Epic EPCS VAM Deployment Guide

The physician enters a username and is prompted for a method to receive the required password; if RequirePassword key is set to 1 in SASettings.xml, or else it skips to step 3 in the login workflow.

The physician enters the password and presses Enter.

This opens a user interface with list of available MFA options.

The physician needs to select a preferred MFA option and presses Enter.

Based on the selected MFA option, the next page appears to complete 2FA.

The physician receives entry to the EPCS system.

The physician enters a user name and is prompted for a method to receive the required passcode.

The physician receives the passcode on their registered device.

The physician enters the received passcode and presses Enter.

The physician is granted access to the EPCS system.

The physician enters a user name and is prompted for a fingerprint.

The physician authenticates with a fingerprint on the mobile device.

The physician opens the application on their mobile device or computer.

The application prompts the physician for authentication. At the same time, the secondary device is activated.

The physician pushes a button on the secondary device to accept the request for entry.

The application then allows physician access to the required data.

Designate a realm in your Identity Platform appliance to provide API access to the SecureAuth Epic EPCS VAM.

For more information about creating a new realm, see SecureAuth IdP Realm Guide.

Go to the Data tab and configure the required fields for a data store integration.

A data store integration is required for the Identity Platform to pull user profile information during the login process. For more information about configuring the Data tab, see Data Tab Configuration.

Select the API tab.

In the API Key section do the following:

In the API Permissions section, do the following:

1. Select the Enable Authentication API check box.

Save your changes.

Copy the provided ZIP file to a location on the system running Hyperspace.

Do one of the following:

Extract the SecureAuth folder to the C:\ drive. This folder can be installed in another location if write access is provided to the logs folder.

Open the SecureAuth folder and run RegisterSALoginDevice.bat as an Administrator.

UnRegister - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Epic EPCS Login Device\SecureAuthLoginDevice.dll" /u

Register - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Epic EPCS Login Device\SecureAuthLoginDevice.dll" /codebase

This adds SecureAuthLoginDevice.dll to the system code base.

Open SASettings.xml using a text editor and modify the following settings:

Refer to the following sample of the SASettings.xml file.

<?xml version="1.0" encoding="utf-8" ?>
<SASettings>
	<sASetting EPICVersion="Hyperspace" />
	<sASetting WindowTitle="SecureAuth EPIC Login" />
	<sASetting SecureAuthAPIUrl="https://<domain>/SecureAuthXX" />
	<sASetting EPCSUrl="" />
	<sASetting AppID="xxxxxxxxxxxxxx" />
	<sASetting AppKey="xxxxxxxxxxxxxxxxxxxxxxxxxxxx" />
	<sASetting Retry="3" />
	<sASetting LogLevel="2" />
	<sASetting EnablePush="1" />
	<sASetting LogoPath="logo.png" />
	<sASetting RequirePassword="0" />
	<sASetting PreferStaticPin="1" />
	<sASetting PreventNonMobileDevices="0" />
	<sASetting ShowMFA="1" />
	<sASetting MFAOrder="PUSH,TOTP,PIN" />
	<sASetting BioLogoPath="bioLogo.png" />
	<sASetting PinLogoPath="pinLogo.png" />
	<sASetting NoMFAError="Please select one of the available MFA method." />
	<sASetting NoMFASelected="Please select a MFA." />
	<sASetting AcceptDenyPushRequest="Please Accept/Deny the push request sent to your device" />
	<sASetting APIConnectionError="Unable to validate or send {reqType} push request." />
	<sASetting APIDeniedError="Push Request Denied." />
	<sASetting APIFailedError="Push Request Failed." />
	<sASetting APINotFoundError="Push Request Not Found." />
	<sASetting APIInvalidError="Push Request Invalid." />
	<sASetting APIUnknownError="Push Request Unknown Error." />
	<sASetting EnterPasscode="Enter Passcode sent to your device." />
	<sASetting EnterTOTP="Enter the code from your SecureAuth OTP Mobile App." />
	<sASetting EnterPIN="Enter your registration PIN." />
	<sASetting UnknownMFAError="Some error occurs! Please select another MFA method." />
	<sASetting PasscodeNotMatchError="Provided passcode does not match." />
	<sASetting SelectedDeviceError="Selected device is not a mobile device. Please contact to administrator." />
	<sASetting TOTPNotMatchError="Provided TOTP does not match." />
	<sASetting BlankPasscode="Please enter the passcode sent to your device." />
	<sASetting BlankTOTP="Please enter the code from your SecureAuth OTP Mobile App." />
	<sASetting BlankPIN=" Please enter your registration PIN." />
</SASettings>

Save the SASettings.xml file.

In Chronicles, access the Authentication Devices (E0G) master file, then go to <Data Management> 1. Enter Data | Create/Edit Device <Y>.

Enter a name for the device. For example, SecureAuthLoginDevice.

Enter a new ID. For example, 10001+.

On the General Settingspage, set the following:

On the Desktop Settings page in the ProgID field, enter SecureAuthLoginDevice.Receiver2 supporting both Hyperdrive and Hyperspace which is for EPIC VAM version 3.1+.

Open Hyperspace and go to Epic | Admin | Access Management | Authentication Administration.

Select the System level.

Select the desired Context.

Set the first authentication method as the Primary Device.

Typically, this is the username and password.

Set the SecureAuthLoginDevice as the Secondary Device.

Click Accept.

From the SecureAuth folder, open the Test folder.

Run the StandAloneNETTester.exe file.

The MainForm window appears.

In the ProgID field, enter SecureAuthLoginDevice.Receiver2.

Click Authenticate.

The RequestForm window appears.

Do the following:

Click Add Data.

Click Return True.

Follow the authentication flow as prompted on the screen.

After successful authentication, you will see the following screen.