in the corresponding field on the service provider user interface, as required.

IdP Signing Certificate

Download the IdP Signing Certificate.

Download Metadata

To download the metadata file: